- Security-news - lists.drupal.org

SA-CONTRIB-2012-113 - Drupal Commons - Access Bypass
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679888 * Advisory ID: SA-CONTRIB-2012-113 * Project: Drupal Commons [1] (third-party module) * Version: 6.x * Date: 2012-July-11 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Drupal Commons is a ready-to-use solution for building either internal or external communities. The Drupal Commons feature (a central module in the distribution) includes a listing of recent comments on discussions. This listing of comments is powered by a view that doesn't fully enforce node access restrictions, which can expose comments for nodes that the user might not have access to view. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal Commons 6.x-2.x versions prior to 6.x-2.8. Drupal core is not affected. If you do not use the contributed Drupal Commons [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Drupal Commons module for Drupal 6.x, upgrade to Drupal Commons 6.x-2.8 [4] Also see the Drupal Commons [5] project page. -------- REPORTED BY --------------------------------------------------------- * Trevor English [6] * Ezra Gildesgame [7] -------- FIXED BY ------------------------------------------------------------ * Ezra Gildesgame [8] the distribution maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/commons [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/commons [4] http://network.acquia.com/downloads/drupal-commons [5] http://drupal.org/project/commons [6] http://drupal.org/user/193352 [7] http://drupal.org/user/69959 [8] http://drupal.org/user/69959 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-112 - Ubercart SecureTrading - Failure to follow guideline/specification
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679820 * Advisory ID: SA-CONTRIB-2012-112 * Project: Ubercart SecureTrading Payment Method [1] (third-party module) * Version: 6.x * Date: 2012-July-11 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Failure to follow guideline/specification - integrity check value -------- DESCRIPTION --------------------------------------------------------- The Ubercart SecureTrading Payment Method module provides an Ubercart payment method for the SecureTrading.com gateway. The module's payment method did not properly verify the validity of payment notification information. A malicious user could trick a site into thinking that an item has been paid for when in fact it hasn't. If you do not use the Ubercart SecureTrading Payment Method payment method then your site is not at risk to this vulnerability. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * All versions of the Ubercart SecureTrading Payment Method module. Drupal core is not affected. If you do not use the contributed Ubercart SecureTrading Payment Method [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ There is not currently a fixed version of the module. You should disable the module immediately. You can: * Change to a new gateway. * Work with the module maintainer and/or other users to patch the module. Also see the Ubercart SecureTrading Payment Method [4] project page. -------- REPORTED BY --------------------------------------------------------- * Dylan Tack [5] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ No fix provided. -------- COORDINATED BY ------------------------------------------------------ * Dylan Tack [6] of the Drupal Security Team * Damien Tournoud [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/uc_securetrading [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/uc_securetrading [4] http://drupal.org/project/uc_securetrading [5] http://drupal.org/user/96647 [6] http://drupal.org/user/96647 [7] http://drupal.org/user/22211 [8] http://drupal.org/user/36762 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-111 - Security Questions - Access Bypass
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679532 * Advisory ID: SA-CONTRIB-2012-111 * Project: Security Questions [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-July-11 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module provides administrator configurable challenge questions for use during the log in and password reset processes. The module doesn't perform a proper access check, allowing a users' questions and answers to be edited by other users including anonymous users. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Security Questions 6.x-1.x versions prior to 6.x-1.1. * Security Questions 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed Security Questions [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Security Questions module for Drupal 6.x, upgrade to Security Questions 6.x-1.1 [4] * If you use the Security Questions module for Drupal 7.x, upgrade to Security Questions 7.x-1.1 [5] Also see the Security Questions [6] project page. -------- REPORTED BY --------------------------------------------------------- * Chris Hertzog [7] -------- FIXED BY ------------------------------------------------------------ * Chris Hertzog [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team * David Rothstein [10] of the Drupal Security Team * Chris Hales [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/security_questions [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/security_questions [4] http://drupal.org/node/1648200 [5] http://drupal.org/node/1648204 [6] http://drupal.org/project/security_questions [7] http://drupal.org/user/806366 [8] http://drupal.org/user/806366 [9] http://drupal.org/user/36762 [10] http://drupal.org/user/124982 [11] http://drupal.org/user/347249 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-110 - Colorbox Node - Cross Site Scripting (XSS)
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679486 * Advisory ID: SA-CONTRIB-2012-110 * Project: Colorbox Node [1] (third-party module) * Version: 7.x * Date: 2012-July-11 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Colorbox Node gives the user the ability to display ANY page inside a colorbox modal without the header and footer. The module accepts some settings from URL parameters and didn't sufficiently validate them before printing them to the browser, allowing malicious users to inject script code into the page. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Colorbox Node 7.x-2.x versions prior to 7.x-2.2. Drupal core is not affected. If you do not use the contributed Colorbox Node [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * Upgrade to Colorbox Node 7.x-2.2 [4] Also see the Colorbox Node [5] project page. -------- REPORTED BY --------------------------------------------------------- * Gerhard Killesreiter [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Dennis Blake [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Gerhard Killesreiter [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/colorbox_node [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/colorbox_node [4] http://drupal.org/node/1679410 [5] http://drupal.org/project/colorbox_node [6] http://drupal.org/user/83 [7] http://drupal.org/user/384543 [8] http://drupal.org/user/227 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-109 - Restrict node page view - Access bypass
