- Security-news - lists.drupal.org

SA-CONTRIB-2015-037 - Path Breadcrumbs - Access Bypass
by security-news＠drupal.org 04 Feb '15

04 Feb '15

View online: https://www.drupal.org/node/2420139 * Advisory ID: DRUPAL-SA-CONTRIB-2015-037 * Project: Path Breadcrumbs [1] (third-party module) * Version: 7.x * Date: 2015-February-04 * Security risk: 12/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to configure breadcrumbs for any Drupal page. The module doesn't check node access on 403 Not Found pages. As a result, unpublished content data can be shown to unprivileged user. This vulnerability is mitigated by the fact that it is possible to configure proper access control in Path Breadcrumbs items with “Selection Rules” from the UI. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Path Breadcrumbs 7.x-3.x versions prior to 7.x-3.2 Drupal core is not affected. If you do not use the contributed Path Breadcrumbs [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Path Breadcrumbs module for Drupal 7.x, upgrade to Path Breadcrumbs 7.x-3.2 [5] Also see the Path Breadcrumbs [6] project page. -------- REPORTED BY --------------------------------------------------------- * Nicholas Thompson [7] -------- FIXED BY ------------------------------------------------------------ * Kate Marshalkina [8] and Evgeniy Maslovskiy [9], the module maintainers -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/path_breadcrumbs [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/path_breadcrumbs [5] https://www.drupal.org/node/2420121 [6] https://www.drupal.org/project/path_breadcrumbs [7] https://www.drupal.org/user/59351 [8] https://www.drupal.org/u/kalabro [9] https://www.drupal.org/user/810676 [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-036 - Public Download Count - Cross Site Scripting (XSS) - Unsupported
by security-news＠drupal.org 04 Feb '15

04 Feb '15

View online: https://www.drupal.org/node/2420119 * Advisory ID: DRUPAL-SA-CONTRIB-2015-036 * Project: Public Download Count [1] (third-party module) * Version: 7.x * Date: 2015-February-04 * Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Public Download Count module keeps track of file download counts. The module doesn't sufficiently sanitize user supplied text in the Download counts report page thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit nodes. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All versions of Public Download Count module. Drupal core is not affected. If you do not use the contributed Public Download Count [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the Public Download Count module you should uninstall it. Also see the Public Download Count [5] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [12] [1] https://www.drupal.org/project/pubdlcnt [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/pubdlcnt [5] https://www.drupal.org/project/pubdlcnt [6] https://www.drupal.org/user/2301194 [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/contact [9] https://www.drupal.org/security-team [10] https://www.drupal.org/writing-secure-code [11] https://www.drupal.org/security/secure-configuration [12] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-035 - Ajax Timeline - Cross Site Scripting (XSS)
by security-news＠drupal.org 04 Feb '15

04 Feb '15

View online: https://www.drupal.org/node/2420099 * Advisory ID: DRUPAL-SA-CONTRIB-2015-035 * Project: Ajax Timeline [1] (third-party module) * Version: 7.x * Date: 2015-February-04 * Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Ajax Timeline module enables you to display a vertical timeline of nodes based off a date field or created date of the configured nodes. The module doesn't sufficiently escape node titles when displaying the timeline, allowing a malicious user to inject code. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit nodes of the type configured for the timeline. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Ajax Timeline 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed Ajax Timeline [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Ajax Timeline module for Drupal 7.x, upgrade to Ajax Timeline 7.x-1.1 [5]. Also see the Ajax Timeline [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Bryan Sharpe [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/ajax_timeline [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/ajax_timeline [5] https://www.drupal.org/node/2419971 [6] https://www.drupal.org/project/ajax_timeline [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/2512258 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-034 - Commerce WeDeal - Open Redirect
by security-news＠drupal.org 04 Feb '15

