Security-news

security-news@drupal.org

1 participants
1782 discussions

SA-CONTRIB-2012-051 - Activity - Multiple Vulnerablities
by security-news＠drupal.org 28 Mar '12

28 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-051 * Project: Activity [1] (third-party module) * Version: 6.x * Date: 2012-March-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Activity module keeps track of the things people do on your site and provides mini-feeds of these activities in blocks, in a specialized table, and via RSS. The module is extensible so that any other module can integrate with it. The messages that are produced are customizable via the admin interface and are context sensitive. The 6.x-1.x branch of the module does not filter output of the module settings correctly leading to a cross site scripting vulnerability (XSS). It also does not confirm user intent when removing a single activity resulting in a cross site request forgery vulnerability. The XSS vulnerability is mitigated by the fact that it requires the malicious user to have a role with the "access administration pages" and "administer activity" permissions. -------- VERSIONS AFFECTED --------------------------------------------------- * All releases of the 6.x-1.x branch Drupal core is not affected. If you do not use the contributed Activity [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * The 6.x-1.x branch of this module is no longer supported. Upgrade to 6.x-2.0-alpha1 [4] Note that there is currently no upgrade path. Users of the module are encouraged to work in the module queue to help build an upgrade path. Also see the Activity [5] project page. -------- REPORTED BY --------------------------------------------------------- * Ivo Van Geertruyen [6] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/activity [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/activity [4] http://drupal.org/node/944146 [5] http://drupal.org/project/activity [6] http://drupal.org/user/383424 [7] http://drupal.org/user/102818 [8] http://drupal.org/user/36762 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-050 - CDN2 Video - Unsupported
by security-news＠drupal.org 28 Mar '12

28 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-050 * Project: CDN2 Video [1] (third-party module) * Version: 6.x * Date: 2012-March-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- CDN2 is a plug and play module and video management service for Drupal. The module does not sanitize output correctly, allowing for a cross-site scripting (XSS) vulnerability. Additionally, the Form API is not correctly utilized allowing for cross-site request forgery (CSRF) attempts. This module relies on a backend service that is no longer active therefore the project is unsupported. -------- VERSIONS AFFECTED --------------------------------------------------- All versions are affected. Drupal core is not affected. If you do not use the contributed CDN2 Video [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the module. This module is no longer supported. Also see the CDN2 Video [4] project page. -------- REPORTED BY --------------------------------------------------------- * Michael Hess [5] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [6] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. [1] http://drupal.org/project/cdn2 [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/cdn2 [4] http://drupal.org/project/cdn2 [5] http://drupal.org/user/102818 [6] http://drupal.org/user/102818 [7] http://drupal.org/contact [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-049 - ShareThis - Multiple Vulnerablies
by security-news＠drupal.org 28 Mar '12

28 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-049 * Project: ShareThis [1] (third-party module) * Version: 7.x * Date: 2012-March-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The ShareThis module allows you to display social networking tools to users. The administration forms of the module do not properly use the Form API allowing a malicious user to inject unexpected settings, allowing for cross-site scripting attacks (XSS). Additionally, the module had an incomplete feature for updating these settings outside of the Form API which was vulnerable to a cross site request forgery attack. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer sharethis". -------- VERSIONS AFFECTED --------------------------------------------------- * ShareThis 7.x-2.x versions prior to 7.x-2.2. Drupal core is not affected. If you do not use the contributed ShareThis [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the ShareThis module for Drupal 7.x, upgrade to ShareThis 7.x-2.3 [4] Also see the ShareThis [5] project page. -------- REPORTED BY --------------------------------------------------------- * Travis Tomka [6] -------- FIXED BY ------------------------------------------------------------ * Greg Knaddison [7] of the Drupal Security Team * Rob Loach [8], the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team * Michael Hess [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/sharethis [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/sharethis [4] http://drupal.org/node/1504746 [5] http://drupal.org/project/sharethis [6] http://drupal.org/user/718562 [7] http://drupal.org/user/36762 [8] http://drupal.org/user/61114 [9] http://drupal.org/user/36762 [10] http://drupal.org/user/102818 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-048 - Contact Save - Cross Site Scripting
by security-news＠drupal.org 28 Mar '12

