March 2009 - Security-news - lists.drupal.org

SA-CONTRIB-2009-018 - Feed element mapper - Cross site scripting
by security-news＠drupal.org 26 Mar '09

26 Mar '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-018 * Project: Feed element mapper (third-party module) * Version: 5.x * Date: 2009-March-26 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Cross-site scripting (XSS) -------- DESCRIPTION --------------------------------------------------------- Feed element mapper is an Add-on module for FeedAPI that maps elements on a feed item such as tags or the author name to taxonomy or CCK fields. These mappings are configurable by point and click. The module doesn't correctly escape content titles enabling malicious users to insert arbitrary HTML and scripts into certain pages. Such a cross site scripting [1] (XSS) attack against sufficiently privileged users may lead to adminstrator access to the site. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions of Feed element mapper for Drupal 5.x prior to 5.x-1.1 Drupal core is not affected. If you do not use the contributed Feed element mapper module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Feed element mapper for Drupal 5.x upgrade to Feed element mapper 5.x-1.1 [2] If you use one of the unsupported Feed element mapper 6.x-1.0 beta versions, upgrade to Feed element mapper 6.x-1.0-beta5 [3]. See also the Feed element mapper project page [4]. -------- REPORTED BY --------------------------------------------------------- James Gilliand [5] -------- FIXED BY ------------------------------------------------------------ Alex Barth [6] -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [7]. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/414644 [3] http://drupal.org/node/414640 [4] http://drupal.org/project/feedapi_mapper [5] http://drupal.org/user/48673 [6] http://drupal.org/user/53995 [7] http://drupal.org/contact

1 0

SA-CONTRIB-2009-017 - Vote Up/Down - Cross-site request forgery
by security-news＠drupal.org 25 Mar '09

25 Mar '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-017 * Project: Vote Up/Down (third-party module) * Version: 5.x, 6.x * Date: 2009-March-25 * Security risk: Not critical * Exploitable from: Remote * Vulnerability: Cross-site request forgery -------- DESCRIPTION --------------------------------------------------------- The Vote Up/Down module provides a voting widget for content that records votes using Ajax. The URL for voting is vulnerable to cross-site request forgeries (CSRF [1]) making it possible for users to unknowingly vote for content. -------- VERSIONS AFFECTED --------------------------------------------------- * Vote Up/Down 5.x-1.x prior to 5.x-1.1 * Vote Up/Down 6.x-1.x prior to 6.x-1.0-beta4 Drupal core is not affected. If you do not use the contributed Vote Up/Down module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Vote Up/Down 5.x-1.x upgrade to Vote Up/Down 5.x-1.1 [2] * If you use Vote Up/Down 6.x-1.x upgrade to Vote Up/Down 6.x-1.0-beta4 [3] See also the Vote Up/Down project page [4]. -------- REPORTED BY --------------------------------------------------------- Alexandr Shvets [5]. -------- FIXED BY ------------------------------------------------------------ Pratul Kalia [6]. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Csrf [2] http://drupal.org/node/413818 [3] http://drupal.org/node/413896 [4] http://drupal.org/project/vote_up_down [5] http://drupal.org/user/233667 [6] http://drupal.org/user/162357

1 0

SA-CONTRIB-2009-016 - Wikitools - Cross site scripting
by security-news＠drupal.org 25 Mar '09

25 Mar '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-016 * Project: Wikitools (third-party module) * Version: 5.x, 6.x * Date: 2009-March-25 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Cross-site scripting -------- DESCRIPTION --------------------------------------------------------- The Wikitools module provides several options to get a more wiki-like behavior for Drupal. On several pages, the Wikitools module prints out a parameter without escaping it. Malicious users are thus able to execute a cross site scripting [1] (XSS) attack when they entice users to visit a specifically crafted URL. This may lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Wikitools 5.x-1.x prior to 5.x-1.3 * Wikitools 6.x-1.x prior to 6.x-1.1 Drupal core is not affected. If you do not use the contributed Wikitools module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Wikitools 5.x-1.x upgrade to Wikitools 5.x-1.3 [2] * If you use Wikitools 6.x-1.x upgrade to Wikitools 6.x-1.1 [3] See also the Wikitools project page [4]. -------- REPORTED BY --------------------------------------------------------- Charlie Gordon [5] of the Drupal Security Team [6]. -------- FIXED BY ------------------------------------------------------------ Charlie Gordon [7] of the Drupal Security Team [8]. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/413754 [3] http://drupal.org/node/413750 [4] http://drupal.org/project/wikitools [5] http://drupal.org/user/157412 [6] http://drupal.org/security-team [7] http://drupal.org/user/157412 [8] http://drupal.org/security-team

