- Security-news - lists.drupal.org

SA-CONTRIB-2014-077 - TableField - Cross Site Scripting (XSS)
by security-news＠drupal.org 13 Aug '14

13 Aug '14

View online: https://www.drupal.org/node/2320613 * Advisory ID: DRUPAL-SA-CONTRIB-2014-077 * Project: TableField [1] (third-party module) * Version: 7.x * Date: 2014-August-13 * Security risk: 12/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:25 [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to create a field attached to a entity which stores tabular data. The module doesn't sufficiently sanitize the field help text when presented to a privileged user. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer content types" or "administer taxonomy". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * TableField 7.x-2.x versions prior to 7.x-2.3. * TableField versions for Drupal 6 are NOT affected. Drupal core is not affected. If you do not use the contributed TableField [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the TableField module for Drupal 7.x, upgrade to TableField 7.x-2.3 [5] Also see the TableField [6] project page. -------- REPORTED BY --------------------------------------------------------- * Matt V. [7] -------- FIXED BY ------------------------------------------------------------ * Kevin Hankens [8] the module maintainer * David Snopek [9] of the Drupal Security Team * Matt V. [10] -------- COORDINATED BY ------------------------------------------------------ * David Snopek [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] https://www.drupal.org/project/tablefield [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/tablefield [5] https://www.drupal.org/node/2320027 [6] https://www.drupal.org/project/tablefield [7] https://www.drupal.org/user/88338 [8] https://www.drupal.org/u/kevin-hankens [9] https://www.drupal.org/user/266527 [10] https://www.drupal.org/user/88338 [11] https://www.drupal.org/user/266527 [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2014-076 - Fasttoggle - Access bypass
by security-news＠drupal.org 06 Aug '14

06 Aug '14

View online: https://www.drupal.org/node/2316747 * Advisory ID: DRUPAL-SA-CONTRIB-2014-076 * Project: Fasttoggle [1] (third-party module) * Version: 7.x * Date: 2014-August-06 * Security risk: 11/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:None/E:Exploit/TD:25 [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to quickly toggle various user, node and field related settings via ajax links. The recent 7.x-1.3 and 1.4 releases of the module include a rewrite of the access control which doesn't correctly implement support for the user status (allow/block) link. This vulnerability is mitigated by the fact that the administrator must enable the link in the fasttoggle configuration and allow user profiles to be viewed by anonymous or logged in users. For user 1 to be affected, the administrator must also enable the fasttoggle setting that allows that account to be blocked via fasttoggle. All uses of the Fasttoggle module are logged, so any invocations of the exploit will be recorded. Accounts can only be blocked or unblocked via the exploit. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- Drupal core is not affected. If you do not use the contributed Fasttoggle [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Fasttoggle module for Drupal 7.x, upgrade to Fasttoggle 7.x-1.5 [5] Also see the Fasttoggle [6] project page. -------- REPORTED BY --------------------------------------------------------- * Laura Hild [7] -------- FIXED BY ------------------------------------------------------------ * Nigel Cunningham [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Neil Drumm [9] of the Drupal Security Team * David Stoline [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/fasttoggle [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/fasttoggle [5] https://www.drupal.org/node/2316065 [6] http://drupal.org/project/fasttoggle [7] https://www.drupal.org/user/760454 [8] https://www.drupal.org/user/250105 [9] https://www.drupal.org/user/3064 [10] https://www.drupal.org/u/dstol [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2014-075 - Biblio Autocomplete - SQL injection and Access Bypass
by security-news＠drupal.org 06 Aug '14