28 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-048 * Project: Contact Save [1] (third-party module) * Version: 6.x * Date: 2012-March-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module stores in the database all messages submitted through the core contact forms, and provides a way to respond to these messages through the website. The module doesn't sufficiently filter user supplied text, leading to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with either the "access site-wide contact form". -------- VERSIONS AFFECTED --------------------------------------------------- * Contact Save 6.x-1.x versions prior to 6.x-1.5. Drupal core is not affected. If you do not use the contributed Contact Save [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Contact Save module for Drupal 6.x, upgrade to Contact Save 6.x-1.5 [4]. Also see the Contact Save [5] project page. -------- REPORTED BY --------------------------------------------------------- * Stella Power [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Joel Stein [7] the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/contact_save [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/contact_save [4] http://drupal.org/node/953788 [5] http://drupal.org/project/contact_save [6] http://drupal.org/user/66894 [7] http://drupal.org/user/36598 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-047 - Ubercart Views - Information disclosure
by security-news＠drupal.org 28 Mar '12

28 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-047 * Project: Ubercart Views [1] (third-party module) * Version: 6.x * Date: 2012-March-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Ubercart Views provides Views integration for the Ubercart shopping cart module, and includes default views that contain a critical information disclosure bug. In some versions, these views are disabled by default, but still disclose information if you enable them. -------- VERSIONS AFFECTED --------------------------------------------------- All versions of Ubercart Views for Drupal 6.x prior to 6.x-3.2. Drupal core is not affected. If you do not use the contributed Ubercart Views [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Ubercart Views module for Drupal 6.x upgrade to Ubercart Views 6.x-3.2 [4] After installing, if you have enabled or previously edited the "orders" or "order_management" views, you must either revert these views to their default settings, or edit the "access" settings for these views and ensure that all displays require the "view all orders" permission. Also see the Ubercart Views [5] project page. -------- REPORTED BY --------------------------------------------------------- * Derek Wright [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * David Long [7] the module maintainer * Derek Wright [8] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Gerhard Killesreiter [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/uc_views [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/uc_views [4] http://drupal.org/node/1505210 [5] http://drupal.org/project/uc_views [6] http://drupal.org/user/46549 [7] http://drupal.org/user/246492 [8] http://drupal.org/user/46549 [9] http://drupal.org/user/227 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-046 - Bundle Copy - Arbitrary Code execution
by security-news＠drupal.org 28 Mar '12

28 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-046 * Project: Bundle copy [1] (third-party module) * Version: 7.x * Date: 2012-March-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- Bundle copy is a replacement for the Content copy module which lives in the CCK project for Drupal 6. Besides the ability to import and export content types, taxonomy and user entities are also supported. Field groups can be exported easily as well. The module doesn't sufficiently check whether the user has the "use PHP for settings" permission, allowing to execute arbitrary PHP code while importing settings. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer taxonomy", "administer content types" or "administer users". -------- VERSIONS AFFECTED --------------------------------------------------- * Bundle copy 7.x-1.x versions prior to 7.x-1.0. Drupal core is not affected. If you do not use the contributed Bundle copy [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Bundle copy module for Drupal 7.x, upgrade to Bundle copy 7.x-1.1 [4] Also see the Bundle copy [5] project page. -------- REPORTED BY --------------------------------------------------------- * David Rothstein [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Kristof De Jaeger [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Ivo Van Geertruyen [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/bundle_copy [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/bundle_copy [4] http://drupal.org/node/1506166 [5] http://drupal.org/project/bundle_copy [6] http://drupal.org/user/124982 [7] http://drupal.org/user/107403 [8] http://drupal.org/user/383424 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-045 - AddToAny - Cross Site Scripting
by security-news＠drupal.org 28 Mar '12

28 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-045 * Project: Share Buttons (AddToAny) by Lockerz [1] (third-party module) * Version: 6.x * Date: 2012-March-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to add Lockerz/AddToAny's universal sharing buttons to your site. Previously, the module did not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer addtoany". -------- VERSIONS AFFECTED --------------------------------------------------- * 6.x-3.x versions prior to 6.x-3.4 [3] Drupal core is not affected. If you do not use the contributed Share Buttons (AddToAny) by Lockerz [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Lockerz/AddToAny module for Drupal 6.x, upgrade to version 6.x-3.4 Also see the Share Buttons (AddToAny) by Lockerz [5] project page. -------- REPORTED BY --------------------------------------------------------- * Kyle Small [6] -------- FIXED BY ------------------------------------------------------------ * micropat [7] — one of the module's maintainers -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/addtoany [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/node/1083664 [4] http://drupal.org/project/addtoany [5] http://drupal.org/project/addtoany [6] https://drupal.org/user/832278 [7] http://drupal.org/user/260224 [8] http://drupal.org/user/102818 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-044 - Contact Forms - Cross Site Scripting
by security-news＠drupal.org 28 Mar '12

