March 2011 - Security-news - lists.drupal.org

SA-CONTRIB-2010-015 - Translation Management - Multiple Vulnerabilities
by security-news＠drupal.org 30 Mar '11

30 Mar '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-015 * Project: Translation Management (third-party module) * Version: 6.x * Date: 2011-March-30 * Security risk: Critical (definition of risk levels) [1] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgeries, SQL Injection -------- DESCRIPTION --------------------------------------------------------- This Translation Management module helps to manage the process of translating content on your site. The module has several vulnerabilities. It doesn't sufficiently escape user text when printed to the browser nor when used in database queries resulting in Cross Site Scripting (XSS) and SQL Injection vulnerabilities. It doesn't use the form API nor Drupal's token system to protect against Cross Site Request Forgeries (CSRF). -------- VERSIONS AFFECTED --------------------------------------------------- * Translation Management versions prior to 6.x-1.21 Drupal core is not affected. If you do not use the contributed Translation Management [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Translation Management module for Drupal 6.x upgrade to 6.x-1.22 [3] See also the Translation Management [4] project page. -------- REPORTED BY --------------------------------------------------------- * Dave Reid [5] of the Drupal Security Team * Greg Dunlap [6] -------- FIXED BY ------------------------------------------------------------ * Bruce Pearson [7] the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact. Learn more about the team and their policies [8], writing secure code for Drupal [9], and secure configuration [10] of your site. [1] http://drupal.org/security-team/risk-levels [2] http://drupal.org/project/translation_management [3] http://drupal.org/node/1108848 [4] http://drupal.org/project/translation_management [5] http://drupal.org/user/53892 [6] http://drupal.org/user/128537 [7] http://drupal.org/user/415674 [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-014 - Webform Block - Cross Site Scripting
by security-news＠drupal.org 23 Mar '11

23 Mar '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-014 * Project: Webform Block (third-party module) * Version: 6.x * Date: 2011-March-23 * Security risk: Moderately critical (definition of risk levels) [1] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Webform Block module enables users to make a webform available as a block. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [2]) vulnerability that may lead to a malicious user gaining full administrative access. The vulnerability is mitigated by the fact that a malicious user must be assigned a role that includes permission to create and/or edit webforms. -------- VERSIONS AFFECTED --------------------------------------------------- * Webform Block module for Drupal 6.x versions prior to 6.x-1.2 Drupal core is not affected. If you do not use the contributed Webform Block [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Webform Block module for Drupal 6.x upgrade to Webform Block 6.x-1.2 [4] See also the Webform Block project page [5]. -------- REPORTED BY --------------------------------------------------------- * Dylan Wilder-Tack (grendzy [6]) of the Drupal security team -------- FIXED BY ------------------------------------------------------------ * Dylan Wilder-Tack (grendzy [7]) of the Drupal security team * Mike Carter (budda [8]), module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact. Learn more about the team and their policies [9], writing secure code for Drupal [10], and secure configuration [11] of your site. [1] http://drupal.org/security-team/risk-levels [2] http://en.wikipedia.org/wiki/Cross-site_scripting [3] http://drupal.org/project/webformblock [4] http://drupal.org/node/1101996 [5] http://drupal.org/project/webformblock [6] http://drupal.org/user/96647 [7] http://drupal.org/user/96647 [8] http://drupal.org/user/13164 [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-013 - Tagadelic - Cross Site Scripting (XSS)
by security-news＠drupal.org 16 Mar '11

