Security-news

security-news@drupal.org

1 participants
1782 discussions

SA-CONTRIB-2010-111 - Views - Cross Site Scripting
by security-news＠drupal.org 15 Dec '10

15 Dec '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-111 * Project: Views (third-party module) * Version: 6.x * Date: 2010-December-15 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- The Views module provides a flexible method for Drupal site designers to control how lists and tables of content are presented. Under certain circumstances, Views could display parts of the page path without escaping, resulting in a relected Cross Site Scripting (XSS [1]) vulnerability. An attacker could exploit this to gain full administrative access. *Mitigating factors:* This vulnerability only occurs with a specific combination of configuration options for a specific View, but this combination is used in the default Views provided by some additional modules. A malicious user would need to get an authenticated administrative user to visit a specially crafted URL. -------- VERSIONS AFFECTED --------------------------------------------------- * Views module for Drupal 6.x versions prior to 6.x-2.12 Drupal core is not affected. If you do not use the contributed Views [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Views module for Drupal 6.x upgrade to Views 6.x-2.12 [3] See also the Views project page [4]. -------- REPORTED BY --------------------------------------------------------- * Alexander Kirienko [5] -------- FIXED BY ------------------------------------------------------------ * Earl Miles (merlinofchaos [6]), module maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [7] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/views [3] http://drupal.org/node/999386 [4] http://drupal.org/project/views [5] http://drupal.org/user/1019216 [6] http://drupal.org/user/26979 [7] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-110 - Drupal For Firebug - Cross-site Request Forgery
by security-news＠drupal.org 15 Dec '10

15 Dec '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-110 * Project: Drupal For Firebug (third-party module) * Version: 5.x, 6.x * Date: 2010-Dec-15 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Cross-site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Drupal For Firebug module allows developers to use Firebug to get debugging information about their Drupal installation. The module does not properly protect the form used to submit PHP code against Cross-site Request Forgeries (CSRF [1]), allowing a malicious user to trick an authorized user into executing arbitrary PHP code. -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal For Firebug 5.x versions prior to 5.x-1.5 * Drupal For Firebug 6.x versions prior to 6.x-1.4 Drupal core is not affected. If you do not use the contributed Drupal For Firebug [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Drupal For Firebug 5.x, upgrade to Drupal For Firebug 5.x-1.5 [3] * If you use Drupal For Firebug 6.x, upgrade to Drupal For Firebug 6.x-1.4 [4] See also the Drupal For Firebug project page [5]. -------- REPORTED BY --------------------------------------------------------- * mr.baileys [6] of the Drupal security team -------- FIXED BY ------------------------------------------------------------ * Matt Cheney (populist [7]), module maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact [8]. [1] http://en.wikipedia.org/wiki/Cross-site_request_forgery [2] http://drupal.org/project/drupalforfirebug [3] http://drupal.org/node/998568 [4] http://drupal.org/node/998566 [5] http://drupal.org/project/drupalforfirebug [6] http://drupal.org/user/383424 [7] http://drupal.org/user/58600 [8] http://drupal.org/contact

1 0

SA-CONTRIB-2010-109 - Embedded Media Field, Media: Video Flotsam, Media: Audio Flotsam - Multiple Vulnerabilities
by security-news＠drupal.org 08 Dec '10

