August 2011 - Security-news - lists.drupal.org

SA-CONTRIB-2011-039 - Bot Alarm - Multiple vulnerabilities
by security-news＠drupal.org 31 Aug '11

31 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-039 * Project: Bot Alarm [1] (third-party module) * Version: 6.x * Date: 2011-August-31 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- This module enables you to set alarms for your IRC bot. The module does not properly escape the message and channels of alarms in pages listing the alarms, leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission 'administer bot'. The module does not check for any one-time-use tokens when deleting an alarm, leading to a Cross Site Request Forgery (CSRF ) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission 'administer bot'. -------- VERSIONS AFFECTED --------------------------------------------------- * Bot Alarm 6.x-1.0 Drupal core is not affected. If you do not use the contributed Bot Alarm [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the bot_alarm module for Drupal 6.x, upgrade to 6.x-1.2 [4] See also the Bot Alarm [5] project page. -------- REPORTED BY --------------------------------------------------------- * CSÉCSY László [6] -------- FIXED BY ------------------------------------------------------------ * Aaron Forsander [7] the module maintainer -------- RELEASE COORDINATED BY ---------------------------------------------- * Michael Hess [8], Greg Knaddison [9] and Ben Jeavons [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/bot_alarm [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/bot_alarm [4] http://drupal.org/node/1265642 [5] http://drupal.org/project/bot_alarm [6] http://drupal.org/user/199303 [7] http://drupal.org/user/737486 [8] http://drupal.org/user/102818 [9] http://drupal.org/user/36762 [10] http://drupal.org/user/91990 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-037- Node Invite - Cross Site Scripting
by security-news＠drupal.org 31 Aug '11

31 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-037 * Project: Node Invite [1] (third-party module) * Version: 6.x * Date: 2011-Augest-31 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Node Invite module allows you to invite users (with existing accounts or otherwise) to specified nodes on a Drupal site. This module does not properly use t() strings to ensure all text was sanitized when data was output through a form_set_error message, thus creating a Cross Site Scripting (XSS) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Node invite 6.x versions prior to 6.x-2.3 [3]. Drupal core is not affected. If you do not use the contributed Node Invite [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Node Invite module for Drupal 6.x, upgrade to node_invite-6.x-2.3 See also the Node Invite [5] project page. -------- REPORTED BY --------------------------------------------------------- * Richard Kapolnai [6] -------- FIXED BY ------------------------------------------------------------ * Scott Hadfield [7] the module maintainer -------- RELEASE COORDINATED BY ---------------------------------------------- * Michael Hess [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/node_invite [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/node/1265334 [4] http://drupal.org/project/node_invite [5] http://drupal.org/project/node_invite [6] http://drupal.org/user/277970 [7] http://drupal.org/user/67093 [8] http://drupal.org/user/102818 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-038 - Taxonomy Views Integrator - Cross Site Scripting
by security-news＠drupal.org 31 Aug '11

31 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-038 * Project: Taxonomy Views Integrator [1] (third-party module) * Version: 6.x * Date: 2011-Augest-31 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to override whole vocabularies or individual terms with the View of your choice. The module did not filter user entered term descriptions for Cross Site Scripting (XSS) injections. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer taxonomy". -------- VERSIONS AFFECTED --------------------------------------------------- * Taxonomy Views Integrator 6.x-1.x versions prior to 6.x-1.2. Drupal core is not affected. If you do not use the contributed Taxonomy Views Integrator [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Taxonomy Views Integrator module for Drupal 6.x, upgrade to 6.x-1.2 [4] See also the Taxonomy Views Integrator [5] project page. -------- REPORTED BY --------------------------------------------------------- * Owen Barton [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Derek Webb [7] one of the module's maintainers -------- RELEASE COORDINATED BY ---------------------------------------------- * Michael Hess [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/tvi [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/tvi [4] http://drupal.org/node/1264776 [5] http://drupal.org/project/tvi [6] http://drupal.org/user/19668 [7] http://drupal.org/user/64114 [8] http://drupal.org/user/102818 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-036 - Addresses - Cross Site Scripting
by security-news＠drupal.org 17 Aug '11

17 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-036 * Project: Addresses [1] (third-party module) * Version: 6.x * Date: 2011-August-17 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to link your users and contents to physical addresses. The module doesn't sufficiently filter output when displaying an address. This vulnerability is mitigated by the fact that the module doesn't use the single line display by default, an administrator has to enable that feature first. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions prior to 6.x-1.10 Drupal core is not affected. If you do not use the contributed Addresses [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the addresses module for Drupal 6.x, upgrade to 6.x-1.11 [4] See also the Addresses [5] project page. -------- REPORTED BY --------------------------------------------------------- * David Kinzer [6] -------- FIXED BY ------------------------------------------------------------ * David Kinzer [7] * Alexis Wilke [8] the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/addresses [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/addresses [4] http://drupal.org/node/1251508 [5] http://drupal.org/project/addresses [6] http://drupal.org/user/619296 [7] http://drupal.org/user/619296 [8] http://drupal.org/user/356197 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-035 Forward module - Open redirect
by security-news＠drupal.org 17 Aug '11

