- Security-news - lists.drupal.org

SA-CONTRIB-2014-011 - Push Notifications - Information Disclosure
by security-news＠drupal.org 05 Feb '14

05 Feb '14

View online: https://drupal.org/node/2189643 * Advisory ID: DRUPAL-SA-CONTRIB-2014-011 * Project: Push Notifications [1] (third-party module) * Version: 7.x * Date: 2014-February-05 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- This module enables the delivery of push notifications to iOS and Android devices. The module doesn't sufficiently randomize the certificate filenames required for Apple's Push Notification service or protect the files from being publicly accessible, which could allow an attacker to acquire the certificates and broadcast push notifications to the target's user base. This vulnerability primarily affects sites that did not follow the general security best practice of placing certificates into a directory outside of the webroot and did not use password-protected certificate files. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * push_notifications 7.x-1.x versions prior to 7.x-1.1 Drupal core is not affected. If you do not use the contributed Push Notifications [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the push_notifications module for Drupal 7.x and your APNS certificate files are stored in the default directory, upgrade to push_notifications 7.x-1.1 [5] * Navigate to the configuration page for the push_notifications module (admin/config/services/push_notifications/configure) and click the "Generate new certificate string" button to generate a random filename. Then, rename your APNS certificates according to the instructions on the push notification configuration page. Also see the Push Notifications [6] project page. -------- REPORTED BY --------------------------------------------------------- * Graham Bates [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Daniel Hanold [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Laurence Liss [9] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] http://drupal.org/project/push_notifications [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/push_notifications [5] http://drupal.org/node/2188983 [6] http://drupal.org/project/push_notifications [7] http://drupal.org/user/16029 [8] http://drupal.org/user/339733 [9] http://drupal.org/user/724750 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-010 Services - Access Bypass and Privilege Escalation
by security-news＠drupal.org 05 Feb '14

05 Feb '14

View online: https://drupal.org/node/2189509 * Advisory ID: DRUPAL-SA-CONTRIB-2014-010 * Project: Services [1] (third-party module) * Version: 7.x * Date: 2014-February-05 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Services module enables you to expose an API to third party systems using REST, XML-RPC or other protocols. .... User update access bypass vulnerability An authenticated user is able to assign additional roles to themselves, which means they can escalate their privileges by assigning an administrative role. This vulnerability is mitigated by the fact that the user must be able to log in on the site, the update operation on the user resource configuration must be enabled, and a site must have an role with more permissions than the authenticated user. .... Comment access bypass vulnerability As an authenticated user an attacker with the permission to post comments is able to update other users' comments. This vulnerability is mitigated by the fact that the update operation on the comment resource configuration must be enabled. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Services 7.x-3.x versions prior to 7.x-3.6. Drupal core is not affected. If you do not use the contributed Services [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Services module for Drupal 7.x, upgrade to Services 7.x-3.7 [5] Also see the Services [6] project page. -------- REPORTED BY --------------------------------------------------------- * The User update access bypass vulnerability was reported by Fredrik Lassen [7]. * The Comment access bypass vulnerability was reported by wedge [8]. -------- FIXED BY ------------------------------------------------------------ * The User update access bypass vulnerability was fixed by Fredrik Lassen [9]. * The Comment access bypass vulnerability was fixed by Kyle Browning [10], the module maintainer. -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [11] of the Drupal Security Team * Balazs Dianiska [12] a provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [17] [1] http://drupal.org/project/services [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/services [5] https://drupal.org/node/2186581 [6] http://drupal.org/project/services [7] https://drupal.org/user/243377 [8] https://drupal.org/user/11442 [9] https://drupal.org/user/243377 [10] https://drupal.org/user/211387 [11] http://drupal.org/user/262198 [12] http://drupal.org/user/58645 [13] http://drupal.org/contact [14] http://drupal.org/security-team [15] http://drupal.org/writing-secure-code [16] http://drupal.org/security/secure-configuration [17] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-009 - Tagadelic - Information Disclosure
by security-news＠drupal.org 05 Feb '14

