July 2016 - Security-news - lists.drupal.org

Drupal Core - Highly Critical - Injection - SA-CORE-2016-003
by security-news＠drupal.org 18 Jul '16

18 Jul '16

View online: https://www.drupal.org/SA-CORE-2016-003 * Advisory ID: DRUPAL-SA-2016-002 * Project: Drupal core [1] * Version: 8.x * Date: 2016-July-18 * Security risk: 20/25 ( Highly Critical) AC:Basic/A:None/CI:All/II:All/E:Proof/TD:Default [2] * Vulnerability: Injection -------- DESCRIPTION --------------------------------------------------------- Drupal 8 uses the third-party PHP library Guzzle for making server-side HTTP requests. An attacker can provide a proxy server that Guzzle will use. The details of this are explained at https://httpoxy.org/ [3]. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal core 8.x versions prior to 8.1.7 -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Drupal 8.x, upgrade to Drupal core 8.1.7 [5] * If you use Drupal 7.x, Drupal core is not affected. However you should consider using the mitigation steps at https://httpoxy.org/ [6] since you might have modules or other software on your server affected by this issue. For example, sites using Apache can add the following code to .htaccess: RequestHeader unset Proxy We also suggest mitigating it as described here: https://httpoxy.org/ [7] Also see the Drupal core [8] project page. -------- WHAT IF I AM RUNNING DRUPAL CORE 8.0.X? ----------------------------- Drupal core 8.0.x is no longer supported. Update to 8.1.7 to get the latest security and bug fixes. -------- WHY IS THIS BEING RELEASED MONDAY RATHER THAN WEDNESDAY? ------------ The Drupal Security Team usually releases Security Advisories on Wednesdays. However, this vulnerability affects more than Drupal, and the authors of Guzzle and reporters of the issue coordinated to make it public Monday. Therefore, we are issuing a core release to update to the secure version of Guzzle today. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [13] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://httpoxy.org/ [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/drupal/releases/8.1.7 [6] https://httpoxy.org/ [7] https://httpoxy.org/ [8] https://www.drupal.org/project/drupal [9] https://www.drupal.org/contact [10] https://www.drupal.org/security-team [11] https://www.drupal.org/writing-secure-code [12] https://www.drupal.org/security/secure-configuration [13] https://twitter.com/drupalsecurity

1 0

Drupal 8.x core release on Monday -- PSA-2016-002
by security-news＠drupal.org 17 Jul '16

17 Jul '16

View online: https://www.drupal.org/PSA-2016-002 * Advisory ID: DRUPAL-PSA-2016-002 * Project: Drupal * Version: 8.x * Date: 2016-July-17 * Security risk: TBD * Vulnerability: TBD -------- DESCRIPTION --------------------------------------------------------- We will be doing a Drupal 8 core patch release on Monday, July 18th. This will occur between 14:15 UTC and 19:00 UTC. There will not be a Drupal 7 release during this window. -------- WHY IS THIS RELEASE BEING ISSUED? ----------------------------------- The Drupal security team has learned that a third-party Drupal 8 dependency will be making a security release on Monday, July 18th and in accordance we will be making a Drupal 8 release soon after. We will not disclose details of the third-party update in advance of that release and cannot respond to requests for further information. This security release is for the dependency only and only affects Drupal 8 sites. Other mitigating factors will be included with our published SA. -------- WHAT ABOUT THE REGULARLY SCHEDULED RELEASE WINDOW ON WEDNESDAY, JULY 20? ----------------------------------------------------------------- We are moving the regularly scheduled window two days earlier to provide the third-party dependency update, so this replaces that window. There will not be another core release on Wednesday, July 20th. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [1]. Learn more about the Drupal Security team and their policies [2], writing secure code for Drupal [3], and securing your site [4]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [5] [1] https://www.drupal.org/contact [2] https://www.drupal.org/security-team [3] https://www.drupal.org/writing-secure-code [4] https://www.drupal.org/security/secure-configuration [5] https://twitter.com/drupalsecurity

1 0

RESTWS - Highly critical - Remote code execution - SA-CONTRIB-2016-040
by security-news＠drupal.org 13 Jul '16

