- Security-news - lists.drupal.org

Content Construction Kit (CCK) - Less Critical - Open Redirect - SA-CONTRIB-2015-126
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2507753 * Advisory ID: DRUPAL-SA-CONTRIB-2015-126 * Project: Content Construction Kit (CCK) [1] (third-party module) * Version: 6.x * Date: 2015-June-17 * Security risk: 9/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Open Redirect -------- DESCRIPTION --------------------------------------------------------- The Content Construction Kit (CCK) project is a set of modules that allows you to add custom fields to nodes using a web browser. CCK uses a "destinations" query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks. See also: SA-CORE-2015-002 [3] -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Content Construction Kit (CCK) 6.x-2.x versions prior to 6.x-2.10. Drupal core is not affected. If you do not use the contributed Content Construction Kit (CCK) [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Content Construction Kit (CCK) module for Drupal 6.x, upgrade to Content Construction Kit (CCK) 6.x-2.10 [6] Also see the Content Construction Kit (CCK) [7] project page. -------- REPORTED BY --------------------------------------------------------- * Michael Smith [8] * David Rothstein [9] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Pere Orga [10] of the Drupal Security Team * Neil Drumm [11], module maintainer and member of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * The Drupal Security Team [12] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [17] [1] https://www.drupal.org/project/cck [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/SA-CORE-2015-002 [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/cck [6] https://www.drupal.org/node/2507763 [7] https://www.drupal.org/project/cck [8] https://www.drupal.org/user/1291584 [9] https://www.drupal.org/u/david_rothstein [10] https://www.drupal.org/user/2301194 [11] https://www.drupal.org/user/3064 [12] https://www.drupal.org/security-team [13] https://www.drupal.org/contact [14] https://www.drupal.org/security-team [15] https://www.drupal.org/writing-secure-code [16] https://www.drupal.org/security/secure-configuration [17] https://twitter.com/drupalsecurity

1 0

jQuery Update - Less Critical - Open Redirect - SA-CONTRIB-2015-123
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2507729 * Advisory ID: DRUPAL-SA-CONTRIB-2015-123 * Project: jQuery Update [1] (third-party module) * Version: 7.x * Date: 2015-June-17 * Security risk: 9/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Open Redirect -------- DESCRIPTION --------------------------------------------------------- The jQuery Update module enables you to update jQuery on your site. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack (see SA-CORE-2015-002 [3]). Only sites with the Overlay module enabled are vulnerable. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * jQuery Update 7.x-2.x versions prior to 7.x-2.6 Drupal core is not affected. If you do not use the contributed jQuery Update [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the jQuery Update module 2.x branch, upgrade to jQuery Update 7.x-2.6 [6] Also see the jQuery Update [7] project page. -------- REPORTED BY --------------------------------------------------------- * Jeroen Vreuls [8] * David Rothstein [9] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Pere Orga [10] of the Drupal Security Team * David Rothstein [11] of the Drupal Security Team * Rob Loach [12] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * The Drupal Security Team [13] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [18] [1] https://www.drupal.org/project/jquery_update [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/SA-CORE-2015-002 [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/jquery_update [6] https://www.drupal.org/node/2507555 [7] https://www.drupal.org/project/jquery_update [8] https://www.drupal.org/user/2700643 [9] https://www.drupal.org/user/124982 [10] https://www.drupal.org/user/2301194 [11] https://www.drupal.org/user/124982 [12] https://www.drupal.org/u/robloach [13] https://www.drupal.org/security-team [14] https://www.drupal.org/contact [15] https://www.drupal.org/security-team [16] https://www.drupal.org/writing-secure-code [17] https://www.drupal.org/security/secure-configuration [18] https://twitter.com/drupalsecurity

