Security-news

Download

security-news@drupal.org

April 2012

1 participants
12 discussions

SA-CONTRIB-2012-057 - Printer, email and PDF versions - Cross Site Scripting (XSS)
by security-news＠drupal.org 05 Apr '12

05 Apr '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-057 * Project: Printer, email and PDF versions [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-April-04 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module provides printer-friendly versions of content, including send by e-mail and PDF versions. The module doesn't sufficiently escape URL elements which are printed back to the user. -------- VERSIONS AFFECTED --------------------------------------------------- * Printer, email and PDF versions 6.x-1.x versions prior to 6.x-1.15. * Printer, email and PDF versions 7.x-1.x versions prior to 7.x-1.0. Drupal core is not affected. If you do not use the contributed Printer, email and PDF versions [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Printer, email and PDF versions module for Drupal 6.x, upgrade to Printer, email and PDF versions 6.x-1.15 [4] * If you use the Printer, email and PDF versions module for Drupal 7.x, upgrade to Printer, email and PDF versions 7.x-1.0 [5] Also see the Printer, email and PDF versions [6] project page. -------- REPORTED BY --------------------------------------------------------- * Shlomi Zadok [7] * Ivan Bueno [8] -------- FIXED BY ------------------------------------------------------------ * João Ventura [9] the module maintainer * Ivan Bueno [10] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [11] of the Drupal Security Team * James Gilliland [12] of the Drupal Security Team * Michael Hess [13] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. [1] http://drupal.org/project/print [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/print [4] http://drupal.org/node/1515060 [5] http://drupal.org/node/1515076 [6] http://drupal.org/project/print [7] http://drupal.org/user/408236 [8] http://drupal.org/user/578064 [9] http://drupal.org/user/122464 [10] http://drupal.org/user/578064 [11] http://drupal.org/user/36762 [12] http://drupal.org/user/48673 [13] http://drupal.org/user/102818 [14] http://drupal.org/contact [15] http://drupal.org/security-team [16] http://drupal.org/writing-secure-code [17] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-056 - Janrain Engage - Sensitive Data Protection Vulnerability
by security-news＠drupal.org 04 Apr '12

04 Apr '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-056 * Project: Janrain Engage (formerly RPX) [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-April-04 * Security risk: Less critical [2] * Exploitable from: Not exploitable * Vulnerability: Sensitive Data Protection Vulnerability -------- DESCRIPTION --------------------------------------------------------- Using Janrain Engage, Drupal sites can authenticate new and existing users with popular social networks, map user profile data from these websites to Drupal fields, and share Drupal content with a user's friends on their social networks. The module permanently retains the complete user profile data returned from Engage in the users table. Only a subset of that data is needed for a limited time. The profile data is also stored in the sessions table. This is undesirable as it may include sensitive information (such as provider access tokens). This is not an immediate vulnerability per se as it does not create an attack vector (i.e. it cannot be exploited) but it makes other weaknesses much more critical (e.g. a data breach could be parlayed into privilege escalation). -------- VERSIONS AFFECTED --------------------------------------------------- * Janrain Engage (formerly RPX) 6.x-1.x versions (all). * Janrain Engage (formerly RPX) 6.x-2.x versions prior to 6.x-2.2. * Janrain Engage (formerly RPX) 7.x-2.x versions prior to 7.x-2.2. Drupal core is not affected. If you do not use the contributed Janrain Engage (formerly RPX) [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Janrain Engage (formerly RPX) for Drupal 6.x, upgrade to version 6.x-2.2 [4] * If you use Janrain Engage (formerly RPX) for Drupal 7.x, upgrade to version 7.x-2.2 [5] Also see the Janrain Engage (formerly RPX) [6] project page. -------- REPORTED BY --------------------------------------------------------- * Peter Wolanin [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * George Katsitadze [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Peter Wolanin [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/rpx [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/rpx [4] http://drupal.org/node/1515114 [5] http://drupal.org/node/1515120 [6] http://drupal.org/project/rpx [7] http://drupal.org/user/49851 [8] http://drupal.org/user/933066 [9] http://drupal.org/user/49851 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0