- Security-news - lists.drupal.org

SA-CONTRIB-2014-069 - Logintoboggan - Access Bypass and Cross Site Scripting (XSS)
by security-news＠drupal.org 09 Jul '14

09 Jul '14

View online: https://www.drupal.org/node/2300369 * Advisory ID: DRUPAL-SA-CONTRIB-2014-069 * Project: LoginToboggan [1] (third-party module) * Version: 7.x * Date: 2014-July-09 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to customise the standard Drupal registration and login processes. -------- CROSS SITE SCRIPTING ------------------------------------------------ The module doesn't filter user-supplied information from the URL resulting in a reflected Cross Site Scripting (XSS) vulnerability. -------- ACCESS BYPASS ------------------------------------------------------- The module introduces a concept of a "pre-authorized role" which can have different permissions than the normal Drupal core authorized role. Logintoboggan usually removes permissions for a user if those permissions are in the "authorized user" role and not in the "pre-authorized role". The module failed to remove those permissions for users in a pre-authorized state on all "Page Not Found" (i.e. 404) pages. This vulnerability is mitigated by the fact that a site must use the "pre-authorized role" feature and an attacker would only gain permissions available to authenticated users and would only gain them on 404 pages which do not show private information in a default Drupal installation. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Logintoboggan 7.x-1.x versions prior to 7.x-1.4 Drupal core is not affected. If you do not use the contributed LoginToboggan [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Logintoboggan module for Drupal 7.x, upgrade to Logintoboggan 7.x-1.4 [5] Also see the LoginToboggan [6] project page. -------- REPORTED BY --------------------------------------------------------- * Mark Mahon [7] * Joel Walters [8] -------- FIXED BY ------------------------------------------------------------ * Steve Cowie [9] the module maintainer * Dan Smith [10] of the Drupal Security Team * Joel Walters [11] * Mark Davies [12] -------- COORDINATED BY ------------------------------------------------------ * Dan Smith [13] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [18] [1] http://drupal.org/project/logintoboggan [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/logintoboggan [5] https://www.drupal.org/node/2299467 [6] http://drupal.org/project/logintoboggan [7] https://www.drupal.org/user/1899214 [8] https://www.drupal.org/user/1052318 [9] https://www.drupal.org/user/110518 [10] https://www.drupal.org/user/241220 [11] https://www.drupal.org/user/1052318 [12] https://www.drupal.org/user/243300 [13] http://drupal.org/user/241220 [14] http://drupal.org/contact [15] http://drupal.org/security-team [16] http://drupal.org/writing-secure-code [17] http://drupal.org/security/secure-configuration [18] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-068 - Pane - XSS
by security-news＠drupal.org 02 Jul '14

02 Jul '14

View online: https://www.drupal.org/node/2296783 * Advisory ID: DRUPAL-SA-CONTRIB-2014-068 * Project: Pane [1] (third-party module) * Version: 7.x * Date: 2014-July-02 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module did not properly sanitize content entered for title. It allowed sufficiently privileged users to add arbitrary HTML which could result in XSS attacks.< /p> This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks" or ability to edit Panel panes. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Pane 7.x-2.x versions prior to 7.x-2.5. Drupal core is not affected. If you do not use the contributed Pane [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Pane module for Drupal 7.x, upgrade to Pane 7.x-2.5 [5] Also see the Pane [6] project page. -------- REPORTED BY --------------------------------------------------------- * Lucas Hedding [7] -------- FIXED BY ------------------------------------------------------------ * Lucas Hedding [8] -------- COORDINATED BY ------------------------------------------------------ * Rick Manelius [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] http://drupal.org/project/pane [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/pane [5] https://www.drupal.org/node/2296651 [6] http://drupal.org/project/pane [7] https://www.drupal.org/u/heddn [8] https://www.drupal.org/u/heddn [9] https://www.drupal.org/user/680072 [10] https://www.drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-067 - Meta Tags Quick - Multiple vulnerabilities
by security-news＠drupal.org 02 Jul '14