1 0

LABjs - Less Critical - Open Redirect - SA-CONTRIB-2015-124
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2507735 * Advisory ID: DRUPAL-SA-CONTRIB-2015-124 * Project: LABjs [1] (third-party module) * Version: 7.x * Date: 2015-June-17 * Security risk: 9/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Open Redirect -------- DESCRIPTION --------------------------------------------------------- The LABjs module integrates LABjs with Drupal for web performance optimization. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack (see SA-CORE-2015-002 [3]). Only sites with the Overlay module enabled are vulnerable. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * LABjs 7.x-1.x versions prior to 7.x-1.7. Drupal core is not affected. If you do not use the contributed LABjs [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the LABjs module for Drupal 7.x, upgrade to LABjs 7.x-1.7 [6]. Also see the LABjs [7] project page. -------- REPORTED BY --------------------------------------------------------- * Jeroen Vreuls [8] * David Rothstein [9] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Pere Orga [10] of the Drupal Security Team * David Rothstein [11] of the Drupal Security Team * Hai-Nam Nguyen [12] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * The Drupal Security Team [13] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [18] [1] https://www.drupal.org/project/labjs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/SA-CORE-2015-002 [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/labjs [6] https://www.drupal.org/node/2507561 [7] https://www.drupal.org/project/labjs [8] https://www.drupal.org/user/2700643 [9] https://www.drupal.org/u/david_rothstein [10] https://www.drupal.org/u/pere-orga [11] https://www.drupal.org/u/david_rothstein [12] https://www.drupal.org/u/jcisio [13] https://www.drupal.org/security-team [14] https://www.drupal.org/contact [15] https://www.drupal.org/security-team [16] https://www.drupal.org/writing-secure-code [17] https://www.drupal.org/security/secure-configuration [18] https://twitter.com/drupalsecurity

