Security-news May 2010

security-news@drupal.org

1 participants
24 discussions

SA-CONTRIB-2010-042: LoginToboggan - Session fixation
by security-news＠drupal.org 12 May '10

12 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-042 * Project: LoginToboggan (third-party module) * Version: 5.x, 6.x * Date: 2010-05-12 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Session fixation -------- DESCRIPTION --------------------------------------------------------- The LoginToboggan module provides a customized log in workflow. Attackers may be able to exploit the workflow to initiate a session fixation [1] attack. -------- VERSIONS AFFECTED --------------------------------------------------- * LoginToboggan versions for the 5.x and 6.x versions of Drupal Drupal core is not affected. If you do not use the contributed LoginToboggan module for Drupal 5.x or 6.x, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version of the module: * 5.x: LoginToboggan 5.x-1.7 [2] * 6.x: LoginToboggan 6.x-1.7 [3] See also the LoginToboggan [4] project page. -------- REPORTED BY --------------------------------------------------------- * Chad Phillips (hunmonk [5]), the module maintainer and member of the Drupal Security Team. -------- FIXED BY ------------------------------------------------------------ * Chad Phillips (hunmonk [6]), the module maintainer and member of the Drupal Security Team. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [7]. Read more about the Security Team and Security Advisories at http://drupal.org/security. [1] http://en.wikipedia.org/wiki/Session_fixation [2] http://drupal.org/node/797154 [3] http://drupal.org/node/797158 [4] http://drupal.org/project/logintoboggan [5] http://drupal.org/user/22079 [6] http://drupal.org/user/22079 [7] http://drupal.org/contact

1 0

SA-CONTRIB-2010-041: ImageField - Access Bypass
by security-news＠drupal.org 06 May '10

06 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-41 * Project: ImageField (third-party module) * Version: 6.x * Date: 2010-May-5 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- ImageField provides a file upload field for CCK, allowing files to be attached to a node. ImageField intends to set a default extension of "png jpg gif" for all new fields, but may actually save an empty string allowing all of the "png jpg gif" extensions if an administrator does not save the field configuration page after creating a new field. Any ImageField that has been initially saved or edited with any extensions specified is not affected. This vulnerability is mitigated by the attacker needing permission to create or edit content with an unconfigured ImageField. ImageField also creates thumbnails after uploading a new image. A second vulnerability is that this thumbnail is not properly checked for access if using the Private Downloads setting, allowing users that may not have access to view the full size image to still view the administrative thumbnail. -------- VERSIONS AFFECTED --------------------------------------------------- * ImageField for Drupal 6.x versions prior to 6.x-3.3 Drupal core is not affected. If you do not use the contributed ImageField [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use ImageField for Drupal 6.x upgrade to ImageField 6.x-3.3 [2] -------- REPORTED BY --------------------------------------------------------- * vb1 [3] -------- FIXED BY ------------------------------------------------------------ * Nathan Haug [4] the module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/imagefield [2] http://drupal.org/node/791030 [3] http://drupal.org/user/690402 [4] http://drupal.org/user/35821

1 0

SA-CONTRIB-2010-040: FileField - Access Bypass
by security-news＠drupal.org 06 May '10

06 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-40 * Project: FileField (third-party module) * Version: 6.x * Date: 2010-May-5 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- FileField provides a file upload field for CCK, allowing files to be attached to a node. FileField intends to set a default extension of "txt" for all new fields, but may actually save an empty string allowing all extensions if an administrator does not save the field configuration page after creating a new field. Execution of code in uploaded files is normally prevented by .htaccess rules, regardless of file extension. Any FileField that has been initially saved or edited with any extensions specified is not affected. This vulnerability is mitigated by the attacker needing permission to create or edit content with an unconfigured FileField. -------- VERSIONS AFFECTED --------------------------------------------------- * FileField for Drupal 6.x versions prior to 6.x-3.3 Drupal core is not affected. If you do not use the contributed FileField [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use FileField for Drupal 6.x upgrade to FileField 6.x-3.3 [2] -------- REPORTED BY --------------------------------------------------------- * David Rothstein [3] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Nathan Haug [4] the module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/filefield [2] http://drupal.org/node/791032 [3] http://drupal.org/user/124982 [4] http://drupal.org/user/35821

1 0

SA-CONTRIB-2010-039: CCK TableField - Cross Site Scripting
by security-news＠drupal.org 05 May '10

05 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-039 * Project: CCK TableField (third-party module) * Version: 6.x * Date: 2010-May-05 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The CCK TableField module provides a generic method to attach tabular data to a node. CCK TableField does not sanitize table headers before output, allowing anyone with permissions to create or edit a node containing one or more TableField fields to insert arbitrary HTML and script code. Such a cross site scripting [1] (XSS) attack may also lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * CCK TableField module for Drupal 6.x version prior to 6.x-1.2. Drupal core is not affected. If you do not use the contributed CCK TableField module for Drupal 6.x, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version or disable the module. * If you use CCK TableField 6.x-1.1 or older, upgrade to CCK TableField 6.x-1.2 [2] See also the CCK TableField [3] project page. -------- REPORTED BY --------------------------------------------------------- * mr.baileys [4] of the Drupal Security Team [5]. -------- FIXED BY ------------------------------------------------------------ * Kevin Hankens [6], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [7]. Read more about the Security Team and Security Advisories at http://drupal.org/security. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/790364 [3] http://drupal.org/project/tablefield [4] http://drupal.org/user/383424 [5] http://drupal.org/security-team [6] http://drupal.org/user/78090 [7] http://drupal.org/contact

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news May 2010