November 2011 - Security-news

SA-CONTRIB-2011-057 - Support Ticketing System - Cross Site Scripting (XSS)
by security-news＠drupal.org 30 Nov '11

30 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-057 * Project: Support Ticketing System [1] (third-party module) * Version: 6.x * Date: 2011-November-30 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Support Ticketing System module provides a basic ticketing system and helpdesk that is native to Drupal, offering complete email integration. The module does not properly sanitize user-supplied content, resulting in multiple Cross-Site Scripting (XSS) vulnerabilities. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer support projects." -------- VERSIONS AFFECTED --------------------------------------------------- * support 6.x-1.x versions prior to 6.x-1.7 [3]. Drupal core is not affected. If you do not use the contributed Support Ticketing System [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Support Ticketing System module for Drupal 6.x, upgrade to support 6.x-1.7 [5] Note: If you were using the 6.x-1.6-rc1 release, or wish to test the latest 6.x version, you may upgrade to support 6.x-1.8-rc1 [6]. See also the Support Ticketing System [7] project page. -------- REPORTED BY --------------------------------------------------------- * Brandon Bergren [8] -------- FIXED BY ------------------------------------------------------------ * Brandon Bergren [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/support [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/node/1357300 [4] http://drupal.org/project/support [5] http://drupal.org/node/1357300 [6] http://drupal.org/node/1357304 [7] http://drupal.org/project/support [8] http://drupal.org/user/53081 [9] http://drupal.org/user/53081 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-058 - Support Timer - Cross Site Scripting (XSS)
by security-news＠drupal.org 30 Nov '11

30 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-058 * Project: Support Timer [1] (third-party module) * Version: 6.x * Date: 2011-November-30 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Support Timer module adds a javascript-based timer to the Support Ticketing System [3] for tracking how long users are working on support tickets, as well as administrative reports. The module does not properly sanitize user-supplied content, resulting in multiple Cross-Site Scripting (XSS) vulnerabilities. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "track time spent". -------- VERSIONS AFFECTED --------------------------------------------------- * Support Timer 6.x-1.x versions prior to 6.x-1.4 [4]. Drupal core is not affected. If you do not use the contributed Support Timer [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Support Timer module for Drupal 6.x, upgrade to Support Timer 6.x-1.4 [6] See also the Support Timer [7] project page. -------- REPORTED BY --------------------------------------------------------- * Brandon Bergren [8] -------- FIXED BY ------------------------------------------------------------ * Brandon Bergren [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/support_timer [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/support [4] http://drupal.org/node/1357278 [5] http://drupal.org/project/support_timer [6] http://drupal.org/node/1357278 [7] http://drupal.org/project/support_timer [8] http://drupal.org/user/53081 [9] http://drupal.org/user/53081 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-056 - Webform Validation Cross Site Scripting
by security-news＠drupal.org 30 Nov '11

30 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-056 * Project: Webform Validation [1] (third-party module) * Version: 6.x, 7.x * Date: 2011-November-30 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Webform Validation module enables you to add form validation rules to Webform components through a UI. The module contains multiple cross site scripting (XSS) vulnerabilities due to the fact that it fails to sanitize certain user entered text prior to displaying in the browser. This vulnerability is mitigated by the fact that an attacker must have a role with permission to update Webform nodes. Various permissions provide for this ability. -------- VERSIONS AFFECTED --------------------------------------------------- * Webform Validation 6.x-1.x versions prior to 6.x-1.4. * Webform Validation 7.x-1.x versions prior to 7.x-1.0. Drupal core is not affected. If you do not use the contributed Webform Validation [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Webform Validation module for Drupal 6.x, upgrade to Webform Validation 6.x-1.5 [4] * If you use the Webform Validation module for Drupal 7.x, upgrade to Webform Validation 7.x-1.1 [5] See also the Webform Validation [6] project page. -------- REPORTED BY --------------------------------------------------------- * Justin_KleinKeane [7] -------- FIXED BY ------------------------------------------------------------ * Sven Decabooter [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Forest Monsen [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/webform_validation [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/webform_validation [4] http://drupal.org/node/1357354 [5] http://drupal.org/node/1357356 [6] http://drupal.org/project/webform_validation [7] http://drupal.org/user/302225 [8] http://drupal.org/user/35369 [9] http://drupal.org/user/181798 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-055 - Webform CiviCRM Integration - Multiple vulnerabilities
by security-news＠drupal.org 09 Nov '11

