March 2010 - Security-news - lists.drupal.org

SA-CONTRIB-2010-033 - Taxonomy Filter - Cross Site Scripting (XSS)
by security-news＠drupal.org 31 Mar '10

31 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-033 * Project: Taxonomy Filter (third-party module) * Version: 6.x * Date: 2010-March-31 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Taxonomy Filter module enables users to filter node listings by multiple taxonomy terms across multiple vocabularies. Vocabulary names, terms, and filter menus are not sanitized, creating a Cross Site Scripting (XSS) vulnerability. Exploiting this vulnerability would allow a malicious user to gain full administrative access, or worse. To exploit the vulnerability a user would either need to have a role with 'administer taxonomy' permission or a site would need to use free tagging and a user would need the ability to create a node that has free tagging enabled. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions of Taxonomy Filter for Drupal 6.x prior to 6.x-1.1 [1] Versions of Taxonomy Filter for Drupal 5.x are not affected. Drupal core is not affected. If you do not use the 6.x version of the contributed Taxonomy Filter module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Taxonomy Filter for Drupal 6.x upgrade to Taxonomy Filter 6.x-1.1 [2] or any later version. Also see the Taxonomy Filter [3] project page. -------- REPORTED BY --------------------------------------------------------- * Dylan Wilder-Tack [4] of the Drupal security team. -------- FIXED BY ------------------------------------------------------------ * Dylan Wilder-Tack [5] of the Drupal security team. * Solotandem [6], the module maintainer -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/622096 [2] http://drupal.org/node/622096 [3] http://drupal.org/project/taxonomy_filter [4] http://drupal.org/user/96647 [5] http://drupal.org/user/96647 [6] http://drupal.org/user/240748

1 0

SA-CONTRIB-2010-032 - Taxonomy Breadcrumb - Cross Site Scripting (XSS)
by security-news＠drupal.org 31 Mar '10

31 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-032 * Project: Taxonomy Breadcrumb (third-party module) * Versions: 6.x-1.x, 5.x-1.x * Date: 2010-March-31 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Taxonomy Breadcrumb module generates taxonomy based breadcrumbs on node pages and taxonomy/term pages. This module does not properly sanitize taxonomy term name and, for 6.x, node titles when displayed in breadcrumbs, leading to a Cross Site Scripting (XSS [1]) vulnerability. XSS vulnerabilities may lead to compromise of administrative accounts or other attacks against site visitors. -------- VERSIONS AFFECTED --------------------------------------------------- * Taxonomy Breadcrumb module for Drupal 6.x version prior to 6.x-1.1. * Taxonomy Breadcrumb module for Drupal 5.x versions prior to 5.x-1.5. Drupal core is not affected. If you do not use the contributed Taxonomy Breadcrumb module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use the Taxonomy Breadcrumb module for Drupal 6.x-1.x upgrade to Taxonomy Breadcrumb 6.x-1.1 [2] * If you use the Taxonomy Breadcrumb module for Drupal 5.x-1.x upgrade to Taxonomy Breadcrumb 5.x-1.5 [3] -------- REPORTED BY --------------------------------------------------------- * Martin Barbella [4] -------- FIXED BY ------------------------------------------------------------ * Martin Barbella [5] * Peter Wolanin [6] of the Drupal Security Team [7]. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/757980 [3] http://drupal.org/node/757974 [4] http://drupal.org/user/633600 [5] http://drupal.org/user/633600 [6] http://drupal.org/user/49851 [7] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-031 - Menu Block - Cross Site Scripting (XSS)
by security-news＠drupal.org 25 Mar '10

25 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-031 * Project: Menu Block (third-party module) * Versions: 6.x-2.x, 5.x-2.x, 5.x-1.x * Date: 2010-March-24 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Menu Block module generates full or partial menu trees that are presented in configurable blocks. When partial menu trees are displayed, the block title uses the text from the partial menu tree's parent menu item. However, that text is not properly sanitized, leading to a Cross Site Scripting (XSS) vulnerability. XSS vulnerabilities may expose site administrative accounts which could lead to a variety of additional compromises. This vulnerability is mitigated by the fact that an attacker must have the "administer menu" permission which should generally only be granted to trusted roles. -------- VERSIONS AFFECTED --------------------------------------------------- * Menu Block module for Drupal 6.x version prior to 6.x-2.3. * Menu Block module for Drupal 5.x versions prior to 5.x-2.1 or 5.x-1.1. Drupal core is not affected. If you do not use the contributed Menu Block module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use the Menu Block module for Drupal 6.x-2.x upgrade to Menu Block 6.x-2.3 [1] * If you use the Menu Block module for Drupal 5.x-2.x upgrade to Menu Block 5.x-2.1 [2] * If you use the Menu Block module for Drupal 5.x-1.x upgrade to Menu Block 5.x-1.1 [3] -------- REPORTED BY --------------------------------------------------------- * imonemus [4] -------- FIXED BY ------------------------------------------------------------ * JohnAlbin [5], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/752248 [2] http://drupal.org/node/752246 [3] http://drupal.org/node/752244 [4] http://drupal.org/user/682372 [5] http://drupal.org/user/32095

