OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
[SA24845] CoSign POST Request Carriage Return Insertion Vulnerabilities

From: Secunia Security Advisories (sec-advsecunia.com)
Date: Thu Apr 12 2007 - 04:02:05 CDT

----------------------------------------------------------------------

Secunia customers receive relevant and filtered advisories.
Delivery is done via different channels including SMS, Email, Web,
and https based XML feed.
http://corporate.secunia.com/trial/38/request/

----------------------------------------------------------------------

TITLE:
CoSign POST Request Carriage Return Insertion Vulnerabilities

SECUNIA ADVISORY ID:
SA24845

VERIFY ADVISORY:
http://secunia.com/advisories/24845/

CRITICAL:
Moderately critical

IMPACT:
Hijacking, Security Bypass

WHERE:
From remote

SOFTWARE:
CoSign 1.x
http://secunia.com/product/13914/
CoSign 2.x
http://secunia.com/product/13915/

DESCRIPTION:
Jon Oberheide has reported two vulnerabilities in CoSign, which can
be exploited by malicious users to hijack other user sessions and by
malicious people to bypass certain security restrictions.

Certain input passed via POST requests are not properly sanitised
before being used by the daemon. These can be exploited to insert
certain commands via carriage return sequences in the cookie or data
of a POST request.

Successful exploitation e.g. allows a non-authenticated user to
bypass the authentication mechanism and an authenticated user to
assume the identity of other users.

The vulnerabilities are reported in versions 2.0.1 and 2.0.2. Other
versions may also be affected.

SOLUTION:
Apply patch or update to version 2.0.2a or 1.9.4b.
http://www.umich.edu/~umweb/downloads/cosign-1.9.4-vuln-patch.txt
http://www.umich.edu/~umweb/downloads/cosign-1.9.4b.tar.gz
http://www.umich.edu/~umweb/downloads/cosign-2.0.2a.tar.gz

PROVIDED AND/OR DISCOVERED BY:
Jon Oberheide, University of Michigan

ORIGINAL ADVISORY:
http://www.umich.edu/~umweb/software/cosign/cosign-vuln-2007-001.txt
http://www.umich.edu/~umweb/software/cosign/cosign-vuln-2007-002.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------