- Security-news - lists.drupal.org

SA-CONTRIB-2013-016 - Banckle Chat - Access bypass - Unsupported
by security-news＠drupal.org 13 Feb '13

13 Feb '13

View online: http://drupal.org/node/1916370 * Advisory ID: DRUPAL-SA-CONTRIB-2013-016 * Project: Banckle Chat [1] (third-party module) * Version: 7.x * Date: 2013-February-13 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to chat with the visitors of your web site. The module doesn't sufficiently check access to its admin pages. This vulnerability is not mitigated. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All Banckle Chat 7.x-1.x versions. Drupal core is not affected. If you do not use the contributed Banckle Chat [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the module. Also see the Banckle Chat [5] project page. -------- REPORTED BY --------------------------------------------------------- * Wale Adesanya [6] * Lau Futtrup Rasmussen -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Gerhard Killesreiter [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/banckle_live_chat [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/banckle_live_chat [5] http://drupal.org/project/banckle_live_chat [6] http://drupal.org/user/1028156 [7] http://drupal.org/user/83 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-015 - Manager Change for Organic Groups - Cross site scripting (XSS)
by security-news＠drupal.org 13 Feb '13

13 Feb '13

View online: http://drupal.org/node/1916312 * Advisory ID: DRUPAL-SA-CONTRIB-2013-015 * Project: Manager Change for Organic Groups [1] (third-party module) * Version: 7.x * Date: 2013-February-13 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module extends Organic Groups to allow the manager of a group to select a new manager for their group (ie if they want to leave the group). The autocomplete field for selecting a new manager didn't properly filter usernames. The vulnerability is mitigated by the fact that Drupal's default registration validation prevents the creation of username that contain cross site scripting attacks. However, a contributed module may bypass that validation or alter the way usernames are loaded in a way that introduces an attack vector. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Manager Change for Organic Groups 7.x-2.x versions prior to 7.x-2.1. Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the 2.x branch of the Manager Change for Organic Groups module for Drupal 7.x, upgrade to Manager Change for Organic Groups 7.x-2.1 [4] Also see the Manager Change for Organic Groups project page. -------- REPORTED BY --------------------------------------------------------- * Michael Hess [5] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Joe Haskins [6] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/og_manager_change [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/node/1915408 [5] http://drupal.org/user/102818 [6] http://drupal.org/user/1358434 [7] http://drupal.org/user/102818 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-014 - Drush Debian Packaging - Information Disclosure - Unsupported
by security-news＠drupal.org 30 Jan '13

30 Jan '13

View online: http://drupal.org/node/1903324 * Advisory ID: DRUPAL-SA-CONTRIB-2013-014 * Project: Drush Debian Packaging [1] (third-party module) * Version: 7.x * Date: 2013-January-30 * Security risk: Critical [2] * Exploitable from: Local * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- This package is a tool to build debian packages from a Drupal instance. The module doesn't sufficiently protect database credentials. This vulnerability is mitigated by the fact that an attacker must have shell access to the server. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All versions. Drupal core is not affected. If you do not use the contributed Drush Debian Packaging [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the package. Also see the Drush Debian Packaging [5] project page. -------- REPORTED BY --------------------------------------------------------- * jiri-catalyst [6] -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/debuild [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/debuild [5] http://drupal.org/project/debuild [6] http://drupal.org/user/2322458 [7] http://drupal.org/user/36762 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-013 - Boxes - Cross site scripting (XSS)
by security-news＠drupal.org 30 Jan '13

30 Jan '13

View online: http://drupal.org/node/1903300 * Advisory ID: DRUPAL-SA-CONTRIB-2013-013 * Project: Boxes [1] (third-party module) * Version: 7.x * Date: 2013-January-30 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The subject field for the included simple box doesn't escape HTML properly. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to administer/edit boxes. Wikipedia has more information about cross site scripting [3] (XSS). -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Boxes 7.x-1.x versions prior to 7.x-1.1 Drupal core is not affected. If you do not use the contributed Boxes [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Boxes module for Drupal 7.x, upgrade to Boxes 7.x-1.1 [6] Also see the Boxes [7] project page. -------- REPORTED BY --------------------------------------------------------- * Laura Dickinson [8] -------- FIXED BY ------------------------------------------------------------ * Tirdad Chaharlengi [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/boxes [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Xss [4] http://cve.mitre.org/ [5] http://drupal.org/project/boxes [6] http://drupal.org/node/1897016 [7] http://drupal.org/project/boxes [8] http://drupal.org/user/337318 [9] http://drupal.org/user/383630 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-012 - Google Authenticator login - Access Bypass
by security-news＠drupal.org 30 Jan '13