08 Dec '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-109 * Projects: Embedded Media Field, Media: Video Flotsam, Media: Audio Flotsam (third-party module) * Version: 5.x and 6.x * Date: 2010-December-08 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- .... 1 - Arbitrary File Upload/Code Execution Vulnerability The Embedded Thumbnail module (packaged with the project) allows users who upload videos to upload their own thumbnails to replace The Drupal Embedded Media Field module. Unfortunately, the Embedded Thumbnail Module contains a vulnerability that could allow arbitrary file upload, as well as potentially remote and potentially code execution. Malicious users can upload arbitrary files with extensions other than .php, .pl, .py, .cgi, .asp, or .js. Many web servers support legacy PHP extensions not included in this list (such as .phtml, or .php3) which would allow attackers to upload and execute arbitrary PHP code. Attackers could also upload malicious documents or other material with virus payload and use these to attack other users or exploit flaws in file include vulnerabilities. This exploit is mitigated by the fact that the site must have a content type with an embedded media field that allows users to upload custom thumbnails, and the user must have access to create or edit the content type. .... 2 - Embed XSS Vulnerability The 5.x-1.x and 6.x-1.x versions of the Embedded Media Field module comes packaged with "custom provider files" that allow users to add audio and video files to their site by posting a link to the direct url of an audio or video the field emfield provides. Unfortunately the Embedded Media Field module contains an arbitrary HTML injection vulnerability (also known as cross site scripting, or XSS) due to the fact that it fails to sanitize user supplied audio file paths and embed codes before display. *Please note*, recently these 6.x-2.x branch of the Embedded Media Field module, the custom audio and video provider files were moved to separate modules: Media: Video Flotsam 6.x-1.2 [1] and Media: Audio Flotsam [2]. This exploit is mitigated by the fact that the site must have a content type with an embedded media field that has the custom audio or video provider file enabled, and the user must have access to create or edit the content type. -------- VERSIONS AFFECTED --------------------------------------------------- * Embedded Media Field module for Drupal 6.x versions prior to 6.x-1.26 and 6.x-2.4, and for Drupal 5.x versions prior to 5.x-1.12. * Media: Video Flotsam module for Drupal 6.x versions prior to 6.x-1.2. * Media: Audio Flotsam module for Drupal 6.x versions prior to 6.x-1.1. Drupal core is not affected. If you do not use the contributed Embedded Media Field [3] module, together with the Embedded Thumbnail Field module or the custom audio and video provider files included in emfield as well as in Media: Audio Flotsam [4] and/or Media: Video Flotsam [5], there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Embedded Media Field module for Drupal 6.x upgrade to either Embedded Media Field 6.x-2.4 [6] or Embedded Media Field 6.x-1.26 [7]. * If you use the Embedded Media Field module for Drupal 5.x upgrade to Embedded Media Field 5.x-1.12 [8]. * If you use the Media: Video Flotsam module upgrade to Media: Video Flotsam 6.x-1.2 [9] * If you use the Media: Audio Flotsam module upgrade to Media: Audio Flotsam 6.x-1.1 [10] -------- REPORTED BY --------------------------------------------------------- * Stella Power (stella) [11], of the Drupal security team -------- FIXED BY ------------------------------------------------------------ * Stella Power (stella) [12] * Matthew Klein (kleinmp) [13], module co-maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [14] can be reached at security at drupal.org or via the form at http://drupal.org/contact [15]. [1] http://drupal.org/project/media_video_flotsam [2] http://drupal.org/project/media_audio_flotsam [3] http://drupal.org/project/emfield [4] http://drupal.org/project/media_audio_flotsam [5] http://drupal.org/project/media_video_flotsam [6] http://drupal.org/node/992912 [7] http://drupal.org/node/992910 [8] http://drupal.org/node/992906 [9] http://drupal.org/node/992918 [10] http://drupal.org/node/992916 [11] http://drupal.org/user/66894 [12] http://drupal.org/user/66894 [13] http://drupal.org/user/390447 [14] http://drupal.org/security-team [15] http://drupal.org/contact

1 0

SA-CONTRIB-2010-108 - Who Bought What|Ubercart - Multiple Vulnerabilities
by security-news＠drupal.org 08 Dec '10

08 Dec '10

* DRUPAL-SA-CONTRIB-2010-108 * Who Bought What|Ubercart (third-party module) * Version: 6.x * Date: 2010-Dec-08 * Security risk: Highly Critical * Exploitable from: Remote * Vulnerability: Multiple Vulnerabilities -------- DESCRIPTION --------------------------------------------------------- The Who Bought What-module collects and displays relevant information about purchases, including purchaser name, quantity, payment status, and all attributes. The module does not properly sanitize arguments passed via the URL when used in SQL queries, leading to a SQL Injection [1] vulnerability. Additionally, the module neglects to sanitize some of the user-generated content before displaying it, leading to a Cross-Site Scripting (XSS [2]) vulnerability. Finally, the module allows users with the "view uc_who_bought_what" permission to view the title of any node in the system, including unpublished nodes and nodes that user might otherwise not have access to, which constitutes an Information Disclosure vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Who Bought What|Ubercart module for Drupal 6.x versions prior to 6.x-2.11. Drupal core is not affected. If you do not use the contributed Who Bought What|Ubercart module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Who Bought What|Ubercart module for Drupal 6.x upgrade to Who Bought What|Ubercart 6.x-2.11 [3] See also the Who Bought What|Ubercart project page [4]. -------- REPORTED BY --------------------------------------------------------- * The SQL Injection vulnerability was reported by Mark Styles (lambic [5]) * The XSS and Information Disclosure vulnerabilities were reported by mr.baileys [6] of the Drupal.org Security Team -------- FIXED BY ------------------------------------------------------------ * Michael Moradzadeh (Cayenne [7]), module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [8]. [1] http://en.wikipedia.org/wiki/SQL_Injection [2] http://en.wikipedia.org/wiki/Cross-site_scripting [3] http://drupal.org/node/991762 [4] http://drupal.org/project/uc_who_bought_what [5] http://drupal.org/user/58843 [6] http://drupal.org/user/383424 [7] http://drupal.org/user/92993 [8] http://drupal.org/contact

