* Advisory ID: DRUPAL-SA-CONTRIB-2009-069 * Project: Shared Sign On (third-party module) * Version: 5.x, 6.x * Date: 2009 September 30 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- The Shared Sign On module enables users to log into one Drupal site and be automatically logged into multiple related Drupal sites. The module suffers multiple vulnerabilities, including Cross Site Request Forgeries (CSRF [1]) and Session fixation problem (Session Fixation [2]). This problem allows an attacker to hijack the account of a logged in user by tricking them into visiting a seemingly innocent page. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions of Shared Sign On for both Drupal 5.x and Drupal 6.x Drupal core is not affected. If you do not use the contributed Shared Sign On module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ The Shared Sign On module is marked as un-supported. A separate project called Single Sign On [3] has been created as a replacement. Download the Single Sign On module and carefully read the README.txt as there is a risk of breaking a site if instructions are not carried out correctly. -------- REPORTED BY --------------------------------------------------------- * Reported by Jose A. Reyero [4] and Steven Wittens [5]. -------- FIXED BY ------------------------------------------------------------ * Fixed by Steven Wittens [6] of Strutta Inc. and Jakub Suchy [7] of Drupal Security team and Heine Deelstra [8] of Drupal Security Team. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Csrf [2] http://en.wikipedia.org/wiki/Session_fixation [3] http://drupal.org/project/sso [4] http://drupal.org/user/4299 [5] http://drupal.org/user/10 [6] http://drupal.org/user/10 [7] http://drupal.org/user/31977 [8] http://drupal.org/user/17943