02 Jul '14

View online: https://www.drupal.org/node/2296511 * Advisory ID: DRUPAL-SA-CONTRIB-2014-067 * Project: Meta tags quick [1] (third-party module) * Version: 7.x * Date: 2014-July-02 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Open Redirect -------- DESCRIPTION --------------------------------------------------------- Meta tags quick adds meta tags editing to all non-administrative pages of Drupal site. .... Redirector abuse in path-based meta tag editing form When editing a path-based meta tag, module does not check destination parameter of the URL, allowing attacker to pass arbitrary URL to meta tag editing form. .... XSS in path-based meta tag editing form It is possible to inject arbitrary Javascript via the module's Path-based Metatags edit form that executes when a user attempts to delete a Path-based Metatag. Both vulnerabilities are mitigated by the fact that an attacker must have a role with the permission "Edit path based meta tags". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Meta tags quick 7.x-2.x versions from and including 7.x-2.1 to 7.x-2.7 (7.x-1.x and 7.x-2.0 are not affected) Drupal core is not affected. If you do not use the contributed Meta tags quick [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the Meta tags quick 7.x-2.x for Drupal 7, upgrade to Meta tags quick 7.x-2.8 [5] Also see the Meta tags quick [6] project page. -------- REPORTED BY --------------------------------------------------------- * Ubani Balogun [7] -------- FIXED BY ------------------------------------------------------------ * Valery Lourie [8] the module maintainer * Ubani Balogun [9] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] http://drupal.org/project/metatags_quick [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/metatags_quick [5] https://www.drupal.org/node/2295975 [6] http://drupal.org/project/metatags_quick [7] https://www.drupal.org/user/2858707 [8] https://www.drupal.org/u/valthebald [9] https://www.drupal.org/user/2858707 [10] https://www.drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-066 - Node Access Keys - Access Bypass
by security-news＠drupal.org 02 Jul '14

02 Jul '14

View online: https://www.drupal.org/node/2296495 * Advisory ID: DRUPAL-SA-CONTRIB-2014-066 * Project: Node Access Keys [1] (third-party module) * Version: 7.x * Date: 2014-July-02 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Node Access Keys helps to grant users temporary view permissions to selected content types on a per user role basis. It was found that unpublished nodes of content types that that did not have an access key were visible to all. Also, If an unpublished node of a content type that was protected by an access key was visited with the access key then access was granted. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Node Access Keys 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed Node Access Keys [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Node Access Keys module for Drupal 7.x, upgrade to Node Access Keys 7.x-1.2 [5] Also see the Node Access Keys [6] project page. -------- REPORTED BY --------------------------------------------------------- * This issue was disclosed publicly. -------- FIXED BY ------------------------------------------------------------ * Daniel Korte [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team * David Rothstein [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] http://drupal.org/project/nodeaccesskeys [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/nodeaccesskeys [5] http://drupal.org/node/2295895 [6] http://drupal.org/project/nodeaccesskeys [7] http://drupal.org/user/453668 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/124982 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-062 -Passsword Policy - Multiple vulnerabilities
by security-news＠drupal.org 18 Jun '14

18 Jun '14

View online: https://drupal.org/node/2288341 * Advisory ID: DRUPAL-SA-CONTRIB-2014-062 * Project: Password policy [1] (third-party module) * Version: 6.x, 7.x * Date: 2014-June-18 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- The Password Policy module enables you to define and enforce password policies with various constraints on allowable user passwords. .... Access bypass and information disclosure (7.x only) The module has a history constraint, which when enabled, disallows a user's password from being changed to match a specified number of their previous passwords. For this to work, the module stores a history of all previous user password hashes from the time the module is enabled (regardless of whether the history constraint is enabled). Upon upgrading from 6.x to 7.x, the module does not convert these hashes from the Drupal 6 format to the Drupal 7 format. This has two consequences: 1. Users can change their passwords to old passwords used in Drupal 6 in violation of the history constraint. 2. Previous user passwords from Drupal 6 are kept indefinitely in Drupal 7 as weak MD5 hashes. If a site is compromised, past user passwords are at high risk of exposure. This vulnerability is mitigated by the fact that only sites using 7.x that have previously used 6.x are affected. .... Access bypass (6.x) The module has a feature that lets an administrator force a password change for one or more users at their next login. These users are unable to access the website beyond their account page until changing their password. A bug exists in 6.x where a password change will not be enforced when a user_save() is performed between the time when the administrator forces the password change and the time the affected user logs in. This can lead to users retaining insecure passwords. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Password Policy 6.x-1.x versions prior to 6.x-1.7. * Password Policy 7.x-1.x versions prior to 7.x-1.7. * Password Policy 7.x-2.x versions prior to 7.x-2.0-alpha2. Drupal core is not affected. If you do not use the contributed Password policy [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Warning: If you are using 7.x, and have used 6.x in the past on the same site, you are advised to back up your database prior to upgrading to the latest version to reduce the risk of an unforeseen upgrade problem causing permanent loss of password history. Install the latest version: * If you use the Password Policy module for Drupal 6.x, upgrade to 6.x-1.7 [5] * If you use the Password Policy 1.x module for Drupal 7.x, upgrade to 7.x-1.7 [6] * If you use the Password Policy 2.x module for Drupal 7.x, upgrade to 7.x-2.0-alpha2 [7] Also see the Password policy [8] project page. -------- REPORTED BY --------------------------------------------------------- * Ryan Courtnage [9] * AohRveTPV [10] the module maintainer -------- FIXED BY ------------------------------------------------------------ * Ryan Courtnage [11] * AohRveTPV [12] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [13] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [18] [1] http://drupal.org/project/password_policy [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/password_policy [5] https://drupal.org/node/2287973 [6] https://drupal.org/node/2287985 [7] https://drupal.org/node/2287991 [8] http://drupal.org/project/password_policy [9] http://drupal.org/u/ryan_courtnage [10] http://drupal.org/u/aohrvetpv [11] http://drupal.org/u/ryan_courtnage [12] http://drupal.org/u/aohrvetpv [13] https://drupal.org/u/greggles [14] http://drupal.org/contact [15] http://drupal.org/security-team [16] http://drupal.org/writing-secure-code [17] http://drupal.org/security/secure-configuration [18] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-065 - Custom Meta - Cross Site Scripting (XSS)
by security-news＠drupal.org 18 Jun '14