1 0

Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2015-002
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/SA-CORE-2015-002 * Advisory ID: DRUPAL-SA-CORE-2015-002 * Project: Drupal core [1] * Version: 6.x, 7.x * Date: 2015-June-17 * Security risk: 15/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Access bypass, Information Disclosure, Open Redirect, Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- .... Impersonation (OpenID module - Drupal 6 and 7 - Critical) A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts. This vulnerability is mitigated by the fact that the victim must have an account with an associated OpenID identity from a particular set of OpenID providers (including, but not limited to, Verisign, LiveJournal, or StackExchange). .... Open redirect (Field UI module - Drupal 7 - Less critical) The Field UI module uses a "destinations" query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks. This vulnerability is mitigated by the fact that only sites with the Field UI module enabled are affected. Drupal 6 core is not affected, but see the similar advisory for the Drupal 6 contributed CCK module: SA-CONTRIB-2015-126 [3] .... Open redirect (Overlay module - Drupal 7 - Less critical) The Overlay module displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability. This vulnerability is mitigated by the fact that it can only be used against site users who have the "Access the administrative overlay" permission, and that the Overlay module must be enabled. .... Information disclosure (Render cache system - Drupal 7 - Less critical) On sites utilizing Drupal 7's render cache system to cache content on the site by user role, private content viewed by user 1 may be included in the cache and exposed to non-privileged users. This vulnerability is mitigated by the fact that render caching is not used in Drupal 7 core itself (it requires custom code or the contributed Render Cache [4] module to enable) and that it only affects sites that have user 1 browsing the live site. Exposure is also limited if an administrative role has been assigned to the user 1 account (which is done, for example, by the Standard install profile that ships with Drupal core). -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * Impersonation (OpenID module - Drupal 6 and 7): *CVE-2015-3234* * Open redirect (Field UI module - Drupal 7): *CVE-2015-3232* * Open redirect (Overlay module - Drupal 7: *CVE-2015-3233* * Information disclosure (Render cache system - Drupal 7): *CVE-2015-3231* -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal core 6.x versions prior to 6.36 * Drupal core 7.x versions prior to 7.38 -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Drupal 6.x, upgrade to Drupal core 6.36 [5] * If you use Drupal 7.x, upgrade to Drupal core 7.38 [6] Also see the Drupal core [7] project page. -------- REPORTED BY --------------------------------------------------------- Impersonation in the OpenID module: * Vladislav Mladenov * Christian Mainka [8] * Christian Koßmann [9] Open redirect in the Field UI module: * Michael Smith [10] Open redirect in the Overlay module: * Jeroen Vreuls [11] * David Rothstein [12] of the Drupal Security Team Information disclosure in the render cache system: * Nathaniel Catchpole [13] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ Impersonation in the OpenID module: * Christian Schmidt [14], OpenID module maintainer * Christian Mainka [15] * Christian Koßmann [16] Open redirect in the Field UI module: * Yves Chedemois [17], Field UI module maintainer * Damien McKenna [18] provisional member of the Drupal Security Team * Pere Orga [19] of the Drupal Security Team * David Rothstein [20] of the Drupal Security Team * Klaus Purer [21] of the Drupal Security Team Open redirect in the Overlay module: * Jeroen Vreuls [22] * Ben Dougherty [23] of the Drupal Security Team * David Rothstein [24] of the Drupal Security Team * Katherine Senzee [25], Overlay module maintainer Information disclosure in the render cache system: * David Rothstein [26] of the Drupal Security Team * Wim Leers [27] * willzyx [28] -------- COORDINATED BY ------------------------------------------------------ * The Drupal Security Team [29] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [30]. Learn more about the Drupal Security team and their policies [31], writing secure code for Drupal [32], and securing your site [33]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [34] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/2507753 [4] https://www.drupal.org/project/render_cache [5] https://www.drupal.org/drupal-6.36-release-notes [6] https://www.drupal.org/drupal-7.38-release-notes [7] https://www.drupal.org/project/drupal [8] https://www.drupal.org/user/1096424 [9] https://www.drupal.org/user/3101253 [10] https://www.drupal.org/user/1291584 [11] https://www.drupal.org/user/2700643 [12] https://www.drupal.org/u/david_rothstein [13] https://www.drupal.org/u/catch [14] https://www.drupal.org/user/216078 [15] https://www.drupal.org/user/1096424 [16] https://www.drupal.org/user/3101253 [17] https://www.drupal.org/user/39567 [18] https://www.drupal.org/user/108450 [19] https://www.drupal.org/user/2301194 [20] https://www.drupal.org/u/david_rothstein [21] https://www.drupal.org/u/klausi [22] https://www.drupal.org/user/2700643 [23] https://www.drupal.org/user/1852732 [24] https://www.drupal.org/u/david_rothstein [25] https://www.drupal.org/u/ksenzee [26] https://www.drupal.org/u/david_rothstein [27] https://www.drupal.org/user/99777 [28] https://www.drupal.org/user/1043862 [29] https://www.drupal.org/security-team [30] https://www.drupal.org/contact [31] https://www.drupal.org/security-team [32] https://www.drupal.org/writing-secure-code [33] https://www.drupal.org/security/secure-configuration [34] https://twitter.com/drupalsecurity

1 0

Acquia Cloud Site Factory Connector - Less Critical - Open Redirect - SA-CONTRIB-2015-125
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2507741 * Advisory ID: DRUPAL-SA-CONTRIB-2015-125 * Project: Acquia Cloud Site Factory Connector [1] (third-party module) * Version: 7.x * Date: 2015-June-17 * Security risk: 9/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Open Redirect -------- DESCRIPTION --------------------------------------------------------- Acquia Cloud Site Factory provides an environment and a robust set of tools that simplify management of many Drupal sites, allowing you to quickly deliver and manage any number of websites. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack (see SA-CORE-2015-002 [3]). Only sites with the Overlay module enabled are vulnerable. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Acquia Cloud Site Factory 7.x-1.x versions prior to 7.x-1.14 Drupal core is not affected. If you do not use the contributed Acquia Cloud Site Factory Connector [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Acquia Cloud Site Factory module for Drupal 7.x, upgrade to Acquia Cloud Site Factory 7.x-1.14 [6] Also see the Acquia Cloud Site Factory Connector [7] project page. -------- REPORTED BY --------------------------------------------------------- * Jeroen Vreuls [8] * David Rothstein [9] of the Drupal Security Team * Pere Orga [10] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Stéphane Corlosquet [11], module maintainer and member of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * The Drupal Security Team [12] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [17] [1] https://www.drupal.org/project/acsf [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/SA-CORE-2015-002 [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/acsf [6] https://www.drupal.org/node/2507535 [7] https://www.drupal.org/project/acsf [8] https://www.drupal.org/user/2700643 [9] https://www.drupal.org/u/david_rothstein [10] https://www.drupal.org/u/pere-orga [11] https://www.drupal.org/u/scor [12] https://www.drupal.org/security-team [13] https://www.drupal.org/contact [14] https://www.drupal.org/security-team [15] https://www.drupal.org/writing-secure-code [16] https://www.drupal.org/security/secure-configuration [17] https://twitter.com/drupalsecurity

