July 2015 - Security-news - lists.drupal.org

Time Tracker - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-135
by security-news＠drupal.org 22 Jul '15

22 Jul '15

View online: https://www.drupal.org/node/2537866 * Advisory ID: DRUPAL-SA-CONTRIB-2015-135 * Project: Time Tracker [1] (third-party module) * Version: 7.x * Date: 2015-July-22 * Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting, Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- This module enables you to track time on entities and comments. The module doesn't sufficiently filter notes added to time entries, leading to an XSS/JavaScript injection vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "/Add Time Tracker Entries/". The module doesn't sufficiently filter activities used to categorize time tracker entries. This vulnerability is mitigated by the fact that an attacker must have a role with the "/Administer Time Tracker/" permission. This role has also been properly marked as "/restrict access/". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Time Tracker 7.x-1.x versions prior to 7.x-1.4. Drupal core is not affected. If you do not use the contributed Time Tracker [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Time Tracker module for Drupal 7.x, update to Time Tracker 7.x-1.4 [5]. Also see the Time Tracker [6] project page. -------- REPORTED BY --------------------------------------------------------- * Xavier Landreville [7] -------- FIXED BY ------------------------------------------------------------ * Xavier Landreville [8] -------- COORDINATED BY ------------------------------------------------------ * Frédéric G. Marand [9], provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/time_tracker [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/time_tracker [5] https://www.drupal.org/node/2537296 [6] https://www.drupal.org/project/time_tracker [7] https://www.drupal.org/user/888364 [8] https://www.drupal.org/user/888364 [9] https://www.drupal.org/user/27985 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

OSF for Drupal - Critical - Multiple vulnerabilities - SA-CONTRIB-2015-134
by security-news＠drupal.org 22 Jul '15

22 Jul '15

View online: https://www.drupal.org/node/2537860 * Advisory ID: DRUPAL-SA-CONTRIB-2015-134 * Project: OSF for Drupal [1] (third-party module) * Version: 7.x * Date: 2015-July-22 * Security risk: 15/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Cross Site Scripting, Access bypass, Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Open Semantic Framework (OSF) for Drupal is a middleware layer that allows structured data (RDF) and associated vocabularies (ontologies) to "drive" tailored tools and data displays within Drupal. The module is vulnerable to reflected Cross Site Scripting (XSS) because it did not sufficiently filter user input values in some administration pages. An attacker could exploit this vulnerability by making other users visit a specially-crafted URL. Only sites with OSF Ontology module enabled are affected. Additionally, the module is vulnerable to Arbitrary file deletion. A malicious user can cause an administrator to delete files by getting their browser to make a request to a specially-crafted URL. Only sites with OSF Ontology and OSF Import modules enabled are affected. Also, some forms were vulnerable to Cross Site Request Forgery (CSRF). An attacker could create new OSF datasets by getting an administrator's browser to make a request to a specially-crafted URL. Only sites with OSF Import module enabled are affected. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * OSF 7.x-3.x versions prior to 7.x-3.1. Drupal core is not affected. If you do not use the contributed OSF for Drupal [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the OSF for Drupal module for Drupal 7.x, upgrade to OSF 7.x-3.1 [5] Also see the OSF for Drupal [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Frederick Giasson [8], the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/osf [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/osf [5] https://www.drupal.org/node/2537120 [6] https://www.drupal.org/project/osf [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/512874 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

Path Breadcrumbs - Less Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-133
by security-news＠drupal.org 15 Jul '15

15 Jul '15

View online: https://www.drupal.org/node/2533926 * Advisory ID: DRUPAL-SA-CONTRIB-2015-133 * Project: Path Breadcrumbs [1] (third-party module) * Version: 7.x * Date: 2015-July-15 * Security risk: 7/25 ( Less Critical) AC:Basic/A:Admin/CI:None/II:None/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to configure breadcrumbs for any Drupal page. The module didn't sufficiently filter user input values the in administration interface. This vulnerability was mitigated by the fact that an attacker must have a role with the permission "Administer Path Breadcrumbs". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Path Breadcrumbs 7.x-3.x versions prior to 7.x-3.3 Drupal core is not affected. If you do not use the contributed Path Breadcrumbs [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Path Breadcrumbs module for Drupal 7.x, upgrade to Path Breadcrumbs 7.x-3.3 [5] Also see the Path Breadcrumbs [6] project page. -------- REPORTED BY --------------------------------------------------------- * Greg Anderson [7] -------- FIXED BY ------------------------------------------------------------ * Greg Anderson [8] * Kate Marshalkina [9], the module co-maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Anderson [10], Provisional Member of the Drupal Security Team * David Snopek [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/path_breadcrumbs [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/path_breadcrumbs [5] https://www.drupal.org/node/2533510 [6] https://www.drupal.org/project/path_breadcrumbs [7] https://www.drupal.org/user/438598 [8] https://www.drupal.org/user/438598 [9] https://www.drupal.org/u/kalabro [10] https://www.drupal.org/user/438598 [11] https://www.drupal.org/u/dsnopek [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