1 0

SA-CONTRIB-2009-015 - Tokenauth - Access bypass
by security-news＠drupal.org 25 Mar '09

25 Mar '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-015 * Project: Token authentication (third-party module) * Version: 6.x * Date: 2009-March-25 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Token authentication module allows access to RSS feeds via a token without having to provide your username and password to the site. Token authentication did not properly use the Drupal Form API which would allow a malicious user to learn the site administrator's token giving them the ability to read any nodes on the site via an RSS feed. -------- VERSIONS AFFECTED --------------------------------------------------- * Token authentication 6.x-1.x prior to 6.x-1.1 Token authentication for Drupal 5.x is not affected by this vulnerability. Drupal core is not affected. If you do not use the contributed Token authentication module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Token authentication 6.x-1.x upgrade to Token authentication 6.x-1.1 [1] See also the Token authentication project page [2]. -------- REPORTED BY --------------------------------------------------------- Stéphane Corlosquet [3] of the Drupal Security Team [4]. -------- FIXED BY ------------------------------------------------------------ Stéphane Corlosquet [5] of the Drupal Security Team [6]. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/413728 [2] http://drupal.org/project/tokenauth [3] http://drupal.org/user/52142 [4] http://drupal.org/security-team [5] http://drupal.org/user/52142 [6] http://drupal.org/security-team

1 0

SA-CONTRIB-2009-014 - CCK Field Privacy - Access Bypass
by security-news＠drupal.org 23 Mar '09

23 Mar '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-014 * Project: CCK Field Privacy * Version: 6.x * Date: 2009-March-23 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- CCK Field Privacy was incorrectly updated for the Drupal 6.x menu system in such a way that the intended access controls for the administrative pages are by-passed for unprivileged users. This may allow users to change permissions on fields and lead to exposure of private content. -------- VERSIONS AFFECTED --------------------------------------------------- * CCK Field Privacy [1] module 6.x before version 6.x-1.1 Drupal core is not affected. If you do not use a contributed module from the list above on a Drupal 6 site, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you are using CCK Field Privacy 6.x update to CCK Field Privacy 6.x-1.1 [2] -------- IMPORTANT NOTES ----------------------------------------------------- This vulnerability was publicly disclosed. If you find a security vulnerability, please contact the Security team rather than posting a public issue. If you are a module maintainer, do not commit any security-related code fixes unless you have coordinated with the Security team. If you are the author of a contributed module being updated for Drupal 6.x, please read carefully the documentation on the Drupal 6 menu system to insure that you do not make the same mistake: http://drupal.org/node/109157 -------- REPORTED BY --------------------------------------------------------- This vulnerability was publicly disclosed. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/cck_field_privacy [2] http://drupal.org/node/409690

1 0

SA-CONTRIB-2009-012 - Printer, e-mail and PDF versions - Unrestricted e-mailing (spam)
by security-news＠drupal.org 18 Mar '09