13 Jul '16

View online: https://www.drupal.org/node/2765567 * Advisory ID: DRUPAL-SA-CONTRIB-2016-040 * Project: RESTful Web Services [1] (third-party module) * Version: 7.x * Date: 2016-July-13 * Security risk: 22/25 ( Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:All [2] * Vulnerability: Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- This module enables you to expose Drupal entities as RESTful web services. RESTWS alters the default page callbacks for entities to provide additional functionality. A vulnerability in this approach allows an attacker to send specially crafted requests resulting in arbitrary PHP execution. There are no mitigating factors. This vulnerability can be exploited by anonymous users. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * RESTful Web Services 7.x-2.x versions prior to 7.x-2.6. * RESTful Web Services 7.x-1.x versions prior to 7.x-1.7. Drupal core is not affected. If you do not use the contributed RESTful Web Services [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the RESTful Web Services module for Drupal 7.x, upgrade to RESTful Web Services 7.x-2.6 [5] * If you use the RESTful Web Services module for Drupal 7.x, upgrade to RESTful Web Services 7.x-1.7 [6] Also see the RESTful Web Services [7] project page. -------- REPORTED BY --------------------------------------------------------- * Devin Zuczek [8] -------- FIXED BY ------------------------------------------------------------ * Klaus Purer [9] of the Drupal Security Team * Wolfgang Ziegler [10] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [11] of the Drupal Security Team * Greg Knaddison [12] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [17] [1] https://www.drupal.org/project/restws [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/restws [5] https://www.drupal.org/project/restws/releases/7.x-2.6 [6] https://www.drupal.org/project/restws/releases/7.x-1.7 [7] https://www.drupal.org/project/restws [8] https://www.drupal.org/user/701754 [9] https://www.drupal.org/user/262198 [10] https://www.drupal.org/u/fago [11] https://www.drupal.org/user/262198 [12] https://www.drupal.org/u/greggles [13] https://www.drupal.org/contact [14] https://www.drupal.org/security-team [15] https://www.drupal.org/writing-secure-code [16] https://www.drupal.org/security/secure-configuration [17] https://twitter.com/drupalsecurity

1 0

Coder - Highly Critical - Remote Code Execution - SA-CONTRIB-2016-039
by security-news＠drupal.org 13 Jul '16

13 Jul '16

View online: https://www.drupal.org/node/2765575 * Advisory ID: DRUPAL-SA-CONTRIB-2016-039 * Project: Coder [1] (third-party module) * Version: 7.x * Date: 2016-July-13 * Security risk: 20/25 ( Highly Critical) AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:All [2] * Vulnerability: Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- The Coder module checks your Drupal code against coding standards and other best practices. It can also fix coding standard violations and perform basic upgrades on modules. The module doesn't sufficiently validate user inputs in a script file that has the php extension. A malicious unauthenticated user can make requests directly to this file to execute arbitrary php code. There are no mitigating factors. The module does not need to be enabled for this to be exploited. Its presence on the file system and being reachable from the web are sufficient. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Coder module 7.x-1.x versions prior to 7.x-1.3. * Coder module 7.x-2.x versions prior to 7.x-2.6. Drupal core is not affected. If you do not use the contributed Coder [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Two solutions are possible. A first option is to remove the module from all publicly available websites: * The coder module is intended to be used in development environments and is not intended to be on publicly available servers. Therefore, one simple solution is to remove the entire coder module directory from any publicly accessible website. A second option is to install the latest version: * If you use the Coder module for Drupal 7.x, upgrade to Coder 7.x-1.3 [5] or Coder 7.x-2.6 [6]. Also see the Coder [7] project page. -------- REPORTED BY --------------------------------------------------------- * Nicky Bloor [8] -------- FIXED BY ------------------------------------------------------------ * Jim Berry [9] the module maintainer * David Rothstein [10] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [11] of the Drupal Security Team * Michael Hess [12] of the Drupal Security Team * Klaus Purer [13] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [18] [1] https://www.drupal.org/project/coder [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/coder [5] https://www.drupal.org/project/coder/releases/7.x-1.3 [6] https://www.drupal.org/project/coder/releases/7.x-2.6 [7] https://www.drupal.org/project/coder [8] https://www.drupal.org/user/3469027 [9] https://www.drupal.org/user/240748 [10] https://www.drupal.org/user/124982 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/user/102818 [13] https://www.drupal.org/user/262198 [14] https://www.drupal.org/contact [15] https://www.drupal.org/security-team [16] https://www.drupal.org/writing-secure-code [17] https://www.drupal.org/security/secure-configuration [18] https://twitter.com/drupalsecurity

1 0

Webform Multiple File Upload - Critical - Remote Code Execution - SA-CONTRIB-2016-038
by security-news＠drupal.org 13 Jul '16

