March 2012 - Security-news - lists.drupal.org

DRUPAL-PSA-2012-001 - localizations - Cross Site Scripting
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-PSA-2012-001 * Version: 6.x, 7.x * Date: 2012-March-07 * Security risk: Moderately critical [1] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This is a public service announcement regarding possible cross-site scripting risks associated with interface localizations for Drupal. Drupal has cross-site scripting prevention filters in the interface localization import code in Drupal core, however, the extent to which localization can be used to inject markup to webpages is wider, and due to Drupal's localization architecture and code reuse, we cannot tell in advance where the localized text is going to be used and how we should sanitize the translated text. When translated text is used, developers do not expect that it might cause cross-site scripting issues and therefore do not use filtering techniques when the resulting text is assembled into the output. You should be aware that Drupal's cross-site scripting prevention for interface localizations is not complete and therefore you should review the localizations imported to your site before importing them or ensure that they come from trusted sources. Even Drupal's central localization source, localize.drupal.org has configurable permission system for teams. Those teams where translations are moderated by a team of volunteers are less likely to contain any attack code. Consequently we are adding /translate interface/ to our list of advanced permissions in our Security advisories process and permissions policy [2] document. The issue also affect contributed modules like Localization update which automate localization import from localize.drupal.org and compatible servers or String overrides, which allows you to use the localization system to override English built-in text. -------- VERSIONS AFFECTED --------------------------------------------------- Multiple modules can be used to translate the interface text. Some of those are * Locale module in Drupal core. * Localization update [3] * String overrides [4] Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Given that translations strings can be harmful, you should treat them with the same skepticism that you treat modules. Get them from reputable sources or review them prior to using them. See also the project page. -------- REPORTED BY --------------------------------------------------------- * The underlying issue was reported by Justin C. Klein Keane [5] -------- FIXED BY ------------------------------------------------------------ This PSA drafted by: * Gábor Hojtsy [6] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. [1] http://drupal.org/security-team/risk-levels [2] http://drupal.org/security-advisory-policy [3] http://drupal.org/project/l10n_update [4] http://drupal.org/project/stringoverrides [5] http://drupal.org/user/302225 [6] http://drupal.org/user/4166 [7] http://drupal.org/contact [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-035 - Webform Cross Site Scripting (XSS)
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-035 * Project: Webform [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-March-07 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Webform module allows content creators to assemble a survey for end-users. The module doesn't sufficiently filter user supplied text when displaying radio buttons or checkboxes when used in combination with the Select or Other... [3] module. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "create webform content" and the Select or Other... module must be installed on the site. -------- VERSIONS AFFECTED --------------------------------------------------- * Webform 6.x-3.x versions prior to 6.x-1.17. * Webform 7.x-3.x versions prior to 7.x-1.17. Drupal core is not affected. If you do not use the contributed Webform [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Webform module for Drupal 6.x, upgrade to Webform 6.x-1.17 [5] * If you use the Webform module for Drupal 7.x, upgrade to Webform 7.x-1.17 [6] If you do not use Select or Other... module, no action is necessary. See also the Webform [7] project page. -------- REPORTED BY --------------------------------------------------------- * Kyle Small [8] -------- FIXED BY ------------------------------------------------------------ * Nate Haug [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team * John Morahan [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/webform [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/select_or_other [4] http://drupal.org/project/webform [5] http://drupal.org/node/1472178 [6] http://drupal.org/node/1472180 [7] http://drupal.org/project/webform [8] http://drupal.org/user/832278 [9] http://drupal.org/user/35821 [10] http://drupal.org/user/36762 [11] http://drupal.org/user/58170 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-034 - Node Recommendation Cross Site Scripting (XSS)
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-034 * Project: Node Recommendation [1] (third-party module) * Version: 6.x * Date: 2012-March-7 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module shows users other nodes that they might be interested in based on a simple logic and using taxonomy. The aim of this module is to provide sensible defaults and an easy configuration for less-technical users and to allow it to be manually overriden. The module doesn't sufficiently filter user supplied text. The vulnerability is mitigated by the fact that an attacker would need permission to create taxonomy terms or edit node titles to exploit the issue. -------- VERSIONS AFFECTED --------------------------------------------------- * Node recommendation 6.x-1.x versions prior to 6.x-1.1. Drupal core is not affected. If you do not use the contributed Node Recommendation [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Node recommendation module for Drupal 6.x, upgrade to Node recommendation 6.x-1.1 [4] See also the Node Recommendation [5] project page. -------- REPORTED BY --------------------------------------------------------- * Dylan Tack [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Ariel Barreiro [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/noderecommendation [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/noderecommendation [4] http://drupal.org/node/1471906 [5] http://drupal.org/project/noderecommendation [6] http://drupal.org/user/96647 [7] http://drupal.org/user/23157 [8] http://drupal.org/user/36762 [9] http://drupal.org/user/102818 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-033 - Read More Link - Cross Site Scripting