04 Feb '15

View online: https://www.drupal.org/node/2420089 * Advisory ID: DRUPAL-SA-CONTRIB-2015-034 * Project: Commerce WeDeal [1] (third-party module) * Version: 7.x * Date: 2015-February-04 * Security risk: 10/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] * Vulnerability: Open Redirect -------- DESCRIPTION --------------------------------------------------------- Commerce WeDeal module enables you to do Commerce payments through the payment provider WeDeal. The module doesn't sufficiently check a query parameter used for page redirection, thereby leading to an Open Redirect vulnerability. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Commerce WeDeal 7.x-1.x versions prior to 7.x-1.3. Drupal core is not affected. If you do not use the contributed Commerce WeDeal [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Commerce WeDeal module for Drupal 7.x, upgrade to Commerce WeDeal 7.x-1.3 [5] Also see the Commerce WeDeal [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Jeroen Bobbeldijk [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/commerce_wedeal [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/commerce_wedeal [5] https://www.drupal.org/node/2419483 [6] https://www.drupal.org/project/commerce_wedeal [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/1853532 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-033 - Certify - Access bypass and information disclosure
by security-news＠drupal.org 28 Jan '15

28 Jan '15

View online: https://www.drupal.org/node/2415947 * Advisory ID: DRUPAL-SA-CONTRIB-2015-033 * Project: Certify [1] (third-party module) * Version: 6.x * Date: 2015-January-28 * Security risk: 11/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] * Vulnerability: Access bypass, Information Disclosure, Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- Certify enables you to automatically issue PDF certificates to users upon completion of a set of conditions. The module does not sufficiently check node access when showing (and creating) the PDF certificates. This can lead to users seeing certificates they should not have access to. This vulnerability is mitigated by the fact that an attacker must have completed the conditions of the certificate. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Certify 6.x-2.x versions prior to 6.x-2.3. Drupal core is not affected. If you do not use the contributed Certify [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Certify module for Drupal 6.x, upgrade to Certify 6.x-2.3 [5] Also see the Certify [6] project page. -------- REPORTED BY --------------------------------------------------------- * Jim Gauthier [7] -------- FIXED BY ------------------------------------------------------------ * Håvard Pedersen [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Ben Dougherty [9] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/certify [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/certify [5] https://www.drupal.org/node/2407081 [6] https://www.drupal.org/project/certify [7] https://www.drupal.org/user/3087489 [8] https://www.drupal.org/user/239588/ [9] https://www.drupal.org/user/1852732 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-032 - Node Invite - Multiple vulnerabilities
by security-news＠drupal.org 28 Jan '15

28 Jan '15

View online: https://www.drupal.org/node/2415899 * Advisory ID: DRUPAL-SA-CONTRIB-2015-032 * Project: Node Invite [1] (third-party module) * Version: 6.x * Date: 2015-January-28 * Security risk: 15/25 ( Critical) AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Cross Site Scripting, Cross Site Request Forgery, Open Redirect, Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- Node Invite module enables you to invite people to RSVP on node types that have been configured to represent events. The module doesn't sufficiently sanitize the titles of nodes in some listings, allowing a malicious user to inject code, thereby leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that the attacker must have permission to create or edit nodes configured to be used for RSVP. Additionally, some URLs are not protected against CSRF. A malicious user can cause a user with the "node_invite_can_manage_invite" permission to re-enable node invitations by getting his browser to make a request to a specially-crafted URL. Lastly, the module is not checking that some destination parameters are internal URLs, thereby leading to an Open Redirect vulnerability. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Node Invite 6.x-2.x versions prior to 6.x-2.5. Drupal core is not affected. If you do not use the contributed Node Invite [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Node Invite module for Drupal 6.x, upgrade to Node Invite 6.x-2.5 [5] Also see the Node Invite [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Scott Hadfield [8] the module maintainer * Pere Orga [9] provisional member of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [10] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/node_invite [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/node_invite [5] https://www.drupal.org/node/2415541 [6] https://www.drupal.org/project/node_invite [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/67093 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/user/2301194 [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-031 - GD Infinite Scroll - Multiple vulnerabilites
by security-news＠drupal.org 28 Jan '15

28 Jan '15

View online: https://www.drupal.org/node/2415885 * Advisory ID: DRUPAL-SA-CONTRIB-2015-031 * Project: GD Infinite Scroll [1] (third-party module) * Version: 7.x * Date: 2015-January-28 * Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting, Cross Site Request Forgery, Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- GD Infinite Scroll module enables you to use the "infinite scroll jQuery plugin : auto-pager" on custom pages. Some links were not protected against CSRF. A malicious user could cause another user with the "edit gd infinite scroll settings" permission to delete settings by getting his browser to make a request to a specially-crafted URL. Also, the module fails to sanitize user input in its admin page, leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit gd infinite scroll settings". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- All GD Infinite Scroll versions prior to 7.x-1.4 Drupal core is not affected. If you do not use the contributed GD Infinite Scroll [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version, upgrade to GD Infinite Scroll 7.x-1.4 [5] Also see the GD Infinite Scroll [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Vincent Baronnet [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/gd_infinite_scroll [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/gd_infinite_scroll [5] http://www.drupal.org/node/2415219 [6] https://www.drupal.org/project/gd_infinite_scroll [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/1270276 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-030 - Amazon AWS - Access bypass
by security-news＠drupal.org 28 Jan '15

