July 2009 - Security-news - lists.drupal.org

SA-CONTRIB-2009-049 - Live - Privilege escalation, Impersonation
by security-news＠drupal.org 29 Jul '09

29 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-049 * Project: Live (third-party module) * Version: 6.x * Date: 2009-July-29 * Security risk: Highly critical * Exploitable from: Remote * Vulnerability: Impersonation, privilege escalation -------- DESCRIPTION --------------------------------------------------------- The Live module provides dynamic previews of content. When editing certain content (nodes), the current user becomes logged in as the content's original author. -------- VERSIONS AFFECTED --------------------------------------------------- * Live for Drupal 6.x prior to 6.x-1.2 Drupal core is not affected. If you do not use the contributed Live module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Live for Drupal 6.x upgrade to Live 6.x-1.2 [1] See also the Live project page [2]. -------- REPORTED BY --------------------------------------------------------- Roderik Muit [3] -------- FIXED BY ------------------------------------------------------------ frjo [4] -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/534976 [2] http://drupal.org/project/live [3] http://drupal.org/user/8841 [4] http://drupal.org/user/5546

1 0

SA-CONTRIB-2009-048 - Bibliography Module - Cross Site Scripting
by security-news＠drupal.org 29 Jul '09

29 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-048 * Project: Bibliography Module (third-party module) * Version: 5.x, 6.x * Date: 2009-July-29 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Bibliography module (Biblio) allows users to manage and display lists of scholarly publications. The module contains a cross site scripting vulnerability because it does not properly sanitize output of titles before display. A user who has the permission to create content displayed by the Bibliography module could attempt a cross site scripting [1] (XSS) attack which may lead to the user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Bibliography Module versions 6.x prior to 6.x-1.6 * Bibliography Module versions 5.x prior to 5.x-1.17 Drupal core is not affected. If you do not use the contributed Bibliography module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Bibliography Module for Drupal 6.x upgrade to Bibliography Module 6.x-1.6 [2] * If you use the Bibliography Module for Drupal 5.x upgrade to Bibliography Module 5.x-1.17 [3] See also the Bibliography Module project page [4]. -------- REPORTED BY --------------------------------------------------------- Justin Klein Keane [5]. -------- FIXED BY ------------------------------------------------------------ Justin Klein Keane [6] and Ron Jerome [7] (the Bibliography module maintainer). -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/534744 [3] http://drupal.org/node/534752 [4] http://drupal.org/project/biblio [5] http://drupal.org/user/302225 [6] http://drupal.org/user/302225 [7] http://drupal.org/user/54997

1 0

SA-CONTRIB-2009-047 - Calendar - Cross Site Scripting
by security-news＠drupal.org 29 Jul '09

29 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-047 * Project: Calendar (third-party module) * Version: 6.x * Date: 2009-July-29 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Calendar module enables Views module to display any Date module date field as a calendar. The module does not properly escape user input when displaying titles of content types that have Date fields. A user with permission to create new content types (including via the Date module's Date Tools sub-module) could attempt a cross site scripting [1] (XSS) attack, leading to the user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Calendar for Drupal 6.x prior to 6.x-2.2 Drupal core is not affected. If you do not use the contributed Calendar module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Calendar for Drupal 6.x upgrade to Calendar 6.x-2.2 [2] See also the Calendar project page [3]. -------- REPORTED BY --------------------------------------------------------- Justin C. Klein Keane [4] -------- FIXED BY ------------------------------------------------------------ Justin C. Klein Keane [5] -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/534336 [3] http://drupal.org/project/calendar [4] http://drupal.org/user/302225 [5] http://drupal.org/user/302225

1 0

SA-CONTRIB-2009-046 - Date - Cross Site Scripting
by security-news＠drupal.org 29 Jul '09