28 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-044 * Project: Contact Forms [1] (third-party module) * Version: 6.x * Date: 2012-March-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module expands the features of the site wide contact form. It eliminates the drop down category menu by generating a clean looking contact form with a unique path, for each of the contact form categories. The module doesn't sufficiently filter user text of the page title and additional information, leading to a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer site-wide contact form" and the core contact form needs to be enabled. -------- VERSIONS AFFECTED --------------------------------------------------- * Contact forms 6.x-1.x versions prior to 6.x-1.13 [3]. Drupal core is not affected. If you do not use the contributed Contact Forms [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Contact Forms module for Drupal 6.x, upgrade to 6.x-1.13 [5] Also see the Contact Forms [6] project page. -------- REPORTED BY --------------------------------------------------------- * Ivo Van Geertruyen [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Geoff Davies [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/contact_forms [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/node/1506330 [4] http://drupal.org/project/contact_forms [5] http://drupal.org/node/1506330 [6] http://drupal.org/project/contact_forms [7] http://drupal.org/user/383424 [8] http://drupal.org/user/29262 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-043 - MultiBlock - Cross Site Scripting
by security-news＠drupal.org 28 Mar '12

28 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-0XX * Project: MultiBlock [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-March-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The MultiBlock module allows an administrator to create multiple instances of blocks provided by other modules. The module does not properly sanitize the block title provided by a block administrator, leading to a cross-site scripting (XSS) vulnerability. Such an attack may lead to a malicious user gaining full administrative access. A user must have a role with the permission 'administer blocks' to exploit this vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * MultiBlock 6.x-1.x versions prior to 6.x-1.4. * MultiBlock 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed MultiBlock [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the MultiBlock module for Drupal 6.x, upgrade to MultiBlock 6.x-1.4 [4] * If you use the MultiBlock module for Drupal 7.x, upgrade to MultiBlock 7.x-1.1 [5] Also see the MultiBlock [6] project page. -------- REPORTED BY --------------------------------------------------------- * Justin Klein Keane [7] -------- FIXED BY ------------------------------------------------------------ * Andrew Levine [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Ivo Van Geertruyen [9] of the Drupal Security Team * Michael Hess [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/multiblock [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/multiblock [4] http://drupal.org/node/1505410 [5] http://drupal.org/node/1505414 [6] http://drupal.org/project/multiblock [7] http://drupal.org/user/302225 [8] http://drupal.org/user/49940 [9] http://drupal.org/user/383424 [10] http://drupal.org/user/102818 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-042 - Wishlist Cross Site Scripting (XSS)
by security-news＠drupal.org 21 Mar '12

21 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-042 * Project: Wishlist Module [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-March-21 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Wishlist Module allows users to maintain shared wishlists for special events and holidays. Impact: The module doesn't sufficiently filter user supplied text from the URL. This can be used to perform a reflected cross site scripting (XSS) attack. User account credentials could be exposed or compromised, or users could be redirected to sites designed for phishing or hosting malware. This vulnerability is mitigated by the fact that users must be tricked into visiting a specific link and then manipulating the show/hide purchase details drop down. This drop down is only rendered if the user is viewing their own Wish List and the module is configured to hide the purchased status from them. -------- VERSIONS AFFECTED --------------------------------------------------- * Wishlist Module 6.x-2.x versions prior to 6.x-2.6. * Wishlist Module 7.x-2.x versions prior to 7.x-2.6. Drupal core is not affected. If you do not use the contributed Wishlist Module [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Wishlist module for Drupal 6.x, upgrade to Wishlist 6.x-2.6 [4] * If you use the Wishlist module for Drupal 7.x, upgrade to Wishlist 7.x-2.6 [5] See also the Wishlist Module [6] project page. -------- REPORTED BY --------------------------------------------------------- * Justin Klein Keane [7] -------- FIXED BY ------------------------------------------------------------ * Scott McLewin [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/wishlist [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/wishlist [4] http://drupal.org/node/1483634 [5] http://drupal.org/node/1483636 [6] http://drupal.org/project/wishlist [7] http://drupal.org/user/302225 [8] http://drupal.org/user/33718 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news