March 2013 - Security-news - lists.drupal.org

SA-CONTRIB-2013-039 - Commons Wikis - Access bypass & Privilege escalation
by security-news＠drupal.org 27 Mar '13

27 Mar '13

View online: http://drupal.org/node/1954766 * Advisory ID: DRUPAL-SA-CONTRIB-2013-039 * Project: Commons Wikis [1] (third-party module) * Version: 7.x * Date: 2013-March-27 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass, Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- The Drupal Commons distribution is a tool for building social, group-based collaboration communities. The Commons Wikis module is used by the distribution to provide specific wiki functionality. Versions 3.0 and earlier of the Commons Wikis module is vulnerable to an access bypass and privilege escalation vulnerability that allows anonymous users to post content into groups. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal Commons and Commons Wikis versions prior to 7.x-3.1. Drupal core is not affected. If you do not use the contributed Commons Wikis [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Commons Wikis module upgrade to Commons Wikis 7.x-3.1 [5] or install the latest version of the Drupal Commons distribution (7.x-3.1) which will include the fix for Commons Wikis Also see the Commons Wikis [6] project page. -------- REPORTED BY --------------------------------------------------------- Commons project maintainers: * Jakob Perry [7] * Joseph Pontani [8] * Ezra Gildesgame [9] -------- FIXED BY ------------------------------------------------------------ Commons project maintainers: * Jakob Perry [10] * Joseph Pontani [11] * Ezra Gildesgame [12] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [13] of the Drupal Security Team * Ben Jeavons [14] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [15]. Learn more about the Drupal Security team and their policies [16], writing secure code for Drupal [17], and securing your site [18]. [1] http://drupal.org/project/commons_wikis [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/commons_wikis [5] http://drupal.org/node/1954768 [6] http://drupal.org/project/commons_wikis [7] http://drupal.org/user/45640 [8] http://drupal.org/user/1014606 [9] http://drupal.org/user/69959/ [10] http://drupal.org/user/45640 [11] http://drupal.org/user/1014606 [12] http://drupal.org/user/69959/ [13] http://drupal.org/user/36762 [14] http://drupal.org/user/91990 [15] http://drupal.org/contact [16] http://drupal.org/security-team [17] http://drupal.org/writing-secure-code [18] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-038 - Commons Groups - Access bypass & Privilege escalation
by security-news＠drupal.org 27 Mar '13

27 Mar '13

View online: http://drupal.org/node/1954764 * Advisory ID: DRUPAL-SA-CONTRIB-2013-038 * Project: Commons Groups [1] (third-party module) * Version: 7.x * Date: 2013-March-27 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass, Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- The Drupal Commons distribution is a tool for building social, group-based collaboration communities. The Commons Groups module is used by the distribution to provide specific Organic Groups customizations. Versions 3.0 and earlier of the Commons Groups module is vulnerable to an access bypass and privilege escalation vulnerability that allows anonymous users to post content into groups. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal Commons distribution and Commons Groups versions prior to 7.x-3.1. Drupal core is not affected. If you do not use the contributed Commons Groups [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Commons Groups module upgrade to Commons Groups 7.x-3.1 [5] or install the latest version of the Drupal Commons distribution (7.x-3.1) which will include the fix for Commons Groups Also see the Commons Groups [6] project page. -------- REPORTED BY --------------------------------------------------------- Commons project maintainers: * Joseph Pontani [7] * Jakob Perry [8] * Ezra Gildesgame [9] -------- FIXED BY ------------------------------------------------------------ Commons project maintainers: * Joseph Pontani [10] * Jakob Perry [11] * Ezra Gildesgame [12] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [13] of the Drupal Security Team * Ben Jeavons [14] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [15]. Learn more about the Drupal Security team and their policies [16], writing secure code for Drupal [17], and securing your site [18]. [1] http://drupal.org/project/commons_groups [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/commons_groups [5] http://drupal.org/node/1954762 [6] http://drupal.org/project/commons_groups [7] http://drupal.org/user/1014606 [8] http://drupal.org/user/45640 [9] http://drupal.org/user/69959/ [10] http://drupal.org/user/1014606 [11] http://drupal.org/user/45640 [12] http://drupal.org/user/69959/ [13] http://drupal.org/user/36762 [14] http://drupal.org/user/91990 [15] http://drupal.org/contact [16] http://drupal.org/security-team [17] http://drupal.org/writing-secure-code [18] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-037 - Rules - Cross Site Scripting (XSS)
by security-news＠drupal.org 27 Mar '13

