Skip navigation

STANFORD UNIVERSITY

INFORMATION TECHNOLOGY SERVICES

WebAuth 2013-05-15 Advisory

Vulnerability type: Authentication credential disclosure
Versions affected: 4.4.1 through 4.5.2
Versions fixed: 4.5.3 and later
Reported: 2013-05-15
Public announcement: 2013-05-15
CVE ID: CVE-2013-2106

WebAuth 4.4.1 was changed to use a persistent CGI::Application object for the WebLogin application when run under FastCGI. However, CGI::Application does not reset header state automatically between FastCGI requests, and WebLogin was not modified to do so. In most situations, this caused no problems, since WebLogin overrode the previous header state with new values when answering the request. However, it did not do so when redirecting a user for REMOTE_USER authentication using the $REMUSER_REDIRECT WebLogin option.

Therefore, if WebLogin were configured with the $REMUSER_REDIRECT option and running under FastCGI, a user using REMOTE_USER authentication may receive WebLogin cookies intended for a previous user of the same FastCGI login.fcgi process, enabling them to authenticate to other web sites as the previous user.

This bug is fixed in WebAuth 4.5.3. To fix this bug without upgrading to that version, apply this patch to the WebLogin.pm Perl module.

For Debian and Ubuntu users, all versions of WebAuth with this vulnerability were only uploaded to Debian experimental and did not appear in any release. For Stanford users, no version of WebLogin with this vulnerability was ever deployed in production.

WebAuth 4.5.3 is available from:

http://webauth.stanford.edu/

Direct download links to the release and the PGP signature of the release:

http://webauth.stanford.edu/dist/webauth-4.5.3.tar.gz
http://webauth.stanford.edu/dist/webauth-4.5.3.tar.gz.asc

Last modified Tuesday, 28-May-2013 12:57:52 PM

Stanford University Home Page