Administrator Views - Critical - Information Disclosure - SA-CONTRIB-2015-132
by security-news＠drupal.org 08 Jul '15

08 Jul '15

View online: https://www.drupal.org/node/2529378 * Advisory ID: DRUPAL-SA-CONTRIB-2015-132 * Project: Administration Views [1] (third-party module) * Version: 7.x * Date: 2015-July-08 * Security risk: 15/25 ( Critical) AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- Administration Views module replaces overview/listing pages with actual views for superior usability. The module does not check access properly under certain circumstances. Anonymous users could get access to read information they should not have access to. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Administration Views 7.x-1.x versions prior to 7.x-1.5. Drupal core is not affected. If you do not use the contributed Administration Views [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Administration Views module for Drupal 7.x, upgrade to Administration Views 7.x-1.5 [5] Also see the Administration Views [6] project page. -------- REPORTED BY --------------------------------------------------------- * Maxim Baev [7] -------- FIXED BY ------------------------------------------------------------ * Damian Lee [8], a module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/admin_views [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/admin_views [5] https://www.drupal.org/node/2529366 [6] https://www.drupal.org/project/admin_views [7] https://www.drupal.org/user/2955009 [8] https://www.drupal.org/u/damiankloip [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

Views Bulk Operations - Moderately critical - Access Bypass - SA-CONTRIB-2015-131
by security-news＠drupal.org 01 Jul '15

01 Jul '15

View online: https://www.drupal.org/node/2516688 * Advisory ID: DRUPAL-SA-CONTRIB-2015-131 * Project: Views Bulk Operations (VBO) [1] (third-party module) * Version: 6.x, 7.x * Date: 2015-July-01 * Security risk: 10/25 ( Moderately Critical) AC:Basic/A:Admin/CI:None/II:All/E:Theoretical/TD:Uncommon [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Views Bulk Operations module enables you to add bulk operations to administration views, executing actions on multiple selected rows. The module doesn't sufficiently guard user entities against unauthorized modification. If a user has access to a user account listing view with VBO enabled (such as admin/people when the administration_views module is used), they will be able to edit their own account and give themselves a higher role (such as "administrator") even if they don't have the "'administer users'" permission. This vulnerability is mitigated by the fact that an attacker must have access to such a user listing page and that the bulk operation for changing Roles is enabled. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Views Bulk Operations 7.x-3.x versions prior to 7.x-3.3. * Views Bulk Operations 6.x-1.x versions. Drupal core is not affected. If you do not use the contributed Views Bulk Operations (VBO) [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Views Bulk Operations module for Drupal 7.x, upgrade to Views Bulk Operations 7.x-3.3 [5] * If you use the Views Bulk Operations module for Drupal 6.x, uninstall the module. Also see the Views Bulk Operations (VBO) [6] project page. -------- REPORTED BY --------------------------------------------------------- * Adam Shepherd [7] -------- FIXED BY ------------------------------------------------------------ * Bojan Zivanovic [8] the module maintainer * Adam Shepherd [9] -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/views_bulk_operations [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/views_bulk_operations [5] https://www.drupal.org/node/2516680 [6] https://www.drupal.org/project/views_bulk_operations [7] https://www.drupal.org/user/2650563 [8] https://www.drupal.org/user/86106 [9] https://www.drupal.org/user/2650563 [10] https://www.drupal.org/u/klausi [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

Migrate - Less critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-130
by security-news＠drupal.org 01 Jul '15

01 Jul '15

View online: https://www.drupal.org/node/2516678 * Advisory ID: DRUPAL-SA-CONTRIB-2015-130 * Project: Migrate [1] (third-party module) * Version: 7.x * Date: 2015-July-01 * Security risk: 8/25 ( Less Critical) AC:Basic/A:Admin/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to manage migration processes through the administrative UI. The module doesn't sufficiently sanitize destination field labels thereby exposing a Cross Site Scripting vulnerability (XSS). This vulnerability is mitigated by the fact that an attacker must have a role with permission to create/edit fields (such as "administer taxonomy"), or be able to modify source data being imported by an administrator. Furthermore, the migrate_ui submodule must be enabled. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Migrate 7.x-2.x versions prior to 7.x-2.8. Drupal core is not affected. If you do not use the contributed Migrate [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the migrate module's migrate_ui submodule for Drupal 7.x, upgrade to Migrate 7.x-2.8 [5] Also see the Migrate [6] project page. -------- REPORTED BY --------------------------------------------------------- * Benji Fisher [7] -------- FIXED BY ------------------------------------------------------------ * Benji Fisher [8] * Mike Ryan [9], the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/migrate [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/migrate [5] https://www.drupal.org/node/2516560 [6] https://www.drupal.org/project/migrate [7] https://www.drupal.org/u/benjifisher [8] https://www.drupal.org/u/benjifisher [9] https://www.drupal.org/user/4420 [10] https://www.drupal.org/u/klausi [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0