18 Mar '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-012 * Project: Printer, e-mail and PDF versions (third-party module) * Versions: 5.x, 6.x * Date: 2009 March 18 * Security risk: Highly Critical * Exploitable from: Remote * Vulnerability: Unrestricted e-mailing (spam) The "Send by e-mail" module, part of the "Printer, e-mail and PDF versions" project, allows users to send e-mail messages while viewing content on the site. This module was found to have multiple vulnerabilities. -------- UNRESTRICTED E-MAILING (SPAM) --------------------------------------- Due to improper use of Drupal's flood control API, it is possible for spammers or spambots to send an unlimited numbers of e-mails using the "Send by e-mail" module. This vulnerability is very similar to the recent vulnerability found in the Forward module and reported in SA-CONTRIB-2009-009 [1]. The security team has received reports of this vulnerability being actively exploited on production sites using the Forward module. In addition, when sending out e-mails in HTML format, some content is not properly filtered, allowing malicious users to inject arbitrary HTML and script code into these e-mails. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions of "Printer, e-mail and PDF versions" 5.x prior to 5.x-4.4 * Versions of "Printer, e-mail and PDF versions" 6.x prior to 6.x-1.4 Drupal core is not affected. If you do not use the contributed "Printer, e-mail and PDF versions" module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use "Printer, e-mail and PDF versions" 5.x upgrade to Printer, e-mail and PDF versions 5.x-4.4 [2] * If you use "Printer, e-mail and PDF versions" 6.x upgrade to Printer, e-mail and PDF versions 6.x-1.4 [3] -------- REPORTED BY --------------------------------------------------------- João Ventura, the "Printer, e-mail and PDF versions" project maintainer -------- FIXED BY ------------------------------------------------------------ João Ventura, with assistance from James Gilliand and David Rothstein of the Drupal security team -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [4]. [1] http://drupal.org/node/398564 [2] http://drupal.org/node/406512 [3] http://drupal.org/node/406522 [4] http://drupal.org/contact

1 0

SA-CONTRIB-2009-013 CCK - Cross site scripting
by security-news＠drupal.org 18 Mar '09

18 Mar '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-013 * Project: Content Construction Kit (third-party module) * Version: 6.x * Date: 2009 March 18 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross-site scripting (XSS) -------- DESCRIPTION --------------------------------------------------------- The Node reference and User reference sub-modules, which are part of the Content Construction Kit (CCK) project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate referenced nodes or names of candidate referenced users are not properly filtered, allowing malicious users to inject arbitrary code on those pages. Such a cross site scripting [1] (XSS) attack may lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions of CCK for Drupal 6.x prior to 6.x-2.2 Drupal core is not affected. If you do not use the Node reference or User reference sub-modules of the contributed Content Construction Kit (CCK) project, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use CCK for Drupal 6.x upgrade to CCK 6.x-2.2 [2] See also the Content Construction Kit (CCK) project page [3]. -------- REPORTED BY --------------------------------------------------------- Yves Chedemois (yched [4]). -------- FIXED BY ------------------------------------------------------------ Yves Chedemois (yched [5]). -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/406534 [3] http://drupal.org/project/cck [4] http://drupal.org/user/39567 [5] http://drupal.org/user/39567

1 0

SA-CONTRIB-2009-011 Tasklist - SQL injection and Cross site scripting
by security-news＠drupal.org 18 Mar '09

18 Mar '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-011 * Project: Tasklist (third-party module) * Version: 5.x * Date: 2009 March 18 * Security risk: Highly critical * Exploitable from: Remote * Vulnerability: SQL injection and Cross-site scripting (XSS) -------- DESCRIPTION --------------------------------------------------------- Tasklist does not properly use the Drupal database API and inserts values from the URL directly into queries. This can be exploited to perform SQL Injection attacks [1]. These attacks may lead to a malicious user gaining full administrator access. In addition, Tasklist allows users to add CSS to pages. This CSS was not restricted or filtered, allowing malicious users to insert arbitrary HTML and script code into these pages. Such a cross site scripting [2] (XSS) attack may also lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Tasklist 5.x-1.x prior to 5.x-1.3 * Tasklist 5.x-2.x prior to 5.x-2.0-alpha1 Drupal core is not affected. If you do not use the contributed Tasklist module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Tasklist 5.x-1.x upgrade to Tasklist 5.x-1.3 [3] * If you use Tasklist 5.x-2.x (development snapshots) upgrade to Tasklist 5.x-2.0-alpha1 [4] Tasklist for Drupal 4.7.x is no longer supported. See also the Tasklist project page [5]. -------- REPORTED BY --------------------------------------------------------- John Morahan of the Drupal Security Team [6]. -------- FIXED BY ------------------------------------------------------------ Stéphane Corlosquet of the Drupal Security Team [7]. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [8]. [1] http://en.wikipedia.org/wiki/Sql_injection [2] http://en.wikipedia.org/wiki/Cross-site_scripting [3] http://drupal.org/node/406482 [4] http://drupal.org/node/406488 [5] http://drupal.org/project/tasks [6] http://drupal.org/security-team [7] http://drupal.org/security-team [8] http://drupal.org/contact

