high7.5Public exploit code
CVE-2007-2232
The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR (\r) sequences in the cosign cookie paramete…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Cosign 2.0.1/2.9.4a - CGI Check Cookie Command Remote Authentication Bypass2007-04-11 · webapps · cgi · Verified
Impact
The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR (\r) sequences in the cosign cookie parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cosign | Cosign | Versions 0.7.0, 0.8.0, 0.9.0, 1.0, 1.1, 1.5 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/24845
- http://www.securityfocus.com/archive/1/465386/100/100/threaded
- http://www.umich.edu/~umweb/software/cosign/cosign-vuln-2007-001.txt
- http://www.vupen.com/english/advisories/2007/1359
- http://secunia.com/advisories/24845
- http://www.securityfocus.com/archive/1/465386/100/100/threaded
- http://www.umich.edu/~umweb/software/cosign/cosign-vuln-2007-001.txt
- http://www.vupen.com/english/advisories/2007/1359