09 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-055 * Project: Webform CiviCRM Integration [1] (third-party module) * Version: 6.x, 7.x * Date: 2011-November-09 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass, SQL Injection -------- DESCRIPTION --------------------------------------------------------- The Webform CiviCRM Integration module extends the functionality of the Webform Module [3] to link form submissions with a CiviCRM [4] database. Version 2.0 of the module added form validation based on CiviCRM data type. A flaw in the implementation of this feature caused other validation handlers to fail, so the Webform would be able to be submitted even if required fields were left blank, etc. Version 2.1 fixed this issue, but implemented validation in such a way as to leave a possible opening for SQL injection. Both issues are now fixed in version 2.2. -------- VERSIONS AFFECTED --------------------------------------------------- * Webform CiviCRM Integration prior to 6.x-2.2 * Webform CiviCRM Integration prior to 7.x-2.2 Drupal core is not affected. If you do not use the contributed Webform CiviCRM Integration [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the module for Drupal 6.x, upgrade to Webform CiviCRM Integration 6.x-2.2 [6] * If you use the module for Drupal 7.x, upgrade to Webform CiviCRM Integration 7.x-2.2 [7] See also the Webform CiviCRM Integration [8] project page. -------- REPORTED BY --------------------------------------------------------- * Michał Mach [9] -------- FIXED BY ------------------------------------------------------------ * Coleman Watts [10] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Stéphane Corlosquet [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/webform_civicrm [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/webform [4] http://civicrm.org [5] http://drupal.org/project/webform_civicrm [6] http://drupal.org/node/1336044 [7] http://drupal.org/node/1336046 [8] http://drupal.org/project/webform_civicrm [9] http://drupal.org/user/765720 [10] http://drupal.org/user/639856 [11] http://drupal.org/user/52142 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-054 - CKEditor - Access bypass
by security-news＠drupal.org 09 Nov '11

09 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-054 * Project: CKEditor - WYSIWYG HTML editor [1] (third-party module) * Version: 7.x * Date: 2011-November-09 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The CKEditor module allows Drupal to replace textarea fields with the CKEditor - a visual HTML editor, sometimes called WYSIWYG editor. The module doesn't protect private files appropriately. Private files can downloaded by anyone able to guess their URL. -------- VERSIONS AFFECTED --------------------------------------------------- * CKEditor 7.x-1.4 version only Drupal core is not affected. If you do not use the contributed CKEditor - WYSIWYG HTML editor [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * Upgrade to CKEditor 7.x-1.5 [4] See also the CKEditor - WYSIWYG HTML editor [5] project page. -------- REPORTED BY --------------------------------------------------------- * Joel Walters [6] -------- FIXED BY ------------------------------------------------------------ * Michal [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Stéphane Corlosquet [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/ckeditor [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/ckeditor [4] http://drupal.org/node/1336272 [5] http://drupal.org/project/ckeditor [6] http://drupal.org/user/1052318 [7] http://drupal.org/user/922884 [8] http://drupal.org/user/52142 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-053 - Quiz - Cross Site Scripting
by security-news＠drupal.org 09 Nov '11