1 0

Administration Views - Moderately Critical - Access Bypass - SA-CONTRIB-2015-122
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2507645 * Advisory ID: DRUPAL-SA-CONTRIB-2015-122 * Project: Administration Views [1] (third-party module) * Version: 7.x * Date: 2015-June-17 * Security risk: 12/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module replaces administrative overview/listing pages with Views for improved usability. When combined with other contributed or custom modules, the Administration Views module improperly grants users access to administration pages including the permissions page. This vulnerability is mitigated by the fact that it does not appear in the module itself, but only when combined with select other custom or contributed modules. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Administration Views 7.x-1.x versions prior to 7.x-1.4. Drupal core is not affected. If you do not use the contributed Administration Views [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Administration Views module for Drupal 7.x, upgrade to Administration Views 7.x-1.4 [5] Also see the Administration Views [6] project page. -------- REPORTED BY --------------------------------------------------------- * Barry Fisher [7] -------- FIXED BY ------------------------------------------------------------ * Robert [8] -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/admin_views [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/admin_views [5] https://www.drupal.org/node/2430043 [6] https://www.drupal.org/project/admin_views [7] https://www.drupal.org/user/202648 [8] https://www.drupal.org/u/rob230 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

The eXtensible Catalog (XC) Drupal Toolkit - Critical - Cross Site Request Forgery (CSRF) - Unsupported - SA-CONTRIB-2015-121
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2507619 * Advisory ID: DRUPAL-SA-CONTRIB-2015-121 * Project: The eXtensible Catalog (XC) Drupal Toolkit [1] (third-party module) * Version: 6.x, 7.x * Date: 2015-June-17 * Security risk: 15/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The eXtensible Catalog Drupal Toolkit is a set of Drupal modules to harvest records of the XC Schema format from a Metadata Services Toolkit (MST). The XC NCIP Provider module doesn't sufficiently protect some URLs against CSRF. A malicious user can cause a user with "administer ncip providers" permission to alter NCIP providers by getting their browser to make a request to a specially-crafted URL. This vulnerability is mitigated by the fact that only sites that have the XC NCIP Provider module enabled are affected. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All versions of The eXtensible Catalog (XC) Drupal Toolkit Drupal core is not affected. If you do not use the contributed The eXtensible Catalog (XC) Drupal Toolkit [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use The eXtensible Catalog (XC) Drupal Toolkit you should uninstall it. Also see the The eXtensible Catalog (XC) Drupal Toolkit [5] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [12] [1] https://www.drupal.org/project/xc [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/xc [5] https://www.drupal.org/project/xc [6] https://www.drupal.org/user/2301194 [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/contact [9] https://www.drupal.org/security-team [10] https://www.drupal.org/writing-secure-code [11] https://www.drupal.org/security/secure-configuration [12] https://twitter.com/drupalsecurity