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-033 * Project: Read More Link [1] (third-party module) * Version: 6.x * Date: 2012-March-07 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Read More Link module allows you to move the "Read more" link from the node's links area to the end of the teaser text. A user could inject java script into pages affecting other site users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages." -------- VERSIONS AFFECTED --------------------------------------------------- * Read More Link 6.x-3.x versions prior to and including 6.x-3.0. Drupal core is not affected. If you do not use the contributed Read More Link (Drupal 6 and earlier) [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Read More Link module for Drupal 6.x, upgrade to version 6.x-3.1 [4] or 6.x-5.0 [5] See also the Read More Link [6] project page. -------- REPORTED BY --------------------------------------------------------- * Kyle Small -------- FIXED BY ------------------------------------------------------------ * Stéphane Corlosquet [7] * Todd Nienkerk [8] -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/ed_readmore [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/ed_readmore [4] http://drupal.org/node/1471080 [5] http://drupal.org/node/1306640 [6] http://drupal.org/project/ed_readmore [7] http://drupal.org/user/52142 [8] http://drupal.org/user/92096 [9] http://drupal.org/user/102818 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-032 - Block Class - Cross Site scripting
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-032 * Project: Block Class [1] (third-party module) * Version: 7.x * Date: 2012-March-07 * Security risk: Moderately Critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The block class module allows users to add classes to any block through the block's configuration interface The class names in a block were not properly filtered. Someone with the ability to modify or create blocks could inject java script that would be rendered when viewing the block. -------- VERSIONS AFFECTED --------------------------------------------------- * Blockclass versions prior to 7.x-1.0. Drupal core is not affected. If you do not use the contributed Block Class [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the block class module for Drupal 7.x, upgrade to block class 7.x-1.1 [4] See also the Block Class [5] project page. -------- REPORTED BY --------------------------------------------------------- * Katherine Senzee [6] -------- FIXED BY ------------------------------------------------------------ * Berend de Boer [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/block_class [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/block_class [4] http://drupal.org/node/1471090 [5] http://drupal.org/project/block_class [6] http://drupal.org/user/139855 [7] http://drupal.org/user/143552 [8] http://drupal.org/user/102818 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-031 - Multiple Modules Unsupported - UC PayDutchGroup - Information leakage and Multisite Search sql injection
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-031 * Projects: UC PayDutchGroup / WeDeal payment [1], Multisite Search [2] (third-party modules) * Version: 6.x * Date: 2012-March-7 * Security risk: Critical [3] * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- UC PayDutchGroup / WeDeal payment [4] integrates the PayDutchGroup / WeDeal payment gateway with Ubercart. The module exposes account credentials for the store's PayDutchGroup account under certain circumstances allowing a malicious user to login to the PayDutchGroup site as the store owner and manage the store owner's account. The vulnerability is mitigated by an attacker needing to gain an account with the ability to checkout of the store. Multisite Search [5] allows you to index and search content from all sites in a Multisite configuration. The module doesn't sufficiently escape user input when constructing queries. The vulnerability is mitigated by the fact that in order to execute arbitrary sql injection malicious users must have the ability to administer multisite search. -------- VERSIONS AFFECTED --------------------------------------------------- All versions of UC PayDutchGroup / WeDeal payment are affected by vulnerabilities. All versions of Multisite Search payment are affected by vulnerabilities. Drupal core is not affected. If you do not use one of the contributed modules listed above, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Users of thes modules are encouraged to disable the modules and search for similar alternatives. Users of the module who wish to take over maintainership should post patches to the issue queue to fix the security issues and request maintenance following the Unsupported project process [6] -------- REPORTED BY --------------------------------------------------------- * UC PayDutchGroup / WeDeal payment issue reported by Rolf Meijer [7] * Multisite Search issue reported by Justin Klein Keane [8] -------- FIXED BY ------------------------------------------------------------ No fixes created. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/uc_paydutch [2] http://drupal.org/project/multisite_search [3] http://drupal.org/security-team/risk-levels [4] http://drupal.org/project/uc_paydutch [5] http://drupal.org/project/multisite_search [6] http://drupal.org/node/251466 [7] http://drupal.org/user/358052 [8] http://drupal.org/user/302225 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-030 - Data - Cross Site Scripting (XSS)
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-030 * Project: Data [1] (third-party module) * Version: 6.x * Date: 2012-March-07 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to create arbitrary tables in your Drupal database and manage the data in them, and also manage data in existing tables such as those created by or imported from a third-party application. The module doesn't sufficiently escape the human-readable title that is given to a new table by the admin, thus allowing arbitrary scripts to be run on the site. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer data tables". -------- VERSIONS AFFECTED --------------------------------------------------- * Data 6.x-1.x versions prior to 6.x-1.0. Drupal core is not affected. If you do not use the contributed Data [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Data module for Drupal 6.x, upgrade to Data 6.x-1.1 [4] See also the Data [5] project page. -------- REPORTED BY --------------------------------------------------------- * Justin C. Klein Keane [6] -------- FIXED BY ------------------------------------------------------------ * Joachim Noreiko [7] the module co-maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/data [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/data [4] http://drupal.org/node/1470980 [5] http://drupal.org/project/data [6] http://drupal.org/user/302225 [7] http://drupal.org/user/107701 [8] http://drupal.org/user/36762 [9] http://drupal.org/user/102818 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0