28 Jan '15

View online: https://www.drupal.org/node/2415873 * Advisory ID: DRUPAL-SA-CONTRIB-2015-030 * Project: Amazon AWS [1] (third-party module) * Version: 7.x * Date: 2015-January-28 * Security risk: 14/25 ( Moderately Critical) AC:None/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Amazon AWS module provides integration with Amazon Web Services (AWS). A malicious user could potentially guess an access token and trigger the creation of new backups by making a request to a specially-crafted URL. If the number of stored backups was limited, an attacker could exceed the limit by calling the URL multiple times, thereby resulting in the loss of older backup states that would get replaced with the newly generated ones. This vulnerability is mitigated by the fact that an attacker must know the AWS Access Key Id (these are not secret). -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Amazon AWS versions prior to 7.x-1.3. Drupal core is not affected. If you do not use the contributed Amazon AWS [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Amazon AWS module for Drupal 7, upgrade to Amazon AWS 7.x-1.3 [5] Also see the Amazon AWS [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Sudhir Krishna [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/aws_amazon [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/aws_amazon [5] https://www.drupal.org/node/2415457 [6] https://www.drupal.org/project/aws_amazon [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/554988 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-029 - Corner - Cross Site Request Forgery (CSRF) - Unsupported
by security-news＠drupal.org 22 Jan '15

22 Jan '15

View online: https://www.drupal.org/node/2411741 * Advisory ID: DRUPAL-SA-CONTRIB-2015-029 * Project: Corner [1] (third-party module) * Version: 6.x * Date: 2015-January-21 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- This module enables you to add configurable corners to your site. A malicious user can cause an administrator to enable and disable corners by getting the administrator's browser to make a request to a specially-crafted URL while the administrator is logged in. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All versions of Corner module Drupal core is not affected. If you do not use the contributed Corner [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the Corner module you should uninstall it. Also see the Corner [5] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [6] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [7] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [12] [1] https://www.drupal.org/project/corner [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/corner [5] https://www.drupal.org/project/corner [6] https://www.drupal.org/user/2301194 [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/contact [9] https://www.drupal.org/security-team [10] https://www.drupal.org/writing-secure-code [11] https://www.drupal.org/security/secure-configuration [12] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-028 - Shibboleth Authentication - Cross Site Request Forgery (CSRF)
by security-news＠drupal.org 22 Jan '15

22 Jan '15

View online: https://www.drupal.org/node/2411737 * Advisory ID: DRUPAL-SA-CONTRIB-2015-028 * Project: Shibboleth authentication [1] (third-party module) * Version: 6.x, 7.x * Date: 2015-January-21 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- Shibboleth Authentication module allows users to log in and get permissions based on federated (SAML2) authentication. The roles that are assigned to users are based on a matching list. A malicious attacker can delete matching rules from the list by getting the administrator's browser to make a request to a specially-crafted URL while the administrator is logged in. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Shibboleth Authentication 6.x-4.x versions prior to 6.x-4.1. * Shibboleth Authentication 7.x-4.x versions prior to 7.x-4.1. Drupal core is not affected. If you do not use the contributed Shibboleth authentication [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Shibboleth Authentication module for Drupal 6.x, upgrade to 6.x-4.1 [5] * If you use the Shibboleth Authentication module for Drupal 7.x, upgrade to 7.x-4.1 [6] Also see the Shibboleth authentication [7] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [8] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Zoltán Kiss [9] and Kristof Bajnok [10] the module maintainers -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [11] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/shib_auth [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/shib_auth [5] https://www.drupal.org/node/2411269 [6] https://www.drupal.org/node/2411271 [7] https://www.drupal.org/project/shib_auth [8] https://www.drupal.org/user/2301194 [9] https://www.drupal.org/user/496918 [10] https://www.drupal.org/user/250470 [11] https://www.drupal.org/user/2301194 [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0