05 Feb '14

View online: https://drupal.org/node/2187453 * Advisory ID: DRUPAL-SA-CONTRIB-2014-009 * Project: Tagadelic [1] (third-party module) * Version: 6.x * Date: 2014-February-05 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- This module provides an API and a few simple turnkey modules, which allows you to easily create tagclouds, weighted lists, search-clouds and such. The 6.x-1.x version does not account for node access modules, thus leading to information being disclosed. This vulnerability is mitigated by the fact that a site must be using a node access module. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Tagadelic 6.x-1.x versions. Drupal core is not affected. If you do not use the contributed Tagadelic [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the Tagadelic module for Drupal 6.x, upgrade to Tagadelic 6.x-1.5 [5] and then disable node access modules, such as taxonomy_access and content_access. Also see the Tagadelic [6] project page. -------- REPORTED BY --------------------------------------------------------- * Michael Hess [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Rick Manelius [8] * Sean T. Walsh [9] -------- COORDINATED BY ------------------------------------------------------ * Rick Manelius [10] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] http://drupal.org/project/tagadelic [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/tagadelic [5] https://drupal.org/node/2188887 [6] http://drupal.org/project/tagadelic [7] http://drupal.org/user/102818 [8] https://drupal.org/user/680072 [9] http://drupal.org/user/995722 [10] http://drupal.org/user/680072 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-008 - Tribune - Cross Site Scripting (XSS)
by security-news＠drupal.org 29 Jan '14

29 Jan '14

View online: https://drupal.org/node/2184845 * Advisory ID: DRUPAL-SA-CONTRIB-2014-008 * Project: Tribune [1] (third-party module) * Version: 6.x, 7.x * Date: 2014-January-29 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- A tribune is a type of chatroom. The module doesn't sufficiently filter user provided text from Tribune node titles. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create a Tribune node. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Tribune 6.x-1.x versions. * Tribune 7.x-3.x versions. Drupal core is not affected. If you do not use the contributed Tribune [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Remove the module or otherwise mitigate the issue. Also see the Tribune [5] project page. -------- REPORTED BY --------------------------------------------------------- * Raynald Mirville [6] -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Laurence Liss [7] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [12] [1] http://drupal.org/project/tribune [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/tribune [5] http://drupal.org/project/tribune [6] http://drupal.org/user/2737379 [7] http://drupal.org/user/724750 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration [12] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-007 - Services - Multiple access bypass vulnerabilities
by security-news＠drupal.org 29 Jan '14

29 Jan '14

View online: https://drupal.org/node/2184843 * Advisory ID: DRUPAL-SA-CONTRIB-2014-007 * Project: Services [1] (third-party module) * Version: 7.x * Date: 2014-January-29 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Multiple access bypass vulnerabilities -------- DESCRIPTION --------------------------------------------------------- This module enables you to expose an API to third party systems using REST, XML-RPC or other protocols. The form API provides a method for developers to submit forms programmatically using the function drupal_form_submit(). During programmatic form submissions, all access checks are deliberately bypassed, and any form element may be submitted regardless of the current user's access level. To facilitate this, a new, optional $form_state['programmed_bypass_access_check'] element has been added to the Drupal 7 form API. If this is provided and set to FALSE, drupal_form_submit() will perform the normal form access checks against the current user while submitting the form, rather than bypassing them. Services relies heavily on programmatic form submission and therefore needs to use this new $form_state['programmed_bypass_access_check'] so that access control parameters and hooks are performed for untrusted users. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Services 7.x-3.x versions prior to 7.x-3.5. Drupal core is not affected. If you do not use the contributed Services [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Services module for Drupal 7.x, upgrade to Services 7.x-3.6 [5] Also see the Services [6] project page. -------- REPORTED BY --------------------------------------------------------- * wedge [7] * prjcarr [8] -------- FIXED BY ------------------------------------------------------------ * David Rothstein [9] of the Drupal Security Team * Hunter Fox [10] of the Drupal Security Team * Kyle Browning [11], the module maintainer. -------- COORDINATED BY ------------------------------------------------------ * Hunter Fox [12] of the Drupal Security Team * Klaus Purer [13] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [18] [1] http://drupal.org/project/services [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/services [5] https://drupal.org/node/2180373 [6] http://drupal.org/project/services [7] https://drupal.org/user/11442 [8] https://drupal.org/user/1223090 [9] https://drupal.org/user/124982 [10] https://drupal.org/user/426416 [11] https://drupal.org/user/211387 [12] http://drupal.org/user/426416 [13] http://drupal.org/user/262198 [14] http://drupal.org/contact [15] http://drupal.org/security-team [16] http://drupal.org/writing-secure-code [17] http://drupal.org/security/secure-configuration [18] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-006 - Language Switcher Dropdown - Open Redirect
by security-news＠drupal.org 22 Jan '14