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679466 * Advisory ID: SA-CONTRIB-2012-109 * Project: Restrict node page view [1] (third-party module) * Version: 7.x * Date: 2012-July-11 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to disable direct access to node pages (node/XXX) based on nodetypes and permissions. The module issues a NODE_ACCESS_ALLOW if it's permissions are met, but does not respect the "administer nodes" or "access own unpublished content" permissions. The consequence is that this module grants access to unpublished content to any role that has the "view any node page" or "view any node {type} page" permissions. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Restrict node page view 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Restrict node page view [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Restrict node page view module for Drupal 7.x, upgrade to Restrict node page view 7.x-1.2 [4] Also see the Restrict node page view [5] project page. -------- REPORTED BY --------------------------------------------------------- * Jake Bell [6] -------- FIXED BY ------------------------------------------------------------ * Jake Bell [7] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team * Chris Hales [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/restrict_node_page_view [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/restrict_node_page_view [4] http://drupal.org/node/1662724 [5] http://drupal.org/project/restrict_node_page_view [6] http://drupal.org/user/11219 [7] http://drupal.org/user/11219 [8] http://drupal.org/user/36762 [9] http://drupal.org/user/347249 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-108 - Drag & Drop Gallery - Arbitrary PHP code execution
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679442 * Advisory ID: DRUPAL-SA-CONTRIB-2012-108 * Project: Drag & Drop Gallery [1] (third-party module) * Version: 6.x * Date: 2012-July-11 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Access bypass, Cross Site Request Forgery, SQL Injection, Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- /Important note: Most of the vulnerabilities discussed below can be exploited when the Drag & Drop Gallery module is disabled on a Drupal site. See Solution below for details./ The Drag & Drop Gallery creates a gallery node type that allows you add images to the gallery by dragging and dropping images from your local file system. The file handling the actual uploads contains a number of bugs. The combination of these bugs allows unauthenticated user to upload PHP-executable files to arbitrary locations. A script exploiting this vulnerability has been published. A succesful exploit requires the webserver to be configured in such a way that it either ignores the .htaccess in the files directory or is able to write to certain web-accessible directories that do not have this .htaccess protection. The module also contains other vulnerabilities such as Cross site scripting (XSS), SQL-injection, Access bypass and Cross site request forgery (CSRF). Though less severe, these vulnerabilities can also be used to get administrator level access to the site. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Drag & Drop Gallery 6.x versions Drupal core is not affected. If you do not use the contributed Drag & Drop Gallery [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ There is no version of the module that fixes these vulnerabilites. Disable *and remove* the module from your system. Important note: Most vulnerabilities can still be exploited when the module is disabled. Please join the issue in the public queue [4] to fix the problems. Also see the Drag & Drop Gallery [5] project page. -------- REPORTED BY --------------------------------------------------------- The vulnerability was publicly disclosed. An exploit exists. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [6]. Learn more about the Drupal Security team and their policies [7], writing secure code for Drupal [8], and securing your site [9]. [1] http://drupal.org/project/dragdrop_gallery [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/dragdrop_gallery [4] http://drupal.org/node/1679444 [5] http://drupal.org/project/dragdrop_gallery [6] http://drupal.org/contact [7] http://drupal.org/security-team [8] http://drupal.org/writing-secure-code [9] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-107 - Search autocomplete - Access bypass
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679422 * Advisory ID: SA-CONTRIB-2012-107 * Project: Search Autocomplete [1] (third-party module) * Version: 7.x * Date: 2012-July-11 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module allows you to add autocomplete functionality to virtually any fields of a Drupal site. The module doesn't sufficiently protect access to the module admin page. This vulnerability is mitigated by the fact that the user can only access the page, disable an autocompletion or change priority order. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Search Autocomplete 7.x-2.x versions prior to 7.x-2.4. Drupal core is not affected. If you do not use the contributed Search Autocomplete [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Search Autocomplete module for Drupal 6.x, upgrade to Search Autocomplete 7.x-2.4 [4] Also see the Search Autocomplete [5] project page. -------- REPORTED BY --------------------------------------------------------- * Reuben Turk [6] (nick: rooby) -------- FIXED BY ------------------------------------------------------------ * Reuben Turk [7] the module maintainer * Dominique CLAUSE [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team * Chris Hales [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/search_autocomplete [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/search_autocomplete [4] http://drupal.org/node/1649442 [5] http://drupal.org/project/search_autocomplete [6] http://drupal.org/user/10164 [7] http://drupal.org/user/10164 [8] http://drupal.org/user/801982 [9] http://drupal.org/user/36762 [10] http://drupal.org/user/347249 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-106 - Listhandler - Access Bypass
by security-news＠drupal.org 11 Jul '12