13 Jul '16

View online: https://www.drupal.org/node/2765573 * Advisory ID: DRUPAL-SA-CONTRIB-2016-038 * Project: Webform Multiple File Upload [1] (third-party module) * Version: 7.x * Date: 2016-July-13 * Security risk: 17/25 ( Critical) AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] * Vulnerability: Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- The Webform Multiple File Upload module allows users to upload multiple files on a Webform. The Webform Multifile File Upload module contains a Remote Code Execution (RCE) vulnerability where form inputs will be unserialized and a specially crafted form input may trigger arbitrary code execution depending on the libraries available on a site. This vulnerability is mitigated by the fact that an attacker must have the ability to submit a Webform with a Multiple File Input field. Further, a site must have an object defined with methods that are invoked at wake/destroy that include code that can be leveraged for malicious purposes. Drupal 7 Core contains one such class which can be used to delete arbitrary files, but contributed or custom classes may include methods that can be leveraged for RCE. /Note: this vulnerability exists in the Webform Multiple File Upload (webform_multifile) module. There is a similarly named module Webform Multiple File (webform_multiple_file) which is not related to this issue./ -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- Webform Multifile 7.x-1.x versions prior to 7.x-1.4 Drupal core is not affected. If you do not use the contributed Webform Multiple File Upload [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Webform Multifile module for Drupal 7.x, upgrade to Webform Multiple File Upload 7.x-1.4 [5] Also see the Webform Multiple File Upload [6] project page. -------- REPORTED BY --------------------------------------------------------- * Ben Dougherty [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Jelle Sebreghts [8] the module maintainer * Peter Droogmans [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Ben Dougherty [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/webform_multifile [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/webform_multifile [5] https://www.drupal.org/project/webform_multifile/releases/7.x-1.4 [6] https://www.drupal.org/project/webform_multifile [7] https://www.drupal.org/user/1852732 [8] https://www.drupal.org/user/829198 [9] https://www.drupal.org/user/105002 [10] https://www.drupal.org/user/1852732 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

Drupal contrib - Highly Critical - Remote code execution PSA-2016-001
by security-news＠drupal.org 12 Jul '16

12 Jul '16

View online: https://www.drupal.org/node/2764899 * Advisory ID: DRUPAL-PSA-2016-001 * Project: Drupal contributed modules * Version: 7.x * Date: 2016-July-12 * Security risk: 22/25 ( Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:All [1] * Vulnerability: Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- There will be multiple releases of Drupal contributed modules on Wednesday July 13th 2016 16:00 UTC that will fix highly critical remote code execution vulnerabilities (risk scores up to 22/25 [2]). The Drupal Security Team urges you to reserve time for module updates at that time because exploits are expected to be developed within hours/days. Release announcements will appear at the standard announcement locations. [3] Drupal core is not affected. Not all sites will be affected. You should review the published advisories on July 13th 2016 to see if any modules you use are affected. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [4]. Learn more about the Drupal Security team and their policies [5], writing secure code for Drupal [6], and securing your site [7]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [8] [1] https://www.drupal.org/security-team/risk-levels [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/security/contrib [4] https://www.drupal.org/contact [5] https://www.drupal.org/security-team [6] https://www.drupal.org/writing-secure-code [7] https://www.drupal.org/security/secure-configuration [8] https://twitter.com/drupalsecurity

1 0

Instagram Block - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-037
by security-news＠drupal.org 06 Jul '16

06 Jul '16

View online: https://www.drupal.org/node/2761465 * Advisory ID: DRUPAL-SA-CONTRIB-2016-037 * Project: Instagram Block [1] (third-party module) * Version: 7.x, 8.x * Date: 2016-July-06 * Security risk: 12/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:None/E:Proof/TD:All [2] * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- This module enables you to authenticate with Instagram's API via an intermediary service (instagram.yanniboi.com) The module doesn't sufficiently advise that your authentication tokens could be intercepted. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Instagram Block 7.x-1.x versions prior to 7.x-1.4. Drupal core is not affected. If you do not use the contributed Instagram Block [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the instagram_block module for Drupal 7.x, upgrade to instagram_block 7.x-1.4 [5] Also see the Instagram Block [6] project page. -------- REPORTED BY --------------------------------------------------------- * Joshua Ellinger [7] -------- FIXED BY ------------------------------------------------------------ * Yan Loetzer [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/instagram_block [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/instagram_block [5] https://www.drupal.org/node/2746207 [6] https://www.drupal.org/project/instagram_block [7] https://www.drupal.org/user/100971 [8] https://www.drupal.org/user/1837556 [9] https://www.drupal.org/u/mlhess [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0