22 Jan '14

View online: https://drupal.org/node/2179123 * Advisory ID: DRUPAL-SA-CONTRIB-2014-006 * Project: Language Switcher Dropdown [1] (third-party module) * Version: 7.x * Date: 2014-January-22 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Open Redirect -------- DESCRIPTION --------------------------------------------------------- The Language Switcher Dropdown module enables you to place a block with a convenient drop-down language switcher. After choosing a value the user is redirected to the url of the relevant language. The module doesn't check that the url provided is a valid internal path prior to redirecting. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Language Switcher Dropdown 7.x-1.x versions prior to 7.x-1.4. Drupal core is not affected. If you do not use the contributed Language Switcher Dropdown [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Language switcher dropdown module for Drupal 7.x, upgrade to Language Switcher Dropdown 7.x-1.4 [5] Also see the Language Switcher Dropdown [6] project page. -------- REPORTED BY --------------------------------------------------------- * Eric Peterson [7] -------- FIXED BY ------------------------------------------------------------ * Mohammed J. Razem [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Lee Rowlands [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] http://drupal.org/project/lang_dropdown [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/lang_dropdown [5] https://drupal.org/node/1614372 [6] http://drupal.org/project/lang_dropdown [7] http://drupal.org/user/1467594 [8] https://drupal.org/user/255384 [9] http://drupal.org/user/395439 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-005 - Leaflet - Access bypass
by security-news＠drupal.org 22 Jan '14

22 Jan '14

View online: https://drupal.org/node/2179103 * Advisory ID: DRUPAL-SA-CONTRIB-2014-005 * Project: Leaflet [1] (third-party module) * Version: 7.x * Date: 2014-January-22 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Leaflet module enables you to display an interactive map using the Leaflet library, using entities as map features. The module exposes complete data from entities used as map features to any site visitor with a Javascript inspector (like Firebug). -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Leaflet 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed Leaflet [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Leaflet module version for Drupal 7.x, upgrade to Leaflet 7.x-1.1 [5] Also see the Leaflet [6] project page. -------- REPORTED BY --------------------------------------------------------- * Interdruper [7] * Chris Hood [8] -------- FIXED BY ------------------------------------------------------------ * Gabriel Carleton-Barnes [9], the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] http://drupal.org/project/leaflet [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/leaflet [5] https://drupal.org/node/2178655 [6] http://drupal.org/project/leaflet [7] http://drupal.org/user/2437374 [8] http://drupal.org/user/279264 [9] http://drupal.org/user/1682976 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-004 - Secure Cookie Data - Faulty Hashing
by security-news＠drupal.org 22 Jan '14