18 Jun '14

View online: https://drupal.org/node/2288429 * Advisory ID: DRUPAL-SA-CONTRIB-2014-065 * Project: Custom Meta [1] (third-party module) * Version: 6.x, 7.x * Date: 2014-June-18 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The module allows you to define and manage custom meta tags. The module does not sufficiently sanitize user input before displaying the attribute and content values for meta tags on the administration page. This vulnerability is mitigated by the fact that an attacker must have access to an account with the permission "administer custom meta settings". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Custom Meta 6.x-1.x versions prior to 6.x-1.2. * Custom Meta 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Custom Meta [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Custom Meta for Drupal 6.x, upgrade to Custom Meta 6.x-1.2 [5] * If you use Custom Meta for Drupal 7.x, upgrade to Custom Meta 7.x-1.3 [6] Also see the Custom Meta [7] project page. -------- REPORTED BY --------------------------------------------------------- * Ubani Balogun [8] -------- FIXED BY ------------------------------------------------------------ * Louis Jimenez [9] the module co-maintainer * Ubani Balogun [10] -------- COORDINATED BY ------------------------------------------------------ * Rick Manelius [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] http://drupal.org/project/custom_meta [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/custom_meta [5] https://drupal.org/node/2288417 [6] https://drupal.org/node/2288415 [7] http://drupal.org/project/custom_meta [8] http://drupal.org/user/2858707 [9] http://drupal.org/user/2468112 [10] http://drupal.org/user/2858707 [11] https://drupal.org/user/680072 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-064 -Course - Access bypass
by security-news＠drupal.org 18 Jun '14

18 Jun '14

View online: https://drupal.org/node/2288403 * Advisory ID: DRUPAL-SA-CONTRIB-2014-064 * Project: Course [1] (third-party module) * Version: 6.x, 7.x * Date: 2014-June-18 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to create e-learning courses with any number of requirements for completion. A "Course object" is a relationship entity between a Course and a learning object, such as a Node. The module doesn't sufficiently check access on Course object edit forms. The configuration options of any Course object are visible to any user including the anonymous user. This vulnerability is mitigated by the fact that while the form and its configuration options can be viewed, no changes can be saved. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Course 6.x-1.x versions prior to 6.x-1.1. * Course 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Course [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Course module for Drupal 6.x, upgrade to Course 6.x-1.1 [5] * If you use the Course module for Drupal 7.x, upgrade to Course 7.x-1.2 [6] Also see the Course [7] project page. -------- REPORTED BY --------------------------------------------------------- * Devin Zuczek [8] (module maintainer) -------- FIXED BY ------------------------------------------------------------ * Devin Zuczek [9] (module maintainer) -------- COORDINATED BY ------------------------------------------------------ * Rick Manelius [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] http://drupal.org/project/course [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/course [5] https://drupal.org/node/2288397 [6] https://drupal.org/node/2288399 [7] http://drupal.org/project/course [8] https://drupal.org/user/701754 [9] https://drupal.org/user/701754 [10] https://drupal.org/user/680072 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-063 - Easy Breadcrumb - Cross Site Scripting (XSS)
by security-news＠drupal.org 18 Jun '14