1 0

SA-CONTRIB-2010-030: Mime Mail - Arbitrary code execution
by security-news＠drupal.org 24 Mar '10

24 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-030 * Project: Mime Mail (third-party module) * Version: 5.x * Date: 2010-March-24 * Security risk: Highly critical * Exploitable from: Remote * Vulnerability: Arbitrary code execution -------- DESCRIPTION --------------------------------------------------------- The Mime Mail module is an helper module providing support for MIME mails, for use by other modules. Due to improper use of the PCRE regular expression engine, users with the ability to send HTML email with the Mime Mail module were able to execute arbitrary PHP code on the server. -------- VERSIONS AFFECTED --------------------------------------------------- * Mime Mail for Drupal 5.x prior to 5.x-1.1 *Note that Mime Mail version 6.x-1.0-alpha1 and earlier versions for Drupal 6.x are also affected. However, the security team does not provide support for alpha releases.* Drupal core is not affected. If you do not use the contributed Mime Mail module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Mime Mail for Drupal 5.x upgrade to Mime Mail 5.x-1.1 [1] See also the Mime Mail project page [2]. -------- REPORTED BY --------------------------------------------------------- * Martin Barbella [3] * Damien Tournoud [4] of the Drupal Security Team [5]. -------- FIXED BY ------------------------------------------------------------ * Peter Wolanin [6] of the Drupal Security Team [7]. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/752166 [2] http://drupal.org/project/mimemail [3] http://drupal.org/user/633600 [4] http://drupal.org/user/22211 [5] http://drupal.org/security-team [6] http://drupal.org/user/49851 [7] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-029: Keys - Cross-site Request Forgery
by security-news＠drupal.org 17 Mar '10

17 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-029 * Project: Keys (third-party module) * Version: 6.x * Date: 2010-March-17 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross-site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Keys module provides management of various API keys. The module is vulnerable to cross-site request forgeries (CSRF [1]) via the keys delete form. This would allow a malicious user to trick an admin with the "administer keys" permission into deleting keys by directing them to the url via link or image src, etc. -------- VERSIONS AFFECTED --------------------------------------------------- * Keys for Drupal 6.x prior to Keys 6.x-2.0 Drupal core is not affected. If you do not use the contributed Keys module for Drupal 6.x, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Keys for Drupal 6.x upgrade to Keys 6.x-2.0 [2] or simply disable the Keys module. Be sure to backup saved keys prior to upgrade. See also the Keys project page [3]. -------- REPORTED BY --------------------------------------------------------- Steven Jones [4]. -------- FIXED BY ------------------------------------------------------------ James Jeffery [5], Keys module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Csrf [2] http://drupal.org/node/676104 [3] http://drupal.org/project/keys [4] http://drupal.org/user/99644 [5] http://drupal.org/user/173855

1 0

SA-CONTRIB-2010-028 - Tag Order - Cross Site Scripting
by security-news＠drupal.org 17 Mar '10

17 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-028 * Project: Tag Order (third-party module) * Version: 5.x, 6.x * Date: 2010-March-17 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Tag Order module allows you to select vocabularies whose terms you would like to preserve in the original order entered per node. Taxonomy vocabulary names are not sanitized when being displayed on an administrative page, leading to a cross-site scripting (XSS [1]) vulnerability. Such an attack may lead to a malicious user gaining full administrative access. Mitigating factor: only users with the 'administer taxonomy' permission can enter or edit vocabulary names. -------- VERSIONS AFFECTED --------------------------------------------------- * Tag Order for Drupal 6.x prior to 6.x-1.4 * Tag Order for Drupal 5.x prior to 5.x-1.4 Drupal core is not affected. If you do not use the contributed Tag Order module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Tag Order for Drupal 6.x upgrade to Tag Order 6.x-1.4 [2] * If you use Tag Order for Drupal 5.x upgrade to Tag Order 5.x-1.4 [3] See also the Tag Order project page [4]. -------- REPORTED BY --------------------------------------------------------- * Martin Barbella [5] -------- FIXED BY ------------------------------------------------------------ * Martin Barbella [6] -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/745338 [3] http://drupal.org/node/745346 [4] http://drupal.org/project/tagorder [5] http://drupal.org/user/633600 [6] http://drupal.org/user/633600

