By Drupal Security Team on
  • Advisory ID: DRUPAL-SA-CONTRIB-2011-022
  • Project: cosign (third-party module)
  • Version: 6.x
  • Date: 2011-June-08
  • Security risk: Less critical
  • Exploitable from: Remote
  • Vulnerability: SQL Injection

Description

Under certain conditions the module deletes uid 1 and then does an unparameterized db_query to insert a new uid 1.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer site configuration" and must be able to remotely manipulate the web server environmental variables REMOTE_USER and REMOTE_REALM.

Versions affected

  • 6.x-1.4
  • 6.x-1.5
  • 6.x-1.6

Drupal core is not affected. If you do not use the contributed cosign module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the Cosign module for Drupal 6.x, upgrade to version 6.x-1.7.

See also the cosign project page.

Reported by

Fixed by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

⋅ Categories: Drupal 6.x