06 Aug '14

View online: https://www.drupal.org/node/2316717 * Advisory ID: DRUPAL-SA-CONTRIB-2014-075 * Project: Biblio Autocomplete [1] (third-party module) * Version: 6.x, 7.x * Date: 2014-08-06 * Security risk: 23/25 ( Highly Critical) AC:Basic/A:None/CI:All/II:All/E:Exploit/TD:100 [2] * Vulnerability: Access bypass, SQL Injection -------- DESCRIPTION --------------------------------------------------------- This module provides functionality for AJAX based auto-completion of fields in the Biblio node type (provided by the Biblio module) using previously entered values and third party services. The submodule "Biblio self autocomplete" for previously entered values doesn't sufficiently sanitize user input as it is used in a database query. Additionally, the AJAX autocompletion callback itself was not properly secured, thus potentially allowing any visitor access to the data, including the anonymous user. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- Drupal core is not affected. If you do not use the contributed Biblio Autocomplete [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Biblio Autocomplete module for Drupal 6.x, upgrade to Biblio Autocomplete 6.x-1.1 [5]. * If you use the Biblio Autocomplete module for Drupal 7.x, upgrade to Biblio Autocomplete 7.x-1.5 [6]. Additionally there is a new permission "access biblio autocomplete" for accessing the search. You need to give this permission to users with write permissions on Biblio nodes. Also see the Biblio Autocomplete [7] project page. -------- REPORTED BY --------------------------------------------------------- * Carsten Logemann [8] -------- FIXED BY ------------------------------------------------------------ * Carsten Logemann [9] * Damien McKenna [10] provisional member of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * David Stoline [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] https://www.drupal.org/project/biblio_autocomplete [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/biblio_autocomplete [5] https://www.drupal.org/node/2316023 [6] https://www.drupal.org/node/2316025 [7] https://www.drupal.org/project/biblio_autocomplete [8] https://drupal.org/user/218368 [9] https://drupal.org/user/218368 [10] https://www.drupal.org/u/damienmckenna [11] https://www.drupal.org/u/dstol [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CORE-2014-004 - Drupal core - Denial of service
by security-news＠drupal.org 06 Aug '14

06 Aug '14

View online: https://www.drupal.org/SA-CORE-2014-004 * Advisory ID: DRUPAL-SA-CORE-2014-004 * Project: Drupal core [1] * Version: 6.x, 7.x * Date: 2014-August-06 * Security risk: 13/25 ( Moderately Critical) AC:None/A:None/CI:None/II:None/E:Proof/TD:100 [2] * Exploitable from: Remote * Vulnerability: Denial of service -------- DESCRIPTION --------------------------------------------------------- Drupal 6 and Drupal 7 include an XML-RPC endpoint which is publicly available (xmlrpc.php). The PHP XML parser used by this XML-RPC endpoint is vulnerable to an XML entity expansion attack and other related XML payload attacks which can cause CPU and memory exhaustion and the site's database to reach the maximum number of open connections. Any of these may lead to the site becoming unavailable or unresponsive (denial of service). All Drupal sites are vulnerable to this attack whether XML-RPC is used or not. In addition, a similar vulnerability exists in the core OpenID module (for sites that have this module enabled). This is a joint release as the XML-RPC vulnerability also affects WordPress (see the announcement [3]). -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal core 7.x versions prior to 7.31. * Drupal core 6.x versions prior to 6.33. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Drupal 7.x, upgrade to Drupal core 7.31 [5]. * If you use Drupal 6.x, upgrade to Drupal core 6.33 [6]. If you are unable to install the latest version of Drupal immediately, you can alternatively remove the xmlrpc.php file from the root of Drupal core (or add a rule to .htaccess to prevent access to xmlrpc.php) and disable the OpenID module. These steps are sufficient to mitigate the vulnerability in Drupal core if your site does not require the use of XML-RPC or OpenID functionality. However, this mitigation will not be effective if you are using a contributed module that exposes Drupal's XML-RPC API at a different URL (for example, the Services module); updating Drupal core is therefore strongly recommended. Also see the Drupal core [7] project page. -------- REPORTED BY --------------------------------------------------------- * Willis Vandevanter [8] * Nir Goldshlager [9] -------- FIXED BY ------------------------------------------------------------ * Andrew Nacin [10] of the WordPress Security Team * Michael Adams [11] of the WordPress Security Team * Frédéric Marand [12] * David Rothstein [13] of the Drupal Security Team * Damien Tournoud [14] of the Drupal Security Team * Greg Knaddison [15] of the Drupal Security Team * Stéphane Corlosquet [16] of the Drupal Security Team * Dave Reid [17] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * The Drupal Security Team [18] and the WordPress [19] Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [20]. Learn more about the Drupal Security team and their policies [21], writing secure code for Drupal [22], and securing your site [23]. [1] http://drupal.org/project/drupal [2] http://drupal.org/security-team/risk-levels [3] https://wordpress.org/news/2014/08/wordpress-3-9-2/ [4] http://cve.mitre.org/ [5] http://drupal.org/drupal-7.31-release-notes [6] http://drupal.org/drupal-6.33-release-notes [7] http://drupal.org/project/drupal [8] https://www.drupal.org/user/1867894 [9] https://www.drupal.org/user/2891345 [10] http://profiles.wordpress.org/nacin [11] http://profiles.wordpress.org/mdawaffe [12] https://www.drupal.org/user/27985 [13] https://www.drupal.org/user/124982 [14] https://www.drupal.org/user/22211 [15] https://www.drupal.org/u/greggles [16] https://www.drupal.org/user/52142 [17] https://www.drupal.org/user/53892 [18] http://drupal.org/security-team [19] http://wordpress.org [20] http://drupal.org/contact [21] http://drupal.org/security-team [22] http://drupal.org/writing-secure-code [23] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2014-073- Date - Cross Site Scripting (XSS)
by security-news＠drupal.org 30 Jul '14

