Detections
Analytics

Debian DSA-2851-1 : drupal6 - impersonation

high Nessus Plugin ID 72248

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Christian Mainka and Vladislav Mladenov reported a vulnerability in the OpenID module of Drupal, a fully-featured content management framework. A malicious user could exploit this flaw to log in as other users on the site, including administrators, and hijack their accounts.

These fixes require extra updates to the database which can be done from the administration pages.

Solution

Upgrade the drupal6 packages.

For the oldstable distribution (squeeze), this problem has been fixed in version 6.30-1.

See Also

https://packages.debian.org/source/squeeze/drupal6

https://www.debian.org/security/2014/dsa-2851

Plugin Details

Severity: High

ID: 72248

File Name: debian_DSA-2851.nasl

Version: 1.9

Type: local

Agent: unix

Published: 2/3/2014

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:drupal6, cpe:/o:debian:debian_linux:6.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 2/2/2014

Reference Information

CVE: CVE-2014-1475

BID: 64973

DSA: 2851