30 Jan '13

View online: http://drupal.org/node/1903282 * Advisory ID: DRUPAL-SA-CONTRIB-2013-012 * Project: Google Authenticator login [1] (third-party module) * Version: 7.x * Date: 2013-January-30 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module will allow you to add Time-based One-time Password Algorithm (also called "Two Step Authentication" or "Multi-Factor Authentication") support to user logins. Users with the permission to use multi-factor authentication need to associate a Google Authenticator token with their acount before they can use the multi-factor authentication for login. If this step is not done or not completed, their accounts can be logged-in to by supplying the username only due to a logic bug in the module's validation. This means that when an administrator enables the module and grants the permission to use multi-factor authentication all user accounts with that permission can be logged-in to via the username. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All 7.x versions prior to 7.x-1.3. Drupal core is not affected. If you do not use the contributed Google Authenticator login [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Google Authenticator login module for Drupal 7.x, upgrade to Google Authenticator login 7.x-1.3 [5] Also see the Google Authenticator login [6] project page. -------- REPORTED BY --------------------------------------------------------- * Patrick C. [7] -------- FIXED BY ------------------------------------------------------------ * attiks [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Heine Deelstra [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/ga_login [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/ga_login [5] http://drupal.org/node/1902102 [6] http://drupal.org/project/ga_login [7] https://drupal.org/user/127758 [8] http://drupal.org/user/105002 [9] http://drupal.org/user/17943 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-011 - email2image - Access Bypass - Unsupported
by security-news＠drupal.org 30 Jan '13

30 Jan '13

View online: http://drupal.org/node/1903264 * Advisory ID: DRUPAL-SA-CONTRIB-2013-011 * Project: email2image [1] (third-party module) * Version: 6.x * Date: 2013-January-30 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module creates images of user email addresses and email fields. The module doesn't sufficiently check node access restrictions when displaying such fields. This vulnerability is mitigated by the fact that it only impacts sites using node access. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All email2image 6.x-1.x and 6.x-2.x versions. Drupal core is not affected. If you do not use the contributed email2image [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the email2image module for Drupal 6.x you should uninstall the module Also see the email2image [5] project page. -------- REPORTED BY --------------------------------------------------------- * Ayesh Karunaratne [6] -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Lee Rowlands [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/email2image [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/email2image [5] http://drupal.org/project/email2image [6] http://drupal.org/user/796148 [7] http://drupal.org/user/395439 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-010 - Search API sorts - Cross Site Scripting (XSS)
by security-news＠drupal.org 23 Jan '13

23 Jan '13

View online: http://drupal.org/node/1896782 * Advisory ID: DRUPAL-SA-CONTRIB-2013-010 * Project: Search API sorts [1] (third-party module) * Version: 7.x * Date: 2013-January-23 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to sort by Search API facets. The module doesn't sufficiently filter user entered text in field labels. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to modify field labels such as "administer taxonomy". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Search API Sorts 7.x-1.x versions prior to 7.x-1.4. Drupal core is not affected. If you do not use the contributed Search API sorts [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Search API Sorts module for Drupal 7.x, upgrade to Search API Sorts 7.x-1.4 [5] Also see the Search API sorts [6] project page. -------- REPORTED BY --------------------------------------------------------- * Francisco José Cruz Romanos [7] -------- FIXED BY ------------------------------------------------------------ * Francisco José Cruz Romanos [8] -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/1097626 [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/1097626 [5] http://drupal.org/node/1896756 [6] http://drupal.org/project/1097626 [7] https://drupal.org/user/848238 [8] https://drupal.org/user/848238 [9] http://drupal.org/user/262198 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-009 - Keyboard Shortcut Utility - Access Bypass - module unsupported
by security-news＠drupal.org 23 Jan '13

