SA-CONTRIB-2012-085 - BrowserID - Multiple Vulnerabilities

CSRF Issue:
CVE: CVE-2012-2713

BrowserID login theft:
CVE: CVE-2012-2714

The BrowserID module provides integration with BrowserID (also known as Mozilla Persona) – a Mozilla project that lets users of your site quickly and easily log in without needing to remember a password specific to your site.

The module did not sufficiently validate requests for authentication to log in, potentially allowing a Cross Site Request Forgery (CSRF) attack and introducing the possibility that logging in to a malicious site with BrowserID could give that site the ability to log in to other websites using your BrowserID identity.

Versions affected

• BrowserID (Mozilla Persona) 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed BrowserID (Mozilla Persona) module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the BrowserID module for Drupal 7.x, upgrade to BrowserID 7.x-1.3

This version adds a dependency on the Session API module. Make sure you install Session API before upgrading to BrowserID 7.x-1.3.

Also see the BrowserID (Mozilla Persona) project page.

Reported by

• Isaac Sukin, the module maintainer

Fixed by

• Isaac Sukin, the module maintainer
• Greg Knaddison of the Drupal Security Team
• Ben Adida of Mozilla

Coordinated by

• Greg Knaddison of the Drupal Security Team