29 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-046 * Project: Date (third-party module) * Version: 6.x * Date: 2009-July-29 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Date module provides a date CCK field that can be added to any content type. The Date Tools module that is bundled with Date module does not properly escape user input when displaying labels for fields on a content type. A malicious user with the 'use date tools' permission of the Date Tools sub-module, or the 'administer content types' permission could attempt a cross site scripting [1] (XSS) attack when creating a new content type, leading to the user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Date for Drupal 6.x prior to 6.x-2.3 Drupal core is not affected. If you do not use the contributed Date module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Date for Drupal 6.x upgrade to Date 6.x-2.3 [2] Note that the 'use date tools' permission has been renamed as 'administer date tools' to clarify that this is an administrative permission (it allows the creation of new content types via a wizard form). You will need to re-assign this permission to any roles that were using it. See also the Date project page [3]. -------- REPORTED BY --------------------------------------------------------- Stella Power [4] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ Stella Power [5] and Karen Stevenson [6], the project maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/534332 [3] http://drupal.org/project/date [4] http://drupal.org/user/66894 [5] http://drupal.org/user/66894 [6] http://drupal.org/user/45874

1 0

SA-CONTRIB-2009-045: Moderation - Cross Site Request Forgery
by security-news＠drupal.org 22 Jul '09

22 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-045 * Project: Moderation (third-party module) * Version: 5.x, 6.x * Date: 2009-07-22 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Cross-site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Moderation module uses Ajax to provide a dynamic moderation queue for nodes and comments. The module is vulnerable to cross-site request forgeries (CSRF [1]) via the AJAX hooks used to toggle the moderation bit. It allows a non-administrative user to trick an admin into publishing arbitrary moderated content by directing them to the url via link or image src, etc. -------- VERSIONS AFFECTED --------------------------------------------------- * Moderation versions 5.x-1.x prior to 5.x-1.2 * Moderation versions 6.x-1.x prior to 6.x-1.3 Drupal core is not affected. If you do not use the contributed Moderation module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Moderation versions for Drupal 5.x upgrade to Moderation version 5.x-1.2 [2] * If you use Moderation versions for Drupal 6.x upgrade to Moderation version 6.x-1.3 [3] See also the Moderation [4] project page. -------- REPORTED BY --------------------------------------------------------- Ben Ford. -------- FIXED BY ------------------------------------------------------------ Stefan Auditor [5], the Moderation project maintainer, with assistance from Ben Jeavons [6] of the Drupal Security Team [7] -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Csrf [2] http://drupal.org/node/527866 [3] http://drupal.org/node/527864 [4] http://drupal.org/project/moderation [5] http://drupal.org/user/28074 [6] http://drupal.org/user/91990 [7] http://drupal.org/security-team

1 0

SA-CONTRIB-2009-044 - Bubbletimer - Multiple vulnerabilities
by security-news＠drupal.org 22 Jul '09

22 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-044 * Project: Bubbletimer (third-party module) * Version: 6.x * Date: 2009-July-22 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- Bubbletimer allows users to create timesheets based on nodes. It suffers from a cross-site scripting [1] (XSS) vulnerability due to not properly sanitizing node titles before they are displayed. It is also vulnerable to cross-site request forgeries [2] (CSRF) making it possible for users to unknowingly add nodes to, or remove nodes from, their timesheets. Together, these vulnerabilities could lead to an attacker gaining administrator access. Additionally, the module does not respect node access restrictions when displaying node listings. -------- VERSIONS AFFECTED --------------------------------------------------- * Bubbletimer for Drupal 6.x prior to Bubbletimer 6.x-1.5 Drupal core is not affected. If you do not use the contributed Bubbletimer module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Bubbletimer for Drupal 6.x upgrade to Bubbletimer 6.x-1.5 [3] See also the Bubbletimer project page [4]. -------- REPORTED BY --------------------------------------------------------- * The CSRF issue was reported by Andrew Berry [5]. * The XSS issue was reported by Stéphane Corlosquet [6] of the Drupal Security Team. * The access bypass issue was reported by John Morahan [7] of the Drupal Security Team. -------- FIXED BY ------------------------------------------------------------ * Peter Arato [8], the Bubbletimer module maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://en.wikipedia.org/wiki/Cross-site_request_forgery [3] http://drupal.org/node/527372 [4] http://drupal.org/project/bubbletimer [5] http://drupal.org/user/71291 [6] http://drupal.org/user/52142 [7] http://drupal.org/user/58170 [8] http://drupal.org/user/428960