1 0

SA-CONTRIB-2010-107 - Services - Access bypass
by security-news＠drupal.org 02 Dec '10

02 Dec '10

* DRUPAL-SA-CONTRIB-2010-107 * Services (third-party module) * Version: 6.x * Date: 2010-Dec-01 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- The Services module allows users to expose Drupal functionality to remote users. Services provides the ability for users to update nodes contained in a drupal install via the services api. When using using the node.save service it is possible for a user to supply a specifically crafted node or format type and circumvent access control checks. This only affects sites that are using the node.save service. -------- VERSIONS AFFECTED --------------------------------------------------- * Services module for Drupal 6.x versions prior to 6.x-2.3. * Drupal core is not affected. If you do not use the contributed Services module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Services module for Drupal 6.x upgrade to Services 6.x-2.3 [1] -------- REPORTED BY --------------------------------------------------------- * Yonathan Offek [2] -------- FIXED BY ------------------------------------------------------------ * Marc Ingram [3], module co-maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [4]. [1] http://drupal.org/node/986550 [2] http://drupal.org/user/194009 [3] http://drupal.org/user/77320 [4] http://drupal.org/contact

1 0

SA-CONTRIB-2010-106 - Comment Edited - Cross Site Scripting
by security-news＠drupal.org 01 Dec '10

01 Dec '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-106 * Project: Comment Edited (third-party module) * Version: 6.x * Date: 2010-Dec-01 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Comment Edited module displays a customizable message at the bottom of a comment when it has been edited. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability that may lead to a malicious user gaining full administrative access. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer comments' permission which should generally only be granted to trusted roles. -------- VERSIONS AFFECTED --------------------------------------------------- * Comment Edited module for Drupal 6.x versions prior to 6.x-1.4 Drupal core is not affected. If you do not use the contributed Comment Edited [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Comment Edited module for Drupal 6.x upgrade to Comment Edited 6.x-1.4 [3] See also the Comment Edited project page [4]. -------- REPORTED BY --------------------------------------------------------- * Balazs Dianiska (snufkin) [5], module maintainer -------- FIXED BY ------------------------------------------------------------ * Balazs Dianiska (snufkin) [6], module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact. Learn more about the team and their policies [7], writing secure code for Drupal [8], and Secure Configuration [9] of your site. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/comment_edited [3] http://drupal.org/node/986524 [4] http://drupal.org/project/comment_edited [5] http://drupal.org/user/58645 [6] http://drupal.org/user/58645 [7] http://drupal.org/security-team [8] http://drupal.org/writing-secure-code [9] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2010-105 - Outline Designer - Cross Site Request Forgery
by security-news＠drupal.org 01 Dec '10

01 Dec '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-105 * Project: Outline Designer (third-party module) * Version: 6.x * Date: 2010-December-01 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross-site Request Forgery -------- DESCRIPTION --------------------------------------------------------- Outline Designer allows for easier creation and management of items in a Book. The Outline Designer modules does not properly protect some of its paths against Cross Site Request Forgeries (CSRF), allowing an attacker to get a user with the permission to administer site configuration to change any book nodes. -------- VERSIONS AFFECTED --------------------------------------------------- * Outline Designer for Drupal 6.x prior to Outline Designer 6.x-1.2 Drupal core is not affected. If you do not use the contributed module Outline Designer there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Outline Designer for Drupal 6.x upgrade to Outline Designer 6.x-1.2 [1] See also the Outline Designer [2] project page. -------- REPORTED BY --------------------------------------------------------- * Bryan Ollendyke (btopro [3]), module maintainer -------- FIXED BY ------------------------------------------------------------ * Bryan Ollendyke (btopro [4]), module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact. Learn more about the team and their policies [5], writing secure code for Drupal [6], and secure configuration [7] of your site. [1] http://drupal.org/node/954666 [2] http://drupal.org/project/outline_designer [3] http://drupal.org/user/24286 [4] http://drupal.org/user/24286 [5] http://drupal.org/security-team [6] http://drupal.org/writing-secure-code [7] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2010-104 - Relevant Content - Information Disclosure
by security-news＠drupal.org 18 Nov '10