27 Mar '13

View online: http://drupal.org/node/1954592 * Advisory ID: DRUPAL-SA-CONTRIB-2013-037 * Project: Rules [1] (third-party module) * Version: 7.x * Date: 2013-March-27 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Rules module allows site administrators to define conditionally executed actions based on occurring events (known as reactive or ECA rules). It's a replacement with more features for the trigger module in core. The module contains a persistent cross site scripting (XSS) vulnerability due to the fact that it fails to sanitize rule tags before display. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer rules". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Rules 7.x-2.x versions prior to 7.x-2.3. Drupal core is not affected. If you do not use the contributed Rules [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Rules module for Drupal 7.x, upgrade to Rules 7.x-2.3 [5] Also see the Rules [6] project page. -------- REPORTED BY --------------------------------------------------------- * Justin C. Klein Keane [7] -------- FIXED BY ------------------------------------------------------------ * Justin C. Klein Keane [8] * Wolfgang Ziegler [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/rules [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/rules [5] http://drupal.org/node/1954508 [6] http://drupal.org/project/rules [7] http://drupal.org/user/302225 [8] http://drupal.org/user/302225 [9] http://drupal.org/user/16747 [10] http://drupal.org/user/262198 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-036 - Zero Point - Cross Site Scripting (XSS)
by security-news＠drupal.org 27 Mar '13

27 Mar '13

View online: http://drupal.org/node/1954588 * Advisory ID: DRUPAL-SA-CONTRIB-2013-036 * Project: Zero Point [1] (third-party module) * Version: 7.x * Date: 2013-March-27 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Zero Point is a theme which includes many options, ideal for a wide range of sites. The theme does not escape user supplied text which creates a reflected Cross site scripting (XSS) vulnerability in URLs. There are no mitigating factors. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * zeropoint 7.x-1.x versions prior to 7.x-1.9. Drupal core is not affected. If you do not use the contributed Zero Point [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Zero Point theme for Drupal 7.x, upgrade to zeropoint 7.x-1.9 [5] Also see the Zero Point [6] project page. -------- REPORTED BY --------------------------------------------------------- * Dennis Walgaard [7] -------- FIXED BY ------------------------------------------------------------ * Florian Radut [8] the module maintainer * Dennis Walgaard [9] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/zeropoint [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/zeropoint [5] http://drupal.org/node/1953840 [6] http://drupal.org/project/zeropoint [7] http://drupal.org/user/883702 [8] http://drupal.org/user/35316 [9] http://drupal.org/user/883702 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-035 - Views - Cross Site Scripting (XSS)
by security-news＠drupal.org 20 Mar '13

20 Mar '13

View online: http://drupal.org/node/1948358 * Advisory ID: DRUPAL-SA-CONTRIB-2013-035 * Project: Views [1] (third-party module) * Version: 7.x * Date: 2013-March-20 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Views module provides a flexible method for Drupal site designers to control how lists and tables of content, users, taxonomy terms and other data are presented. The module incorrectly prints some view configuration fields without proper sanitization opening a Cross-Site Scripting vulnerability. The vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer vocabularies and terms" or other administer-related permissions from contributed modules that integrate with Views. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Views 7.x-3.x versions prior to 7.x-3.6. Drupal core is not affected. If you do not use the contributed Views [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Views module for Drupal 7.x, upgrade to Views 7.x-3.6 [5] Also see the Views [6] project page. -------- REPORTED BY --------------------------------------------------------- * Francisco José Cruz Romanos [7] -------- FIXED BY ------------------------------------------------------------ * Francisco José Cruz Romanos [8] * Daniel Wehner [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team * Ben Jeavons [11] of the Drupal Security Team * David Stoline [12] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. [1] http://drupal.org/project/views [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/views [5] http://drupal.org/node/1948354 [6] http://drupal.org/project/views [7] http://drupal.org/user/848238 [8] http://drupal.org/user/848238 [9] http://drupal.org/user/99340 [10] http://drupal.org/user/36762 [11] http://drupal.org/user/91990 [12] http://drupal.org/user/329570 [13] http://drupal.org/contact [14] http://drupal.org/security-team [15] http://drupal.org/writing-secure-code [16] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-034 - Node Parameter Control - Access Bypass
by security-news＠drupal.org 13 Mar '13

13 Mar '13

View online: http://drupal.org/node/1942330 * Advisory ID: DRUPAL-SA-CONTRIB-2013-034 * Project: Node Parameter Control [1] (third-party module) * Version: 6.x * Date: 2013-Mar-13 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to limit the visibility of the fields on the node edit form. The module doesn't sufficiently check access before allowing users to view and edit the configuration options allowing anonymous and authenticated users the ability to view and edit the configuration options. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All 6.x-1.x versions Drupal core is not affected. If you do not use the contributed Node Parameter Control [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the module. No patched version is available. Also see the Node Parameter Control [5] project page. -------- REPORTED BY --------------------------------------------------------- * Talbot [6] -------- FIXED BY ------------------------------------------------------------ The module maintainer opted to mark the module as unsupported. -------- COORDINATED BY ------------------------------------------------------ * Lee Rowlands [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/node_parameter_control [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/node_parameter_control [5] http://drupal.org/project/node_parameter_control [6] http://drupal.org/user/36138 [7] http://drupal.org/user/395439 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0