30 Jul '14

View online: https://www.drupal.org/node/2312609 * Advisory ID: DRUPAL-SA-CONTRIB-2014-073 * Project: Date [1] (third-party module) * Version: 7.x * Date: 2014-July-30 * Security risk: Moderately Critical [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Date module provides flexible date/time field type Date field and a Date API that other modules can use. The module incorrectly prints date field titles without proper sanitization thereby opening a Cross Site Scripting (XSS) vulnerability. The vulnerability is mitigated by the fact that an attacker must have a permission to create Date fields, such as "administer taxonomy" to add date fields on taxonomy terms. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- Drupal core is not affected. If you do not use the contributed Date [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the date module for Drupal 7.x, upgrade to Date 7.x-2.8 [5] Also see the Date [6] project page. -------- REPORTED BY --------------------------------------------------------- * Lucas D Hedding [7] -------- FIXED BY ------------------------------------------------------------ * Vijayachandran Mani [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/date [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/date [5] https://www.drupal.org/node/2311887 [6] http://drupal.org/project/date [7] https://www.drupal.org/user/1463982 [8] http://drupal.org/user/93488 [9] https://www.drupal.org/user/262198 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2014-074 - Storage API - Code execution prevention
by security-news＠drupal.org 30 Jul '14

30 Jul '14

View online: https://www.drupal.org/node/2312769 * Advisory ID: DRUPAL-SA-CONTRIB-2014-074 * Project: (third-party module) * Version: 7.x * Date: 2014-July-30 * Security risk: (Less Critical) [1] * Vulnerability: Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- Storage API is a low-level framework for managed file storage and serving. The module creates an .htaccess file in the files directory to prevent code execution, but copied the Drupal core file and wasn't updated to include the improved file contents after SA-CORE-2013-003 [2]. This vulnerability is mitigated by the fact that it only relates to a defense in depth mechanism, and sites would only be vulnerable if they are hosted on a server which contains code that does not use protections similar to those found in Drupal's file API to manage uploads in a safe manner. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Storage API module for Drupal 7.x, upgrade to Storage API 7.x-1.6 [4] Also see the project page. -------- REPORTED BY --------------------------------------------------------- Reported publicly outside the Drupal Security Team reporting process [5]. -------- FIXED BY ------------------------------------------------------------ * Jonathan Brown [6] and Brady Owens [7] the module maintainers -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/security-team/risk-levels [2] https://www.drupal.org/SA-CORE-2013-003 [3] http://cve.mitre.org/ [4] https://www.drupal.org/node/2312655 [5] https://www.drupal.org/node/101494 [6] http://drupal.org/user/46104 [7] https://www.drupal.org/user/1547200 [8] https://www.drupal.org/user/262198 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2014-072 - Freelinking, Freelinking Case Tracker - Access bypass
by security-news＠drupal.org 23 Jul '14

23 Jul '14

View online: https://www.drupal.org/node/2308503 * Advisory ID: DRUPAL-SA-CONTRIB-2014-072 * Project: freelinking [1] (third-party module) * Project: freelinking case tracker [2] (third-party module) * Version: 6.x, 7.x * Date: 2014-July-23 * Security risk: Critical [3] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The freelinking and freelinking case tracker modules implement a filter for the easier creation of HTML links to other pages in the site or external sites with a wiki style format such as [[pluginname:identifier]]. The module doesn't sufficiently check access to content when displaying links to nodes and users. This makes it possible to see node titles, usernames and potentially other data depending on the site configuration. This vulnerability is mitigated by the fact that a site must use node access or permissions to prevent some users from viewing some nodes or users. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- All versions of Freelinking and Freelinking for case tracker Drupal core is not affected. If you do not use the contributed freelinking [5] or freelinking Case tracker [6] modules, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the module, it is no longer maintained. Also see the freelinking [7] and freelinking case tracker [8] project pages. -------- REPORTED BY --------------------------------------------------------- * Chris Burgess [9] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] http://drupal.org/project/freelinking [2] https://www.drupal.org/project/freelinking_casetracker [3] http://drupal.org/security-team/risk-levels [4] http://cve.mitre.org/ [5] http://drupal.org/project/freelinking [6] http://drupal.org/project/freelinking_casetracker [7] http://drupal.org/project/freelinking [8] https://www.drupal.org/project/freelinking_casetracker [9] http://drupal.org/user/76026 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-071 - FileField - Access bypass
by security-news＠drupal.org 16 Jul '14