1 0

Inline Entity Form - Less critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-120
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2507605 * Advisory ID: DRUPAL-SA-CONTRIB-2015-120 * Project: Inline Entity Form [1] (third-party module) * Version: 7.x * Date: 2015-June-17 * Security risk: 7/25 ( Less Critical) AC:Basic/A:Admin/CI:None/II:None/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Inline Entity Form module provides a field widget for inline management (creation, modification, removal) of referenced entities. The module doesn't sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create/edit fields. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Inline Entity Form 7.x-1.x versions prior to 7.x-1.6. Drupal core is not affected. If you do not use the contributed Inline Entity Form [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Inline Entity Form module for Drupal 7.x, upgrade to Inline Entity Form 7.x-1.6 [5] Also see the Inline Entity Form [6] project page. -------- REPORTED BY --------------------------------------------------------- * Matt Vance [7], provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Matt Vance [8], provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [13] [1] https://www.drupal.org/project/inline_entity_form [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/inline_entity_form [5] https://www.drupal.org/node/2507593 [6] https://www.drupal.org/project/inline_entity_form [7] https://www.drupal.org/user/88338 [8] https://www.drupal.org/user/88338 [9] https://www.drupal.org/contact [10] https://www.drupal.org/security-team [11] https://www.drupal.org/writing-secure-code [12] https://www.drupal.org/security/secure-configuration [13] https://twitter.com/drupalsecurity

1 0

Apache Solr Real-Time - Critical - Access Bypass - SA-CONTRIB-2015-119
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2507581 * Advisory ID: DRUPAL-SA-CONTRIB-2015-119 * Project: Apache Solr Real-Time [1] (third-party module) * Version: 7.x * Date: 2015-June-17 * Security risk: 15/25 ( Critical) AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module allows content-changes to be committed to Apache Solr in real-time. The module doesn't check the status of an entity being indexed which means that unpublished content will get indexed by Solr and the title and partial content may be exposed to any user who has permission to search site content. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Apache Solr Real-Time 7.x-2.x versions prior to 7.x-2.2. Drupal core is not affected. If you do not use the contributed Apache Solr Real-Time [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Apache Solr Real-Time module for Drupal 7.x, upgrade to Apache Solr Real-Time 7.x-2.2 [5] Also see the Apache Solr Real-Time [6] project page. -------- REPORTED BY --------------------------------------------------------- * Hunter Fox [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Marcus Deglos [8] the module maintainer * Steve Williams [9] the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/apachesolr_realtime [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/apachesolr_realtime [5] https://www.drupal.org/node/2489890 [6] https://www.drupal.org/project/apachesolr_realtime [7] https://www.drupal.org/user/426416 [8] https://www.drupal.org/user/321496 [9] https://www.drupal.org/user/223023 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

HTTP Strict Transport Security - Moderately Critical - Logical Error - SA-CONTRIB-2015-118
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2507563 * Advisory ID: DRUPAL-SA-CONTRIB-2015-118 * Project: HTTP Strict Transport Security [1] (third-party module) * Version: 6.x, 7.x * Date: 2015-June-17 * Security risk: 12/25 ( Moderately Critical) AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- The contributed HSTS module makes it easy for site administrators to implement HTTP Strict Transport Security (HSTS) by setting the Strict-Transport-Security header on each page generated by Drupal. HSTS module provides a configuration UI for the HSTS "include subdomains" directive, which indicates that the browser should apply the HSTS policy to all subdomains on the site's domain. HSTS module did not implement the "include subdomains" directive correctly (it is misspelled as include_subdomains rather than includeSubDomains). As a result, the HSTS policy was not applied to subdomains as site administrators had expected. This vulnerability is mitigated by the fact that only subdomains where HSTS was expected to be enabled are affected and an attacker would still need to execute a man-in-the-middle attack to exploit the issue. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * HSTS 7.x-1.x versions prior to 7.x-1.2. * HSTS 6.x-1.x versions prior to 6.x-1.1. Drupal core is not affected. If you do not use the contributed HTTP Strict Transport Security [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the HSTS module for Drupal 7.x, upgrade to HSTS 7.x-1.2 [5] * If you use the HSTS module for Drupal 6.x, upgrade to HSTS 6.x-1.1 [6] Also see the HTTP Strict Transport Security [7] project page. -------- REPORTED BY --------------------------------------------------------- * Mark Burdett [8] -------- FIXED BY ------------------------------------------------------------ * Mark Burdett [9] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/hsts [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/hsts [5] https://www.drupal.org/node/2507539 [6] https://www.drupal.org/node/2507543 [7] https://www.drupal.org/project/hsts [8] https://www.drupal.org/user/12302 [9] https://www.drupal.org/user/12302 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0