1 0

SA-CONTRIB-2010-027: Email Input Filter - Arbitrary code execution
by security-news＠drupal.org 17 Mar '10

17 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-027 * Project: Email Input Filter (third-party module) * Version: 5.x, 6.x * Date: 2010-March-17 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Arbitrary code execution -------- DESCRIPTION --------------------------------------------------------- Email Input Filter converts email style markup into web friendly format. Arbitrary code execution vulnerability in this module allows a remote attacker with the ability to create content using an input format with the email input filter enabled to execute arbitrary PHP code on an affected system. In order to exploit this vulnerability, an input format must be created using the e-mail input filter, and an attacker must be able to post some form of content using that input format. -------- VERSIONS AFFECTED --------------------------------------------------- * Email Input Filter 6.x-1.x prior to 6.x-1.1 * Email Input Filter 5.x-1.x all versions Drupal core is not affected. If you do not use the contributed Email Input Filter module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Email Input Filter 6.x-1.x upgrade to Email Input Filter 6.x-1.1 [1] * If you use Email Input Filter 5.x-1.x, disable the module or upgrade to Drupal 6.x. The Drupal 5.x version is now unsupported. See also the Email Input Filter project page [2]. -------- REPORTED BY --------------------------------------------------------- * Martin Barbella [3] -------- FIXED BY ------------------------------------------------------------ * Mark Burton [4], the Email Input Filter module maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/745318 [2] http://drupal.org/project/emailFilter [3] http://drupal.org/user/633600 [4] http://drupal.org/user/114447

1 0

SA-CONTRIB-2010-026 - Monthly Archive by Node Type - Access Bypass
by security-news＠drupal.org 10 Mar '10

10 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-026 * Project: Monthly Archive by Node Type (third-party module) * Version: 6.x (all branches) * Date: 2010-March-10 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- The Monthly Archive by Node Type module generates monthly archive pages and a block with links to the pages. You can specify the node types that will be included in the archive pages. In some summary listings, the Monthly Archive by Node Type module does not construct its SQL query to respect node access restrictions, thus users can see listings of nodes which are restricted by a node access module and which should not be accessible. -------- VERSIONS AFFECTED --------------------------------------------------- * Monthly Archive by Node Type module for Drupal 6.x versions prior to 6.x-1.4, 6.x-2.7, or 6.x-3.3 Drupal core is not affected. If you do not use the contributed Monthly Archive by Node Type [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use the Monthly Archive by Node Type module for Drupal 6.x-1.x upgrade to Monthly Archive by Node Type 6.x-1.4 [2] * If you use the Monthly Archive by Node Type module for Drupal 6.x-2.x upgrade to Monthly Archive by Node Type 6.x-2.7 [3] * If you use the Monthly Archive by Node Type module for Drupal 6.x-3.x upgrade to Monthly Archive by Node Type 6.x-3.3 [4] -------- REPORTED BY --------------------------------------------------------- * Prometheus6 [5], the module maintainer. -------- FIXED BY ------------------------------------------------------------ * Prometheus6 [6], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/montharchive [2] http://drupal.org/node/737842 [3] http://drupal.org/node/737848 [4] http://drupal.org/node/737854 [5] http://drupal.org/user/10137 [6] http://drupal.org/user/10137

1 0

SA-CONTRIB-2010-025 - TinyMCE - Cross Site Scripting (XSS)
by security-news＠drupal.org 10 Mar '10

