[CVE-2007-6013] Authentication cookies easily derivable from password hash

[William Grant]

Binary package hint: wordpress

Wordpress 1.5 to 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.

Combined with the prevalence of SQL injection in WordPress, this could be an issue. Otherwise it's fairly unimportant.

[Emanuele Gentili (emgent)]

diff for gutsy is ready.

[Emanuele Gentili (emgent)]

wrong post/patch, redirect to open CVE-2007-6318

[Emanuele Gentili (emgent)]

 wordpress | 2.0.2-2 | dapper/universe | source, all
 wordpress | 2.0.4-2 | edgy/universe | source, all
 wordpress | 2.1.0-1~edgy1 | edgy-backports/universe | source, all
 wordpress | 2.1.2-1ubuntu1~dapper1 | dapper-backports/universe | source, all
 wordpress | 2.1.3-1ubuntu1 | feisty/universe | source, all
 wordpress | 2.1.3-1ubuntu1.1 | feisty-security/universe | source, all
 wordpress | 2.1.3-1ubuntu1.1 | feisty-updates/universe | source, all
 wordpress | 2.2.2-1ubuntu1 | gutsy/universe | source, all
 wordpress | 2.2.2-1ubuntu1.3 | gutsy-security/universe | source, all
 wordpress | 2.2.2-1ubuntu1.3 | gutsy-updates/universe | source, all
 wordpress | 2.3.3-1ubuntu1 | hardy/universe | source, all

System Affected:
Wordpress 1.5 -- 2.3.1

Ubuntu status:
Hardy not affected.
Gutsy, Feisty, Edgy, Dapper affected.

[Emanuele Gentili (emgent)]

@ScottK: what do you think about the possibility to backport it?

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[Sergio Zanchetta (primes2h)]

The 18 month support period for Gutsy Gibbon 7.10 has reached its end of life -
http://www.ubuntu.com/news/ubuntu-7.10-eol . As a result, we are closing the
Gutsy task.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. dapper has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against dapper is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.