22 Jan '14

View online: https://drupal.org/node/2179099 * Advisory ID: DRUPAL-SA-CONTRIB-2014-004 * Project: Secure Cookie Data [1] (third-party module) * Version: 7.x * Date: 2014-January-22 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Information Disclosure, Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- This module allows for storing data securely in a cookie through implementing the Secure Cookie Protocol [3]. .... Ability to alter trusted data in the cookie The module did an incorrect comparison of the HMAC [4] value, allowing a bypass of the HMAC verification which allows changing the cookie value. .... Known encryption key value The key for the HMAC provided a default that was hardcoded. The module relied on the extension of the base class to provide a per site specific key. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [5] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Secure Cookie Data 7.x-2.x versions prior to 7.x-2.1. Drupal core is not affected. If you do not use the contributed Secure Cookie Data [6] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Secure Cookie Data module upgrade to Secure Cookie Data 7.x-2.1 [7] Also see the Secure Cookie Data [8] project page. -------- REPORTED BY --------------------------------------------------------- * Heine Deelstra [9] of the Drupal Security Team * Jonathan Kuma [10] module maintainer -------- FIXED BY ------------------------------------------------------------ * Antonio Almeida [11] and Jonathan Kuma [12] the module maintainers. -------- COORDINATED BY ------------------------------------------------------ * Heine Deelstra [13] and Greg Knaddison [14] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [15]. Learn more about the Drupal Security team and their policies [16], writing secure code for Drupal [17], and securing your site [18]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [19] [1] http://drupal.org/project/secure_cookie_data [2] http://drupal.org/security-team/risk-levels [3] http://www.cse.msu.edu/~alexliu/publications/Cookie/cookie.pdf [4] http://en.wikipedia.org/wiki/Hash-based_message_authentication_code [5] http://cve.mitre.org/ [6] http://drupal.org/project/secure_cookie_data [7] https://drupal.org/node/2178505 [8] http://drupal.org/project/secure_cookie_data [9] https://drupal.org/user/17943 [10] https://drupal.org/user/1919440 [11] https://drupal.org/user/8859 [12] https://drupal.org/user/1919440 [13] https://drupal.org/user/17943 [14] https://drupal.org/user/36762 [15] http://drupal.org/contact [16] http://drupal.org/security-team [17] http://drupal.org/writing-secure-code [18] http://drupal.org/security/secure-configuration [19] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-003 - Doubleclick for Publishers DFP - Cross Site Scripting (XSS)
by security-news＠drupal.org 22 Jan '14

22 Jan '14

View online: https://drupal.org/node/2179085 * Advisory ID: DRUPAL-SA-CONTRIB-2014-003 * Project: Doubleclick for Publishers (DFP) [1] (third-party module) * Version: 7.x * Date: 2014-January-22 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to create blocks to place advertisements from the Google Double Click for Publishers API (DFP). The module doesn't sufficiently sanitize the slot names prior to output into HTML. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer dfp". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * DFP 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Doubleclick for Publishers (DFP) [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the DFP module for Drupal 7.x, upgrade to Google DFP 7.x-1.2 [5] Also see the Doubleclick for Publishers (DFP) [6] project page. -------- REPORTED BY --------------------------------------------------------- * Matt Vance [7] -------- FIXED BY ------------------------------------------------------------ * Matt Vance [8] * Beth Binkovitz [9], provisional member of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Beth Binkovitz [10], provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] http://drupal.org/project/dfp [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/dfp [5] https://drupal.org/node/2172167 [6] http://drupal.org/project/dfp [7] https://drupal.org/user/88338 [8] http://drupal.org/user/88338 [9] https://drupal.org/user/161263 [10] https://drupal.org/user/161263 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2014-002 - Anonymous Posting - Cross Site Scripting (XSS)
by security-news＠drupal.org 15 Jan '14

15 Jan '14

View online: https://drupal.org/node/2173321 * Advisory ID: DRUPAL-SA-CONTRIB-2014-002 * Project: Anonymous Posting [1] (third-party module) * Version: 7.x * Date: 2014-01-15 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module allows anonymous users to fill in their contact information (name, email and homepage) when posting any content type including Forum Topics. This allows the submitted name to be shown instead of the usual anonymous string provided by Drupal core. The module doesn't properly sanitize the name submitted by the anonymous user before it is output. This vulnerability is mitigated only by the fact that use of anonymous posting data must be enabled on a per content type basis by a user with permission to do so since it is not enabled by default. However when configured for it's intended purpose, the vulnerability is not mitigated. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Anonymous Posting 7.x-1.x versions 7.x-1.2 and 7.x-1.3 Drupal core is not affected. If you do not use the contributed Anonymous Posting [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ * Install the latest version: 7.x-1.4 [5] Also see the Anonymous Posting [6] project page. -------- REPORTED BY --------------------------------------------------------- * drikc [7] the module maintainer -------- FIXED BY ------------------------------------------------------------ * drikc [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Rick Manelius [9] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] http://drupal.org/project/anonymous_posting [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/anonymous_posting [5] https://drupal.org/node/2173437 [6] http://drupal.org/project/anonymous_posting [7] http://drupal.org/user/13299 [8] http://drupal.org/user/13299 [9] http://drupal.org/user/680072 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0