1 0

SA-2009-043 - Image Assist - Multiple vulnerabilities
by security-news＠drupal.org 16 Jul '09

16 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-043 * Project: Image Assist (third-party module) * Version: 5.x, 6.x * Date: 2009-07-15 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross site scripting, Information disclosure -------- DESCRIPTION --------------------------------------------------------- The Image Assist module for Drupal 5.x and 6.x allows users to upload and insert inline images into posts. Two vulnerabilities and weaknesses were discovered in the contributed Image Assist module. .... Cross site scripting The node title is treated as if it was safe text, and is not escaped before being output. A user with sufficient permissions to create image nodes could insert malicious script code into the title field. Any user with access to the Image Assist properties page or any user viewing an embedded image in a popup is vulnerable to a cross-site scripting attack. Wikipedia has more information about such cross site scripting [1] (XSS) attacks. .... Information disclosure Some pages of the module do not properly check for required access permissions, allowing unprivileged users to view the title and body of arbitrary nodes. -------- VERSIONS AFFECTED --------------------------------------------------- * Image Assist for Drupal 5.x-1.x before version 5.x-1.8 * Image Assist for Drupal 5.x-2.x before version 2.0-alpha4 * Image Assist for Drupal 6.x-1.x before version 6.x-1.1 * Image Assist for Drupal 6.x-2.x before version 2.0-alpha4 * Image Assist for Drupal 6.x-3.x-dev before 2009-07-15 Drupal core is not affected. If you do not use the contributed Image Assist module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you currently use Image Assist 5.x-1.x upgrade to Image Assist 5.x-1.8 [2] * If you currently use Image Assist 5.x-2.x upgrade to Image Assist 5.x-2.0-alpha4 [3] * If you currently use Image Assist 6.x-1.x upgrade to Image Assist 6.x-1.1 [4] * If you currently use Image Assist 6.x-2.x upgrade to Image Assist 6.x-2.0-alpha4 [5] * If you currently use Image Assist 6.x-3.x-dev upgrade to Image Assist 6.x-3.x-dev after 2009-07-15 See also the Image Assist project page [6]. -------- REPORTED BY --------------------------------------------------------- Stefan M. Kudwien (smk-ka) [7] -------- FIXED BY ------------------------------------------------------------ Daniel F. Kudwien (sun) [8], the project maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Xss [2] http://drupal.org/node/520592 [3] http://drupal.org/node/520586 [4] http://drupal.org/node/520590 [5] http://drupal.org/node/520584 [6] http://drupal.org/project/img_assist [7] http://drupal.org/user/48898 [8] http://drupal.org/user/54136

1 0

SA-CONTRIB-2009-042 - Submitted By - Cross Site Scripting
by security-news＠drupal.org 15 Jul '09

