When contributed modules such as Workflow NG terminate the current request during a login event, user module is not able to regenerate the user's session.
Credit:
The information has been provided by Erich C. Beyrent.
Vulnerable Systems:
* Drupal 5.x before version 5.9
When contributed modules such as Workflow NG terminate the current request during a login event, user module is not able to regenerate the user's session. This may lead to a session fixation attack, when a malicious user is able to control another users' initial session ID. As the session is not regenerated, the malicious user may use the 'fixed' session ID after the victim authenticates and will have the same access.
The advisory SA-2008-044 claims that this session fixation vulnerability was fixed in Drupal 5.8 and 6.3. Unfortunately, Drupal 5.8 still contains this vulnerability.
Vendor Status:
Drupal issued an update for this vulnerability