10 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-025 * Project: TinyMCE (third-party module) * Version: 5.x * Date: 2010-March-09 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting .... Description The TinyMCE module provides a "WYSIWYG" tool for entering rich text into various parts of a site. The TinyMCE module displayed text entered by an admin without filtering that text leading to a Cross Site Scription (XSS) vulnerability. XSS vulnerabilities may expose site administrative accounts which could lead to a variety of additional compromises. This vulnerability is mitigated by the fact that an attacker must have the "administer tinymce" permission which should generally only be granted to trusted roles. .... Versions affected * TinyMCE prior to 5.x-1.10. Drupal core is not affected. If you do not use the contributed TinyMCE module for Drupal 5, there is nothing you need to do. .... Solution Install the latest version: * If you use TinyMCE for Drupal 5.x upgrade to TinyMCE 5.x-1.11 [1] .... Reported by * Justin C. Klein Keane [2] .... Fixed by * Kevin Reynen [3], the module maintainer .... Contact The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/737176 [2] http://drupal.org/user/302225 [3] http://drupal.org/user/48877

1 0

SA-CORE-2010-001 - Drupal core - Multiple vulnerabilities
by security-news＠drupal.org 04 Mar '10

04 Mar '10

* Advisory ID: DRUPAL-SA-CORE-2010-001 * Project: Drupal core * Version: 5.x, 6.x * Date: 2010-March-03 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- Multiple vulnerabilities and weaknesses were discovered in Drupal. .... Installation cross site scripting A user-supplied value is directly output during installation allowing a malicious user to craft a URL and perform a cross-site scripting attack. The exploit can only be conducted on sites not yet installed. This issue affects Drupal 6.x only. .... Open redirection The API function drupal_goto() is susceptible to a phishing attack. An attacker could formulate a redirect in a way that gets the Drupal site to send the user to an arbitrarily provided URL. No user submitted data will be sent to that URL. This issue affects Drupal 5.x and 6.x. .... Locale module cross site scripting Locale module and dependent contributed modules do not sanitize the display of language codes, native and English language names properly. While these usually come from a preselected list, arbitrary administrator input is allowed. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer languages' permission. This issue affects Drupal 5.x and 6.x. .... Blocked user session regeneration Under certain circumstances, a user with an open session that is blocked can maintain his/her session on the Drupal site, despite being blocked. This issue affects Drupal 5.x and 6.x. -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal 6.x before version 6.16. * Drupal 5.x before version 5.22. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you are running Drupal 6.x then upgrade to Drupal 6.16 [1]. * If you are running Drupal 5.x then upgrade to Drupal 5.22 [2]. Drupal 5 will no longer be maintained when Drupal 7 is released [3]. Upgrading to Drupal 6 [4] is recommended. If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. These patches fix the security vulnerabilities, but do not contain other fixes which were released in Drupal 6.16 or Drupal 5.22. * To patch Drupal 6.15 use SA-CORE-2010-001-6.15.patch [5]. * To patch Drupal 5.21 use SA-CORE-2010-001-5.21.patch [6]. -------- REPORTED BY --------------------------------------------------------- The installation cross site scripting issue was reported by David Rothstein [7] (*). The open redirection was reported by Martin Barbella [8]. The locale module cross site scripting was reported by Justin Klein Keane [9]. The blocked user session regeneration issue was reported by Craig A. Hancock [10]. (*) Member of the Drupal security team. -------- FIXED BY ------------------------------------------------------------ The installation cross site scripting issue was fixed by Heine Deelstra [11]. The open redirection was fixed by Gerhard Killesreiter [12] and Heine Deelstra [13]. The locale module cross site scripting was fixed by Stéphane Corlosquet [14], Peter Wolanin [15], Heine Deelstra [16] and Neil Drumm [17]. The blocked user session regeneration issue was fixed by Gerhard Killesreiter [18]. All the fixes were done by members of the Drupal security team. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://ftp.drupal.org/files/projects/drupal-6.16.tar.gz [2] http://ftp.drupal.org/files/projects/drupal-5.22.tar.gz [3] http://drupal.org/node/725382 [4] http://drupal.org/upgrade [5] http://drupal.org/files/sa-core-2010-001/SA-CORE-2010-001-6.15.patch [6] http://drupal.org/files/sa-core-2010-001/SA-CORE-2010-001-5.21.patch [7] http://drupal.org/user/124982 [8] http://drupal.org/user/633600 [9] http://drupal.org/user/302225 [10] http://drupal.org/user/62850 [11] http://drupal.org/user/17943 [12] http://drupal.org/user/227 [13] http://drupal.org/user/17943 [14] http://drupal.org/user/52142 [15] http://drupal.org/user/49851 [16] http://drupal.org/user/17943 [17] http://drupal.org/user/3064 [18] http://drupal.org/user/227

1 0