15 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-042 * Project: Submitted By (third-party module) * Version: 6.x * Date: 2009-July-15 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Submitted By is a module to let you control the format of the "Submitted by" information on your content per content type. This module does not properly escape user input used in building the string to display the "submitted by" text. Only administrators with the 'administer content types' permission can enter this text. A user with this administrative privileges could attempt a cross site scripting [1] (XSS) attack which may lead to the user gaining full administrative access. In general, the permission "administer content types" is comparable in scope to the "administer site configuration" permission. Only grant this permission to trusted site administrators. See: http://drupal.org/node/372836 -------- VERSIONS AFFECTED --------------------------------------------------- * Submitted By for Drupal 6.x prior to 6.x-1.3 Drupal core is not affected. If you do not use the contributed Submitted By module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Submitted By for Drupal 6.x upgrade to Submitted By 6.x-1.3 [2] See also the Submitted By project page [3]. -------- REPORTED BY --------------------------------------------------------- Nancy Wichmann [4], the project maintainer. -------- FIXED BY ------------------------------------------------------------ Nancy Wichmann [5], the project maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/519246 [3] http://drupal.org/project/submitted_by [4] http://drupal.org/user/101412 [5] http://drupal.org/user/101412

1 0

SA-CONTRIB-2009-041 - Nodequeue - Access bypass
by security-news＠drupal.org 08 Jul '09

08 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-041 * Project: Nodequeue (third-party module) * Version: 5.x, 6.x * Date: 2009-July-08 * Security risk: Not critical * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Nodequeue module enables an administrator to arbitrarily put nodes in a group with an arbitrary order for any purpose, such as providing a listing of nodes or featuring a particular node. On the queue administration screen, users with permission to manipulate a queue are presented with an autocomplete textfield that allows them to type the title of a node and add it to a queue. This textfield fails to restrict unpublished node titles from being displayed to users who lack the 'administer content' permission, allowing unprivileged users to view the title of unpublished nodes. -------- VERSIONS AFFECTED --------------------------------------------------- * Nodequeue 6.x prior to 6.x-2.3 * Nodequeue 5.x prior to 5.x-2.8 Drupal core is not affected. If you do not use the contributed Nodequeue module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Nodequeue 6.x upgrade to Nodequeue 6.x-2.3 [1] * If you use Nodequeue 5.x upgrade to Nodequeue 5.x-2.8 [2] See also the Nodequeue [3] project page. -------- REPORTED BY --------------------------------------------------------- Ezra Barnett Gildesgame (ezra-g [4]) -------- FIXED BY ------------------------------------------------------------ Ezra Barnett Gildesgame, the Nodequeue maintainer (ezra-g [5]) -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/513726 [2] http://drupal.org/node/513732 [3] http://drupal.org/project/nodequeue [4] http://drupal.org/user/69959/ [5] http://drupal.org/user/69959/

1 0

SA-CONTRIB-2009-040 - Advanced Forum - Multiple vulnerabilities
by security-news＠drupal.org 01 Jul '09

01 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-040 * Project: Advanced Forum (third-party module) * Version: 5.x, 6.x * Date: 2009-July-1 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- .... Cross-site scripting The Advanced Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS). This issue affects both Advanced Forum for Drupal 5.x and Advanced Forum for Drupal 6.x. .... Input format access bypass User signatures have no separate input format, they use the format of the comment with which they are displayed. A user will no longer be able to edit a comment when an administrator changes the comment's input format to a format that is not accessible to the user. However they will still be able to modify their signature, which will then be processed by the new input format. If the new format is very permissive, via their signature, the user may be able to insert arbitrary HTML and script code into pages or, when the PHP filter is enabled for the new format, execute PHP code. This issue affects Advanced Forum for Drupal 6.x only. -------- VERSIONS AFFECTED --------------------------------------------------- * Advanced Forum for Drupal 5.x prior to Advanced Forum 5.x-1.2 * Advanced Forum for Drupal 6.x prior to Advanced Forum 6.x-1.2 -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Advanced Forum for Drupal 5.x upgrade to Advanced Forum 5.x-1.1 [1] * If you use Advanced Forum for Drupal 6.x upgrade to Advanced Forum 6.x-1.1 [2] See also the Advanced Forum project page [3]. -------- FIXED BY ------------------------------------------------------------ Michelle Cox [4], the project maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/507550 [2] http://drupal.org/node/507526 [3] http://drupal.org/project/advanced_forum [4] http://drupal.org/user/23570

1 0