23 Jan '13

View online: http://drupal.org/node/1896752 * Advisory ID: DRUPAL-SA-CONTRIB-2013-009 * Project: Keyboard Shortcut Utility [1] (third-party module) * Version: 7.x * Date: 2013-January-23 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Keyboard Shortcut Utility module enables you to create keyboard shortcuts on your website. You can create a shortcut to go to a page (internal or external) or call a JavaScript function. The module doesn't sufficiently check node access to view nodes for users who have "view shortcuts" permission. It also doesn't check node access to view, edit, or delete nodes for users who have the "admin shortcuts" permission. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "view shortcuts" or "admin shortcuts". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All Keyboard Shortcut Utility 7.x-1.x versions. Drupal core is not affected. If you do not use the contributed Keyboard Shortcut Utility [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the module. No patched version is available. Also see the Keyboard Shortcut Utility [5] project page. -------- REPORTED BY --------------------------------------------------------- * Michael Griego [6] -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Ivo Van Geertruyen [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/keyboard_shortcut [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/keyboard_shortcut [5] http://drupal.org/project/keyboard_shortcut [6] http://drupal.org/user/524484 [7] http://drupal.org/user/383424 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-008 - CurvyCorners - Cross Site Scripting (XSS) - module unsupported
by security-news＠drupal.org 23 Jan '13

23 Jan '13

View online: http://drupal.org/node/1896718 * Advisory ID: DRUPAL-SA-CONTRIB-2013-008 * Project: CurvyCorners [1] (third-party module) * Version: 6.x, 7.x * Date: 2013-January-23 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The CurvyCorners module enables you to create rounded corners on HTML block elements. The module doesn't sufficiently filter user entered text when being displayed. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer curvycorners". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * CVE-2013-1393 -------- VERSIONS AFFECTED --------------------------------------------------- * All CurvyCorners 6.x-1.x versions. * All CurvyCorners 7.x-1.x versions. Drupal core is not affected. If you do not use the contributed CurvyCorners [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the CurvyCorners module, uninstall the module - there is no patch available to fix this issue Also see the CurvyCorners [4] project page. -------- REPORTED BY --------------------------------------------------------- * rickauer [5] -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [6] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. [1] http://drupal.org/project/curvycorners [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/curvycorners [4] http://drupal.org/project/curvycorners [5] http://drupal.org/user/69553 [6] http://drupal.org/user/36762 [7] http://drupal.org/contact [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-007 User Relationships - Cross Site Scripting (XSS)
by security-news＠drupal.org 23 Jan '13

23 Jan '13

View online: http://drupal.org/node/1896720 * Advisory ID: DRUPAL-SA-CONTRIB-2013-007 * Project: User Relationships [1] (third-party module) * Version: 6.x, 7.x * Date: 2013-January-23 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The User Relationships module allows you to create multiple relationship types and maintain relationships between users in your Drupal site. The module does not sufficiently escape relationship names before display. This allows users with the correct permissions to create relationship names containing arbitrary Javascript which will then be executed by the browser. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer user relationships". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * User Relationships 6.x-1.x versions prior to 6.x-1.4 * User Relationships 7.x-1.x versions prior to 7.x-1.0-alpha5 Drupal core is not affected. If you do not use the contributed User Relationships [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the User Relationships module for Drupal 6.x, upgrade to User Relationships 6.x-1.4 [5] * If you use the User Relationships module for Drupal 7.x, upgrade to User Relationships 7.x-1.0-alpha5 [6] Also see the User Relationships [7] project page. -------- REPORTED BY --------------------------------------------------------- * Klaus Purer [8] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Mark Ferree [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/user_relationships [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/user_relationships [5] http://drupal.org/node/1896272 [6] http://drupal.org/node/1896276 [7] http://drupal.org/project/user_relationships [8] http://drupal.org/user/262198 [9] http://drupal.org/user/76245 [10] http://drupal.org/user/262198 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0