11 Jul '12

View online: http://drupal.org/node/1679412 * Advisory ID: DRUPAL-SA-CONTRIB-2012-106 * Project: Listhandler [1] (third-party module) * Version: 6.x * Date: 2012-July-11 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Listhandler is a module that marries mailing list discussions and Drupal forums. The module doesn't sufficiently check the permissions of comment authors when importing emails. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * All Listhandler 6.x-1.x versions. Drupal core is not affected. If you do not use the contributed Listhandler [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the module. There is no fixed version. Also see the Listhandler [4] project page. -------- REPORTED BY --------------------------------------------------------- * Brian Swaney [5] -------- FIXED BY ------------------------------------------------------------ No release nor support for the advisory process was provided by the maintainer. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [6]. Learn more about the Drupal Security team and their policies [7], writing secure code for Drupal [8], and securing your site [9]. [1] http://drupal.org/project/listhandler [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/listhandler [4] http://drupal.org/project/listhandler [5] http://drupal.org/user/608968 [6] http://drupal.org/contact [7] http://drupal.org/security-team [8] http://drupal.org/writing-secure-code [9] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-105 - Hashcash - Cross Site Scripting (XSS)
by security-news＠drupal.org 27 Jun '12

27 Jun '12

View online: http://drupal.org/node/1663306 * Advisory ID: DRUPAL-SA-CONTRIB-2012-105 * Project: Hashcash [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-June-27 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Hashcash project is an implementation of a Proof Of Work (POW) or Puzzle scheme where users of a service have to do computational work to have their request granted. In the case of the Drupal Hashcash project, the service is 'form submission' and the Proof Of Work is a token that causes a partial hash collision when concatenated with a given string. This is intended to stop spam submissions to a site. .... Cross Site Scripting When an invalid token is received and the setting "Log failed hashcash" is enabled, the invalid token is written to watchdog with incorrect placeholders. This enables an attacker to insert arbitrary scripts into certain pages displayed to administrators via the core module Database logging. Mitigation: The setting "Log failed hashcash" is disabled by default. .... Insufficient proof of work The Hashcash project also fails as a proper proof of work scheme: * 1 in 256 random answers will be accepted as the correct answer. * The discrepancy in resources between a legitimate user using the Javascript hash implementation and an optimal attacker using a GPGPU implementation makes the cost of calculating a Hashcash token negligible for the attacker. The protection against spambots offered by the Drupal Hashcash project hinges on the lack of interest on behalf of an attacker. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Hashcash 6.x-2.x versions prior to 6.x-2.6 * Hashcash 7.x-2.x versions prior to 7.x-2.2 Drupal core is not affected. If you do not use the contributed Hashcash [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ To solve the cross site scripting issue, install the latest version: * If you use the Hashcash module for Drupal 6.x, upgrade to Hashcash 6.x-2.6 [4] * If you use the Hashcash module for Drupal 7.x, upgrade to Hashcash 7.x-2.2 [5] There is no solution for the insufficient proof of work. You need to consider the consequences of this for your sites. Also see the Hashcash [6] project page. -------- REPORTED BY --------------------------------------------------------- * Heine Deelstra [7] -------- FIXED BY ------------------------------------------------------------ * Simon Rycroft [8], the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/hashcash [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/hashcash [4] http://drupal.org/node/1650784 [5] http://drupal.org/node/1650790 [6] http://drupal.org/project/hashcash [7] http://drupal.org/user/17943 [8] http://drupal.org/user/151544 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-104 - Privatemsg - Cross Site Scripting (XSS)
by security-news＠drupal.org 20 Jun '12

20 Jun '12

View online: http://drupal.org/node/1649346 * Advisory ID: DRUPAL-SA-CONTRIB-2012-104 * Project: Privatemsg [1] (third-party module) * Version: 7.x * Date: 2012-June-20 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Privatemsg module allows users to send private messages between to each other. The module doesn't sufficiently sanitize user names when creating messages. This vulnerability is mitigated by the fact that it is not possible to create insecure user names through the default user interface. The exploit is only possible in combination with another module that allows this, such as Realname [3] which allows site-builders to choose fields to display an alternative username. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Privatemsg 7.x-1.x versions prior to 7.x-1.3 Drupal core is not affected. If you do not use the contributed Privatemsg [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Privatemsg module for Drupal 7, upgrade to Privatemsg 7.x-1.3 [5] Also see the Privatemsg [6] project page. -------- REPORTED BY --------------------------------------------------------- * Dave Reid [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Sascha Grossenbacher [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Dave Reid [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team * Michael Hess [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/privatemsg [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/realname [4] http://drupal.org/project/privatemsg [5] http://drupal.org/node/1649338 [6] http://drupal.org/project/privatemsg [7] http://drupal.org/user/53892 [8] http://drupal.org/user/214652 [9] http://drupal.org/user/53892 [10] http://drupal.org/user/36762 [11] http://drupal.org/user/102818 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0