17 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-035 * Project: Forward [1] (third-party module) * Version: 6.x, 7.x * Date: 2011-August-17 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Open redirect -------- DESCRIPTION --------------------------------------------------------- The Forward module enables you to add a "forward this page" link to each node. The link takes regular site visitors to a form where they can generate an email to a friend. The module doesn't check to ensure that the page being forwarded refers to an internal path. This could allow someone to hard code a forward link to an unscrupulous external site. This vulnerability is mitigated by the fact that an attacker must have a role that enables them to post content to the site that contains embedded links. -------- VERSIONS AFFECTED --------------------------------------------------- * Forward 6.x-1.x versions prior to 6.x-1.20. * Forward 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed Forward [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Forward module for Drupal 6.x, upgrade to Forward 6.x-1.20 [4] * If you use the Forward module for Drupal 7.x, upgrade to Forward 7.x-1.1 [5] See also the Forward [6] project page. -------- REPORTED BY --------------------------------------------------------- * Christian Schmidt [7] of Berlingske Media -------- FIXED BY ------------------------------------------------------------ * John Oltman [8] the module maintainer * Christian Schmidt [9] of Berlingske Media -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/forward [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/forward [4] http://drupal.org/node/1252132 [5] http://drupal.org/node/1252118 [6] http://drupal.org/project/forward [7] http://drupal.org/user/216078 [8] http://drupal.org/user/699926 [9] http://drupal.org/user/216078 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-033 - iWebkit - Cross Site Scripting
by security-news＠drupal.org 03 Aug '11

03 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-033 * Project: iWebkit [1] (third-party module) * Version: 6.x * Date: 2011-August-03 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- iWebKit is a web toolkit designed to create iPhone and iPod touch compatible websites and webapps. iWebkit does not properly sanitize menu links when displayed, allowing a malicious user to embed scripts in menu items, thus creating a cross site scripting (XSS [3]) vulnerability that may lead to an unauthorized user gaining full administrative access. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer menu" permission. -------- VERSIONS AFFECTED --------------------------------------------------- * iWebkit theme 6.x-2.x versions prior to 6.x-2.2. Drupal core is not affected. If you do not use the contributed iWebkit [4] theme, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the iWebkit [5] theme for Drupal 6.x, upgrade to iWebkit 6.x-2.2 [6]. See also the iWebkit [7] project page. -------- REPORTED BY --------------------------------------------------------- * Thomas Turnbull (tom_o_t [8]) -------- FIXED BY ------------------------------------------------------------ * Sumit Kataria (sumitk [9]), the theme maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/iwebkit [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/project/iwebkit [5] http://drupal.org/project/iwebkit [6] http://drupal.org/node/1236722 [7] http://drupal.org/project/iwebkit [8] http://drupal.org/user/125573 [9] http://drupal.org/user/267786 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-034 - Display Suite - Cross Site Scripting
by security-news＠drupal.org 03 Aug '11

03 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-034 * Project: Display suite [1] (third-party module) * Version: 7.x * Date: 2011-August-03 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Display Suite allows you to take full control over how your content is displayed using a drag and drop interface. Arrange your nodes, views, comments, user data etc. the way you want without having to work your way through dozens of template files. In certain situations, Display Suite does not properly sanitize user-supplied data, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting (XSS [3]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Display Suite 7.x-1.x versions prior to 7.x-1.3. Drupal core is not affected. If you do not use the contributed Display Suite [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Display Suite module for Drupal 7.x upgrade to Display Suite 7.x-1.3 [5]. See also the Display Suite [6] project page. -------- REPORTED BY --------------------------------------------------------- * Rolf van de Krol [7] * Kristof De Jaeger (swentel [8]) -------- FIXED BY ------------------------------------------------------------ * Rolf van de Krol [9] * Kristof De Jaeger (swentel [10]) -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/ds [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/project/ds [5] http://drupal.org/node/1238544 [6] http://drupal.org/project/ds [7] http://drupal.org/user/70412 [8] http://drupal.org/user/107403 [9] http://drupal.org/user/70412 [10] http://drupal.org/user/107403 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-032 - Mail Logger - Cross Site Scripting
by security-news＠drupal.org 03 Aug '11

03 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-032 * Project: Mail Logger [1] (third-party module) * Version: 6.x * Date: 2011-August-03 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Mail Logger module logs all outgoing e-mails and provides users with the "access mail logger" permission to view logged e-mails. The module does not sanitize the log output of addressee information, subject, and body, leading to a Cross-Site Scripting (XSS [3]) vulnerability that may lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Mail Logger module 6.x-1.x versions prior to 6.x-1.1 Drupal core is not affected. If you do not use the contributed Mail Logger [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * Upgrade to Mail Logger 6.x-1.1 [5] See also the Mail Logger [6] project page. -------- REPORTED BY --------------------------------------------------------- * Ivo Van Geertruyen [7] * Daniel G. Siegel [8] -------- FIXED BY ------------------------------------------------------------ * Oleg Terenchuk [9], module maintainer * David Norman [10], module co-maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/mail_logger [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/project/mail_logger [5] http://drupal.org/node/1238286 [6] http://drupal.org/project/mail_logger [7] http://drupal.org/user/383424 [8] http://drupal.org/user/253160 [9] http://drupal.org/user/78134 [10] http://drupal.org/user/972 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0