1 0

SA-CONTRIB-2009-010 Plus 1 - Cross-site request forgery
by security-news＠drupal.org 18 Mar '09

18 Mar '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-010 * Project: Plus 1 (third-party module) * Version: 6.x * Date: 2009 March 18 * Security risk: Not critical * Exploitable from: Remote * Vulnerability: Cross-site request forgery (CSRF) -------- DESCRIPTION --------------------------------------------------------- The Plus 1 module provides a voting widget for content that records votes using Ajax. The URL for voting is vulnerable to cross-site request forgeries (CSRF [1]) making it possible for users to unknowingly vote for content. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions of Plus 1 prior to 6.x-2.6 Drupal core is not affected. If you do not use the contributed Plus 1 module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Plus 1 for Drupal 6.x upgrade to Plus 1 6.x-2.6 [2] See also the Plus 1 project page [3]. -------- REPORTED BY --------------------------------------------------------- Greg Knaddison of the Drupal security team. -------- FIXED BY ------------------------------------------------------------ Greg Knaddison, Ben Jeavons, Neil Drumm, and Caroline Schnapp. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [4]. [1] http://en.wikipedia.org/wiki/Csrf [2] http://drupal.org/node/405672 [3] http://drupal.org/project/plus1 [4] http://drupal.org/contact

1 0

New pages and RSS feeds for security announcements
by security-news＠drupal.org 18 Mar '09

18 Mar '09

-------- SEPARATE SECURITY ANNOUNCEMENTS BY TYPE ----------------------------- To make the impact of different security advisories and announcements easier to see, they are now separated by type. Drupal core security advisories: http://drupal.org/security [1] RSS feed for Drupal core: http://drupal.org/security/rss.xml [2] Contributed project security advisories: http://drupal.org/security/contrib [3] RSS feed for contributed projects: http://drupal.org/security/contrib/rss.xml [4] Public service announcements: http://drupal.org/security/psa [5] RSS feed for announcements: http://drupal.org/security/psa/rss.xml [6] /We encourage those using RSS readers to track security-related developments to subscribe to all three of these feeds./ All posts to each of these three forums will still be sent to the one security announcements e-mail list. To subscribe to that e-mail list, once logged in, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab. All future public service announcements will only be posted to the /Public service announcements/ page and feed. -------- BACKGROUND ON THE CHANGES ------------------------------------------- At Drupalcon in Washington, D.C. earlier this month, members of the Security team held a "Birds of a Feather" session to discusses various topics including improvements to our process of communicating with the public. One outcome of this meeting was that we decided to more clearly differentiate among security advisories for Drupal core (which affect all users) as opposed to security advisories for contributed projects (which are often used by only tens of sites). In addition, the security team has on occasion issued announcements (such as this one), which were previously mixed in with actual security advisories. Since the Drupal 6.x upgrade of http://drupal.org [7], newsletter postings have been managed using forums. The security team has thus split security-related postings among three forums under http://drupal.org/forum/1188 [8]. All past and new advisories and announcements and their feeds can be viewed (via tabs) on http://drupal.org/security [9]. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [10]. [1] http://drupal.org/security [2] http://drupal.org/security/rss.xml [3] http://drupal.org/security/contrib [4] http://drupal.org/security/contrib/rss.xml [5] http://drupal.org/security/psa [6] http://drupal.org/security/psa/rss.xml [7] http://drupal.org [8] http://drupal.org/forum/1188 [9] http://drupal.org/security [10] http://drupal.org/contact

1 0