16 Mar '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-013 * Project: Tagadelic (third-party module) * Version: 6.x * Date: 2011-March-16 * Security risk: Moderately Critical (definition of risk levels) [1] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Tagadelic module offers various ways to display terms and vocabularies in a tag cloud on a page or in a block. The module does not sanitize the taxonomy vocabulary names and descriptions when displayed on listing pages or blocks, leading to a Cross-Site Scripting (XSS [2]) vulnerability that may lead to a malicious user gaining full administrative access. This vulnerability is mitigated by the fact that the user must be able to create or edit taxonomy vocabularies, normally restricted by the "administer taxonomy" permission, in order to exploit it. -------- VERSIONS AFFECTED --------------------------------------------------- * Tagadelic module 6.x-1.x versions prior to 6.x-1.3 Note: If you do not use the contributed Tagadelic [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Tagadelic module for Drupal 6.x-1.x upgrade to Tagadelic 6.x-1.3 [4] See also the Tagadelic project page [5]. -------- REPORTED BY --------------------------------------------------------- * Greg Knaddison (greggles) [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Bèr Kessels [7], module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact. Learn more about the team and their policies [8], writing secure code for Drupal [9], and secure configuration [10] of your site. [1] http://drupal.org/security-team/risk-levels [2] http://en.wikipedia.org/wiki/Cross-site_scripting [3] http://drupal.org/project/tagadelic [4] http://drupal.org/node/1095016 [5] http://drupal.org/project/tagadelic [6] http://drupal.org/user/36762 [7] http://drupal.org/user/2663 [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-012 - Spaces - Access bypass
by security-news＠drupal.org 02 Mar '11

02 Mar '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-012 * Project: Spaces (third-party module) * Version: 6.x * Date: 2011-March-02 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Spaces module makes sitewide configuration options available to be overridden by individual "spaces" on a Drupal site. Spaces provides a Views module access plugin that does not properly check its permission setting which may allow underprivileged users to visit certain pages. This vulnerability is mitigated by the fact that Drupal's node access system will prevent users from viewing content that they do not have permission to view. -------- VERSIONS AFFECTED --------------------------------------------------- * Spaces module for Drupal 6.x versions prior to 6.x-3.1 Drupal core is not affected. If you do not use the contributed Spaces [1] and Views [2] modules, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Spaces module for Drupal 6.x upgrade to Spaces 6.x-3.1 [3] See also the Spaces project page [4]. -------- REPORTED BY --------------------------------------------------------- * Matthew Radcliffe [5] -------- FIXED BY ------------------------------------------------------------ * Jeff Miccolis [6], module maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [7] can be reached at security at drupal.org [8] or via the form at http://drupal.org/contact [9]. Learn more about the team and their policies [10], writing secure code [11] for Drupal, and Secure Configuration [12] of your site. [1] http://drupal.org/project/spaces [2] http://drupal.org/project/views [3] http://drupal.org/node/1079192 [4] http://drupal.org/project/spaces [5] http://drupal.org/user/157079 [6] http://drupal.org/user/31731 [7] http://drupal.org/security-team [8] http://drupal.org [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

DRUPAL-SA-CONTRIB-2011-011 - Secure Pages - Open redirect
by security-news＠drupal.org 02 Mar '11

02 Mar '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-011 * Project: Secure Pages (third-party module) * Version: 6.x * Date: 2011-March-02 * Security risk: Less Critical (definition of risk levels) [1] * Exploitable from: Remote * Vulnerability: Open Redirection -------- DESCRIPTION --------------------------------------------------------- The Secure Pages module allows administrators to choose certain URLs that must be delivered over HTTPS. An open redirection bug allows an attacker to formulate a URL in a way that redirects the user to an arbitrarily provided URL. -------- VERSIONS AFFECTED --------------------------------------------------- * Secure Pages module for Drupal 6.x versions prior to 6.x-1.9 Drupal core is not affected. If you do not use the contributed Secure Pages [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Secure Pages module for Drupal 6.x upgrade to Secure Pages 6.x-1.9 [3] See also the Secure Pages project page [4]. -------- REPORTED BY --------------------------------------------------------- * Mike Potter [5] -------- FIXED BY ------------------------------------------------------------ * Gordon Heydon [6], module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact. Learn more about the team and their policies [7], writing secure code for Drupal [8], and secure configuration [9] of your site. [1] http://drupal.org/security-team/risk-levels [2] http://drupal.org/project/securepages [3] http://drupal.org/node/1070596 [4] http://drupal.org/project/securepages [5] http://drupal.org/user/616192 [6] http://drupal.org/user/959 [7] http://drupal.org/security-team [8] http://drupal.org/writing-secure-code [9] http://drupal.org/security/secure-configuration

1 0