18 Nov '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-104 * Project: Relevant Content (third-party module) * Version: 5.x, 6.x * Date: 2010-November-17 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- The Relevant Content module provides a block and CCK field which contain links to other nodes on the site which are considered "relevant" to the current nodes based on number of shared taxonomy terms. The Relevant Content module does not implement node access logic properly, resulting in the disclosure of node titles and relationships between nodes that the user cannot normally access. -------- VERSIONS AFFECTED --------------------------------------------------- * Relevant Content module for Drupal 5.x versions prior to 5.x-1.4 * Relevant Content module for Drupal 6.x versions prior to 6.x-1.5 Drupal core is not affected. If you do not use the contributed Relevant Content [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Relevant Content module for Drupal 5.x upgrade to Relevant Content 5.x-1.4 [2] * If you use the Relevant Content module for Drupal 6.x upgrade to Relevant Content 6.x-1.5 [3] See also the Relevant Content project page [4]. -------- REPORTED BY --------------------------------------------------------- * Szymon Nitka [5] -------- FIXED BY ------------------------------------------------------------ * Nicholas Thompson [6], module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact. Learn more about the team and their policies [7], writing secure code for Drupal [8], and secure configuration [9] of your site. [1] http://drupal.org/project/relevant_content [2] http://drupal.org/node/974672 [3] http://drupal.org/node/974668 [4] http://drupal.org/project/relevant_content [5] http://drupal.org/user/171725 [6] http://drupal.org/user/59351 [7] http://drupal.org/security-team [8] http://drupal.org/writing-secure-code [9] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2010-103 - Node Relativity - Multiple vulnerabilities
by security-news＠drupal.org 11 Nov '10

11 Nov '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-103 * Project: Node Relativity (third-party module) * Version: 5.x, 6.x * Date: 2010-November-10 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Cross-Site Scripting, Cross Site Request Forgery, Access bypass -------- DESCRIPTION --------------------------------------------------------- The Node Relativity module allows parent-child relationships between nodes to be established, managed and searched. The Node Relativity module does not sanitize some of the user supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability which can be used by a malicious user to gain full administrative access. The Node Relativity module does not protect the links to establish relations between nodes against Cross-site Request Forgeries (CSRF [2]) vulnerability which can be used by a malicious user to directly perform operations on the database. The Node Relativity module does not implement node access logic properly, resulting in the display of node titles and the establishing of relations between nodes the user has no access to. -------- VERSIONS AFFECTED --------------------------------------------------- * Node Relativity module for Drupal 5.x versions prior to 5.x-2.6 * Node Relativity module for Drupal 6.x versions prior to 6.x-1.4 Drupal core is not affected. If you do not use the contributed Node Relativity [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Node Relativity module for Drupal 5.x upgrade to Node Relativity 5.x-2.6 [4] * If you use the Node Relativity module for Drupal 6.x upgrade to Node Relativity 6.x-1.4 [5] See also the Node Relativity project page [6]. -------- REPORTED BY --------------------------------------------------------- * recrit [7] * catch [8] of the Drupal security team -------- FIXED BY ------------------------------------------------------------ * Jonathan Araña Cruz [9], module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact. Learn more about the team and their policies [10], writing secure code for Drupal [11], and Secure Configuration [12] of your site. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://en.wikipedia.org/wiki/Csrf [3] http://drupal.org/project/relativity [4] http://drupal.org/node/968516 [5] http://drupal.org/node/968514 [6] http://drupal.org/project/relativity [7] http://drupal.org/user/452914 [8] http://drupal.org/user/35733 [9] http://drupal.org/user/49817 [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2010-102 - Category tokens - Cross Site Scripting
by security-news＠drupal.org 10 Nov '10

10 Nov '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-102 * Project: Category tokens (third-party module) * Version: 6.x * Date: 2010-November-10 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Cross-Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Category tokens module exposes additional tokens for the first and last terms related to a node for each vocabulary. The module does not sanitize the vocabulary names when displayed in token help, leading to a Cross-Site Scripting (XSS [1]) vulnerability that may lead to a malicious user gaining full administrative access. This vulnerability is mitigated by the fact that user must have the "administer taxonomy" permission in order to create and edit vocabularies and enter the XSS. -------- VERSIONS AFFECTED --------------------------------------------------- * Category tokens module for Drupal 6.x versions prior to 6.x-1.1. Drupal core is not affected. If you do not use the contributed Category tokens [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Category tokens module for Drupal 6.x upgrade to Category tokens 6.x-1.1 [3] See also the Category tokens project page [4]. -------- REPORTED BY --------------------------------------------------------- * Dave Reid [5], Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Dave Reid [6], Drupal Security Team * scheepers de bruin [7], module maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [8] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/category_tokens [3] http://drupal.org/node/939848 [4] http://drupal.org/project/category_tokens [5] http://drupal.org/user/53892 [6] http://drupal.org/user/53892 [7] http://drupal.org/user/162354 [8] http://drupal.org/security-team

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news