Russ Allbery > Software > Orphaned Software > WebAuth | 2009-09-10 Advisory > |
Vulnerability type: | Authentication credential disclosure |
Versions affected: | 4.4.1 through 4.5.2 |
Versions fixed: | 4.5.3 and later |
Reported: | 2013-05-15 |
Public announcement: | 2013-05-15 |
CVE ID: | CVE-2013-2106 |
WebAuth 4.4.1 was changed to use a persistent CGI::Application object for
the WebLogin application when run under FastCGI. However,
CGI::Application does not reset header state automatically between FastCGI
requests, and WebLogin was not modified to do so. In most situations,
this caused no problems, since WebLogin overrode the previous header state
with new values when answering the request. However, it did not do so
when redirecting a user for REMOTE_USER
authentication using the
$REMUSER_REDIRECT
WebLogin option.
Therefore, if WebLogin were configured with the $REMUSER_REDIRECT
option and running under FastCGI, a user using REMOTE_USER
authentication may receive WebLogin cookies intended for a previous user
of the same FastCGI login.fcgi
process, enabling them to
authenticate to other web sites as the previous user.
This bug is fixed in WebAuth 4.5.3. To fix this bug without upgrading to
that version, apply the following patch to the WebLogin.pm
Perl
module:
--- a/perl/lib/WebLogin.pm +++ b/perl/lib/WebLogin.pm @@ -167,6 +167,11 @@ sub setup { sub cgiapp_prerun { my ($self) = @_; + # Reset the header type and all header properties for clean state for + # each request. + $self->header_props ({}); + $self->header_type ('header'); + # Clear any per-query state that was stored as parameters. for my $param (@PER_QUERY_PARAMS) { $self->param ($param, undef);
For Debian and Ubuntu users, all versions of WebAuth with this vulnerability were only uploaded to Debian experimental and did not appear in any release. For Stanford users, no version of WebLogin with this vulnerability was ever deployed in production.
WebAuth 4.5.3 is available from:
Russ Allbery > Software > Orphaned Software > WebAuth | 2009-09-10 Advisory > |