09 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-053 * Project: Quiz [1] (third-party module) * Version: 6.x * Date: 2011-November-09 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Quiz module allows the creation and taking of tests that are scored either automatically or manually by a teacher. The module contains several cross site scripting (XSS) vulnerabilities that can be exploited when quizzes are being created. These vulnerabilities are mitigated by the fact that an attacker must have the permission to create or edit quizzes. -------- VERSIONS AFFECTED --------------------------------------------------- * Quiz 6.x-4.x versions prior to 6.x-4.3. Drupal core is not affected. If you do not use the contributed Quiz [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Quiz module for Drupal 6.x, upgrade to quiz 6.x-4.3 [4] See also the Quiz [5] project page. -------- REPORTED BY --------------------------------------------------------- * phdruplover [6] -------- FIXED BY ------------------------------------------------------------ * sivaji [7] the module maintainer * falcon [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Matt Kleve [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/quiz [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/quiz [4] http://drupal.org/node/1336756 [5] http://drupal.org/project/quiz [6] http://drupal.org/user/1505850 [7] http://drupal.org/user/328724 [8] http://drupal.org/user/530912 [9] http://drupal.org/user/150473 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-052 - Views SQL Injection
by security-news＠drupal.org 02 Nov '11

02 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-052 * Project: Views [1] (third-party module) * Version: 6.x * Date: 2011-November-02 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: SQL Injection -------- DESCRIPTION --------------------------------------------------------- The Views module enables you to list content in your site in various ways. The module doesn't sufficiently escape database parameters for certain filters/arguments on certain types of views with specific configurations of arguments. -------- VERSIONS AFFECTED --------------------------------------------------- * Views 6.x-2.x versions prior to 6.x-2.13 Drupal core is not affected. If you do not use the contributed Views [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * Upgrade to Views 6.x-2.13 [4] Views 6.x-2.14 [5] is also released today. It contains the security fix and new features and bug fixes. See also the Views [6] project page. -------- REPORTED BY --------------------------------------------------------- * Olli Vesslin [7] -------- FIXED BY ------------------------------------------------------------ * dereine [8] the module co-maintainer -------- COORDINATED BY ------------------------------------------------------ * Heine Deelstra [9] of the Drupal Security Team * Peter Wolanin [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/views [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/views [4] http://drupal.org/node/1329842 [5] http://drupal.org/node/1329846 [6] http://drupal.org/project/views [7] http://drupal.org/user/789644 [8] http://drupal.org/user/99340 [9] http://drupal.org/user/17943 [10] http://drupal.org/user/49851 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-051 - Hotblocks module - multiple vulnerabilities
by security-news＠drupal.org 02 Nov '11

02 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-051 * Project: HotBlocks [1] (third-party module) * Version: 6.x * Date: 2011-November-02 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Access bypass, Cross Site Scripting, Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The HotBlocks module provides a rich experience for managing blocks. The module contained multiple vulnerabilities including Cross Site Scripting (XSS), Access Bypass, and Cross Site Request Forgery (CSRF). XSS is mitigated by the fact that an attacker must have a role with the permission "administer hotblocks". The Access Bypass is mitigated by the fact that the module's author intended (but did not document) the bypass as a feature. The CSRF issue requires an authenticated user with sufficient permissions to be tricked into visiting a specially crafted URL. -------- VERSIONS AFFECTED --------------------------------------------------- * HotBlocks 6.x-1.x versions prior to 6.x-1.6. Drupal core is not affected. If you do not use the contributed HotBlocks [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the HotBlocks module for Drupal 6.x, upgrade to HotBlocks 6.x-1.6 [4] See also the HotBlocks [5] project page. -------- REPORTED BY --------------------------------------------------------- * Greg Knaddison [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Justin Dodge [7] the module maintainer -------- RELEASE COORDINATED BY ---------------------------------------------- * Greg Knaddison [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/hotblocks [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/hotblocks [4] http://drupal.org/node/1329404 [5] http://drupal.org/project/hotblocks [6] http://drupal.org/user/36762 [7] http://drupal.org/user/238638 [8] http://drupal.org/user/36762 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0