16 Jul '14

View online: https://www.drupal.org/node/2304561 * Advisory ID: DRUPAL-SA-CONTRIB-2014-071 * Project: FileField [1] (third-party module) * Version: 6.x * Date: 2014-July-16 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The FileField module enables you to define and use fields that contain files. The module doesn't sufficiently check permission to view the attached file when attaching a file that was previously uploaded. This could allow attackers to gain access to private files. This vulnerability is mitigated by the fact that the attacker must have permission to create or edit content with a file field. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * FileField 6.x-3.x versions prior to 6.x-3.13. Drupal core is not affected. If you do not use the contributed FileField [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ * If you use the FileField module for Drupal 6.x, upgrade to Filefield 6.x-3.13 [5], and also update to Drupal core 6.32 [6] (see SA-CORE-2014-003 [7]). -------- REPORTED BY --------------------------------------------------------- * Ivan Ch [8] -------- FIXED BY ------------------------------------------------------------ * Nate Haug [9] * Ivan Ch [10] * David Snopek [11] of the Drupal Security Team. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/filefield [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/filefield [5] https://www.drupal.org/node/2304517 [6] https://www.drupal.org/drupal-6.32-release-notes [7] https://www.drupal.org/SA-CORE-2014-003 [8] https://www.drupal.org/user/556138 [9] https://www.drupal.org/user/35821 [10] https://www.drupal.org/user/556138 [11] https://www.drupal.org/user/266527 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

SA-CORE-2014-003 - Drupal core - Multiple vulnerabilities
by security-news＠drupal.org 16 Jul '14

16 Jul '14

View online: https://www.drupal.org/SA-CORE-2014-003 * Advisory ID: DRUPAL-SA-CORE-2014-003 * Project: Drupal core [1] * Version: 6.x, 7.x * Date: 2014-July-16 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7. .... Denial of service with malicious HTTP Host header (Base system - Drupal 6 and 7 - Critical) Drupal core's multisite feature dynamically determines which configuration file to use based on the HTTP Host header. The HTTP Host header validation does not sufficiently check maliciously-crafted header values, thereby exposing a denial of service vulnerability. .... Access bypass (File module - Drupal 7 - Critical) The File module included in Drupal 7 core allows attaching files to pieces of content. The module doesn't sufficiently check permission to view the attached file when attaching a file that was previously uploaded. This could allow attackers to gain access to private files. This vulnerability is mitigated by the fact that the attacker must have permission to create or edit content with a file field. Note: The Drupal 6 FileField [3] module is affected by a similar issue (see SA-CONTRIB-2014-071 - FileField - Access bypass [4]) and requires an update to the current security release of Drupal 6 core in order for the fix released there to work correctly. However, Drupal 6 core itself is not directly affected. .... Cross-site scripting (Form API option groups - Drupal 6 and 7 - Moderately critical) A cross-site scripting vulnerability was found due to Drupal's form API failing to sanitize option group labels in select elements. This vulnerability affects Drupal 6 core directly, and likely affects Drupal 7 forms provided by contributed or custom modules. This vulnerability is mitigated by the fact that it requires the "administer taxonomy" permission to exploit in Drupal 6 core, and there is no known exploit within Drupal 7 core itself. .... Cross-site scripting (Ajax system - Drupal 7 - Moderately critical) A reflected cross-site scripting vulnerability was found in certain forms containing a combination of an Ajax-enabled textfield (for example, an autocomplete field) and a file field. This vulnerability is mitigated by the fact that an attacker can only trigger the attack in a limited set of circumstances, usually requiring custom or contributed modules. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [5] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal core 6.x versions prior to 6.32. * Drupal core 7.x versions prior to 7.29. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Drupal 6.x, upgrade to Drupal core 6.32. [6] * If you use Drupal 7.x, upgrade to Drupal core 7.29. [7] Also see the Drupal core [8] project page. -------- REPORTED BY --------------------------------------------------------- * The denial of service vulnerability using malicious HTTP Host headers was reported by Régis Leroy [9]. * The access bypass vulnerability in the File module was reported by Ivan Ch [10]. * The cross-site scripting vulnerability with Form API option groups was reported by Károly Négyesi [11]. * The cross-site scripting vulnerability in the Ajax system was reported by mani22test [12]. -------- FIXED BY ------------------------------------------------------------ * The denial of service vulnerability using malicious HTTP Host headers was fixed by Régis Leroy [13], and by Klaus Purer [14] of the Drupal Security Team. * The access bypass vulnerability in the File module was fixed by Nate Haug [15] and Ivan Ch [16], and by Drupal Security Team members David Rothstein [17], Heine Deelstra [18] and David Snopek [19]. * The cross-site scripting vulnerability with Form API option groups was fixed by Greg Knaddison [20] of the Drupal Security Team. * The cross-site scripting vulnerability in the Ajax system was fixed by Neil Drumm [21] of the Drupal Security Team. -------- COORDINATED BY ------------------------------------------------------ * The Drupal Security Team [22] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [23]. Learn more about the Drupal Security team and their policies [24], writing secure code for Drupal [25], and securing your site [26]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [27] [1] http://drupal.org/project/drupal [2] http://drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/filefield [4] https://www.drupal.org/node/2304561 [5] http://cve.mitre.org/ [6] https://www.drupal.org/drupal-6.32-release-notes [7] https://www.drupal.org/drupal-7.29-release-notes [8] http://drupal.org/project/drupal [9] https://www.drupal.org/user/1367862 [10] https://www.drupal.org/user/556138 [11] https://www.drupal.org/u/chx [12] https://www.drupal.org/user/2844779 [13] https://www.drupal.org/user/1367862 [14] https://www.drupal.org/user/262198 [15] https://www.drupal.org/user/35821 [16] https://www.drupal.org/user/556138 [17] https://www.drupal.org/user/124982 [18] https://www.drupal.org/user/17943 [19] https://www.drupal.org/user/266527 [20] https://www.drupal.org/u/greggles [21] https://www.drupal.org/u/drumm [22] http://drupal.org/security-team [23] http://drupal.org/contact [24] http://drupal.org/security-team [25] http://drupal.org/writing-secure-code [26] http://drupal.org/security/secure-configuration [27] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-070 - Password Policy - Access Bypass
by security-news＠drupal.org 16 Jul '14