18 Jun '14

View online: https://drupal.org/node/2288353 * Advisory ID: DRUPAL-SA-CONTRIB-2014-063 * Project: Easy Breadcrumb [1] (third-party module) * Version: 7.x * Date: 2014-June-18 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Easy Breadcrumb module generates breadcrumbs from path aliases. This module does not properly sanitize user-supplied values creating a Cross Site Scripting (XSS) vulnerability. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Easy breadcrumbs 7.x-2.x versions prior to 7.x-2.10. Drupal core is not affected. If you do not use the contributed Easy Breadcrumb [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the Easy Breadcrumb module for Drupal 7 upgrade to 7.x-2.10 [5]. Also see the Easy Breadcrumb [6] project page. -------- REPORTED BY --------------------------------------------------------- * Rob Dogg [7] * Stefan Ruijsenaars [8] -------- FIXED BY ------------------------------------------------------------ * Stefan Ruijsenaars [9] * Roger Padilla [10] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] http://drupal.org/project/easy_breadcrumb [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/easy_breadcrumb [5] https://drupal.org/node/2286121 [6] http://drupal.org/project/easy_breadcrumb [7] https://drupal.org/user/627900 [8] http://drupal.org/user/77878 [9] http://drupal.org/user/77878 [10] https://drupal.org/user/1667988 [11] https://drupal.org/u/greggles [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-061 - VideoWhisper Webcam Plugins - Cross Site Scripting (XSS) - Unsupported
by security-news＠drupal.org 18 Jun '14

18 Jun '14

View online: https://drupal.org/node/2288333 * Advisory ID: DRUPAL-SA-CONTRIB-2014-061 * Project: VideoWhisper Webcam Plugins [1] (third-party module) * Version: 7.x * Date: 2014-June-18 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Includes multiple modules for video communications including room listing, pay per view access control. The module doesn't sufficiently filter user supplied text from the url (reflected cross site scripting). No special permissions are required to exploit this issue. There are no mitigating factors for this vulnerability. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All versions of VideoWhisper Webcam Plugins. Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the VideoWhisper Webcam Plugins module you should uninstall it. Also see the VideoWhisper Webcam Plugins [4] project page. -------- REPORTED BY --------------------------------------------------------- This issue was publicly disclosed as CVE-2014-2715 outside of the process to report security issues in Drupal. [5] Issues reported via the Drupal Security Team process normally include the original reporter. -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [6] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [11] [1] https://drupal.org/project/videowhisper [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://drupal.org/project/videowhisper [5] https://drupal.org/security-team/report-issue [6] https://drupal.org/u/greggles [7] http://drupal.org/contact [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration [11] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-060- Petitions - Cross Site Request Forgery (CSRF)
by security-news＠lists.drupal.org 11 Jun '14

11 Jun '14

View online: https://drupal.org/node/2284571 * Advisory ID: DRUPAL-SA-CONTRIB-2014-060 * Project: - Petitions - [1] (third-party distribution) * Version: 7.x * Date: 2014-June-11 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- This distribution enables you to build an application that lets users create and sign petitions. The contained wh_petitions module doesn't sufficiently verify the intent of the user when signing a petition. A malicious user could trick another user into signing a petition they did not intend to sign by getting them to visit a specially-crafted URL while logged in. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * petitions 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed - Petitions - [4] distribution, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the petitions distribution for Drupal 7.x, upgrade to petitions 7.x-1.2 [5] or petitions 7.x-2.0-beta19 [6] Note that petitions 7.x-1.2 [7] is the last release for the first version of petitions. petitions 7.x-1.x is no longer maintained, and you are strongly encouraged to upgrade to the latest version petitions 7.x-2.0-beta19 [8]. Also see the - Petitions - [9] project page. -------- REPORTED BY --------------------------------------------------------- * Greg Knaddison [10] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Steve Wirt [11] -------- COORDINATED BY ------------------------------------------------------ * Stéphane Corlosquet [12] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [17] [1] http://drupal.org/project/petitions [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/petitions [5] https://drupal.org/node/2284505 [6] https://drupal.org/node/1995992 [7] https://drupal.org/node/2284505 [8] https://drupal.org/node/1995992 [9] http://drupal.org/project/petitions [10] https://drupal.org/u/greggles [11] https://drupal.org/user/138230 [12] https://drupal.org/u/scor [13] http://drupal.org/contact [14] http://drupal.org/security-team [15] http://drupal.org/writing-secure-code [16] http://drupal.org/security/secure-configuration [17] https://twitter.com/drupalsecurity

1 0