From:	 Adrian Chung <adrian@enfusion-group.com>
To:	 bugtraq@securityfocus.com
Subject: Cookie modification allows unauthenticated user login in Geeklog 1.3
Date:	 Thu, 10 Jan 2002 12:22:02 -0500

A major security vulnerability exists in Geeklog 1.3, released on
December 30th, 2001.

When permanent cookies are enabled, as they are in a stock install,
Geeklog stores a user's UID in a cookie upon successful login.

This cookie is subsequently used during future visits to the site to
automatically initiate an authenticated session as the UID in the
cookie.

Modification of the UID in the cookie allows any user to assume the
identity of any other registered user, including the administrative
user.

A bug report was submitted to the author on January 9th, and fixes
were made available shortly after, with instructions on where to
obtain them posted at the Geeklog website (http://www.geeklog.org).

Geeklog is a 'blog', otherwise known as a Weblog. It allows you to
create your own virtual community area, complete with user
administration, story posting, messaging, comments, polls, calendar,
weblinks, and more! It can run on many different operating systems,
and uses PHP4 and MySQL.

--
Adrian Chung (adrian at enfusion-group dot com)
http://www.enfusion-group.com/~adrian
GPG Fingerprint: C620 C8EA 86BA 79CC 384C E7BE A10C 353B 919D 1A17
[rogue.enfusion-group.com] up 161 days, 4:03, 5 users