16 Jul '14

View online: https://www.drupal.org/node/2304213 * Advisory ID: DRUPAL-SA-CONTRIB-2014-070 * Project: Password Policy [1] (third-party module) * Version: 6.x, 7.x * Date: 2014-July-16 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Password Policy module enables you to define and enforce password policies with various constraints on allowable user passwords. .... Access Bypass (7.x only) Password Policy has a Password Change Tab submodule which provides a tab for a user to change their password. Password Policy also has a history constraint which disallows a user from changing their password to one of a specified number of their previous passwords. When the Password Change Tab module and the history constraint are both enabled, password history will not be stored for a user who changes their password using the password tab. This will allow the user to change their password to one of their previous passwords in violation of the history constraint. This vulnerability is mitigated by the fact that it only exists when both the Password Change Tab module and the history constraint are enabled. .... Access Bypass (6.x and 7.x) Password Policy has a feature that allows an administrator to force one or more users to change their password at their next login. Under certain circumstances, the users may not actually be forced to change their passwords. Specifically, if between the time the administrator flags a user for a forced password change and the time that user logs in, an update operation is programmatically performed on the user, the user will be no longer be flagged for a forced password change. For instance, executing the Drush command drush user-add-role to add a role to a user who is flagged for a password change would cause that user to no longer be forced to change their password. This vulnerability is mitigated by the fact that it only affects users for whom an administrator has forced a password change. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Password Policy 6.x-1.x versions prior to 6.x-1.8. * Password Policy 7.x-1.x versions prior to 7.x-1.9. Drupal core is not affected. If you do not use the contributed Password Policy [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ 1) Install the latest version: * If you use the Password Policy module for Drupal 6.x, upgrade to Password Policy 6.x-1.8 [5] * If you use the Password Policy module for Drupal 7.x, upgrade to Password Policy 7.x-1.9 [6] 2) Force users who may have been affected by the force password change vulnerability to change their passwords. Also see the Password Policy [7] project page. -------- REPORTED BY --------------------------------------------------------- * AohRveTPV [8] -------- FIXED BY ------------------------------------------------------------ * AohRveTPV [9] the module maintainer * Fabio Epifani [10] -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/password_policy [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/password_policy [5] https://www.drupal.org/node/2303857 [6] https://www.drupal.org/node/2303845 [7] https://www.drupal.org/project/password_policy [8] http://drupal.org/user/2760115 [9] http://drupal.org/user/2760115 [10] http://drupal.org/user/2840771 [11] https://www.drupal.org/u/mlhess [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0