- Security-news - lists.drupal.org

SA-CONTRIB-2011-036 - Addresses - Cross Site Scripting
by security-news＠drupal.org 17 Aug '11

17 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-036 * Project: Addresses [1] (third-party module) * Version: 6.x * Date: 2011-August-17 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to link your users and contents to physical addresses. The module doesn't sufficiently filter output when displaying an address. This vulnerability is mitigated by the fact that the module doesn't use the single line display by default, an administrator has to enable that feature first. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions prior to 6.x-1.10 Drupal core is not affected. If you do not use the contributed Addresses [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the addresses module for Drupal 6.x, upgrade to 6.x-1.11 [4] See also the Addresses [5] project page. -------- REPORTED BY --------------------------------------------------------- * David Kinzer [6] -------- FIXED BY ------------------------------------------------------------ * David Kinzer [7] * Alexis Wilke [8] the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/addresses [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/addresses [4] http://drupal.org/node/1251508 [5] http://drupal.org/project/addresses [6] http://drupal.org/user/619296 [7] http://drupal.org/user/619296 [8] http://drupal.org/user/356197 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-035 Forward module - Open redirect
by security-news＠drupal.org 17 Aug '11

17 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-035 * Project: Forward [1] (third-party module) * Version: 6.x, 7.x * Date: 2011-August-17 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Open redirect -------- DESCRIPTION --------------------------------------------------------- The Forward module enables you to add a "forward this page" link to each node. The link takes regular site visitors to a form where they can generate an email to a friend. The module doesn't check to ensure that the page being forwarded refers to an internal path. This could allow someone to hard code a forward link to an unscrupulous external site. This vulnerability is mitigated by the fact that an attacker must have a role that enables them to post content to the site that contains embedded links. -------- VERSIONS AFFECTED --------------------------------------------------- * Forward 6.x-1.x versions prior to 6.x-1.20. * Forward 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed Forward [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Forward module for Drupal 6.x, upgrade to Forward 6.x-1.20 [4] * If you use the Forward module for Drupal 7.x, upgrade to Forward 7.x-1.1 [5] See also the Forward [6] project page. -------- REPORTED BY --------------------------------------------------------- * Christian Schmidt [7] of Berlingske Media -------- FIXED BY ------------------------------------------------------------ * John Oltman [8] the module maintainer * Christian Schmidt [9] of Berlingske Media -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/forward [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/forward [4] http://drupal.org/node/1252132 [5] http://drupal.org/node/1252118 [6] http://drupal.org/project/forward [7] http://drupal.org/user/216078 [8] http://drupal.org/user/699926 [9] http://drupal.org/user/216078 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-033 - iWebkit - Cross Site Scripting
by security-news＠drupal.org 03 Aug '11

03 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-033 * Project: iWebkit [1] (third-party module) * Version: 6.x * Date: 2011-August-03 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- iWebKit is a web toolkit designed to create iPhone and iPod touch compatible websites and webapps. iWebkit does not properly sanitize menu links when displayed, allowing a malicious user to embed scripts in menu items, thus creating a cross site scripting (XSS [3]) vulnerability that may lead to an unauthorized user gaining full administrative access. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer menu" permission. -------- VERSIONS AFFECTED --------------------------------------------------- * iWebkit theme 6.x-2.x versions prior to 6.x-2.2. Drupal core is not affected. If you do not use the contributed iWebkit [4] theme, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the iWebkit [5] theme for Drupal 6.x, upgrade to iWebkit 6.x-2.2 [6]. See also the iWebkit [7] project page. -------- REPORTED BY --------------------------------------------------------- * Thomas Turnbull (tom_o_t [8]) -------- FIXED BY ------------------------------------------------------------ * Sumit Kataria (sumitk [9]), the theme maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/iwebkit [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/project/iwebkit [5] http://drupal.org/project/iwebkit [6] http://drupal.org/node/1236722 [7] http://drupal.org/project/iwebkit [8] http://drupal.org/user/125573 [9] http://drupal.org/user/267786 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-034 - Display Suite - Cross Site Scripting
by security-news＠drupal.org 03 Aug '11

03 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-034 * Project: Display suite [1] (third-party module) * Version: 7.x * Date: 2011-August-03 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Display Suite allows you to take full control over how your content is displayed using a drag and drop interface. Arrange your nodes, views, comments, user data etc. the way you want without having to work your way through dozens of template files. In certain situations, Display Suite does not properly sanitize user-supplied data, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting (XSS [3]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Display Suite 7.x-1.x versions prior to 7.x-1.3. Drupal core is not affected. If you do not use the contributed Display Suite [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Display Suite module for Drupal 7.x upgrade to Display Suite 7.x-1.3 [5]. See also the Display Suite [6] project page. -------- REPORTED BY --------------------------------------------------------- * Rolf van de Krol [7] * Kristof De Jaeger (swentel [8]) -------- FIXED BY ------------------------------------------------------------ * Rolf van de Krol [9] * Kristof De Jaeger (swentel [10]) -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/ds [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/project/ds [5] http://drupal.org/node/1238544 [6] http://drupal.org/project/ds [7] http://drupal.org/user/70412 [8] http://drupal.org/user/107403 [9] http://drupal.org/user/70412 [10] http://drupal.org/user/107403 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-032 - Mail Logger - Cross Site Scripting
by security-news＠drupal.org 03 Aug '11

03 Aug '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-032 * Project: Mail Logger [1] (third-party module) * Version: 6.x * Date: 2011-August-03 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Mail Logger module logs all outgoing e-mails and provides users with the "access mail logger" permission to view logged e-mails. The module does not sanitize the log output of addressee information, subject, and body, leading to a Cross-Site Scripting (XSS [3]) vulnerability that may lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Mail Logger module 6.x-1.x versions prior to 6.x-1.1 Drupal core is not affected. If you do not use the contributed Mail Logger [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * Upgrade to Mail Logger 6.x-1.1 [5] See also the Mail Logger [6] project page. -------- REPORTED BY --------------------------------------------------------- * Ivo Van Geertruyen [7] * Daniel G. Siegel [8] -------- FIXED BY ------------------------------------------------------------ * Oleg Terenchuk [9], module maintainer * David Norman [10], module co-maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/mail_logger [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/project/mail_logger [5] http://drupal.org/node/1238286 [6] http://drupal.org/project/mail_logger [7] http://drupal.org/user/383424 [8] http://drupal.org/user/253160 [9] http://drupal.org/user/78134 [10] http://drupal.org/user/972 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CORE-2011-003 - Drupal core - Access bypass
by security-news＠drupal.org 27 Jul '11

27 Jul '11

* Advisory ID: DRUPAL-SA-CORE-2011-003 * Project: Drupal core [1] * Version: 7.x * Date: 2011-July-27 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- .... Access bypass in private file fields on comments. Drupal 7 contains two new features: the ability to attach File upload fields to any entity type in the system and the ability to point individual File upload fields to the private file directory. If a Drupal site is using these features on comments, and the parent node is denied access (either by a node access module or by being unpublished), the file attached to the comment can still be downloaded by non-privileged users if they know or guess its direct URL. This issue affects Drupal 7.x only. -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal 7.x before version 7.5. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you are running Drupal 7.x then upgrade to Drupal 7.5 or 7.6. The Security Team has released both a pure security update without other bug fixes and a security update combined with other bug fixes and improvements. You can choose to either only include the security update for an immediate fix (which might require less quality assurance and testing) or more fixes and improvements alongside the security fixes by choosing between Drupal 7.5 and Drupal 7.6. Read the announcement [3] for more information. See also the Drupal core [4] project page. -------- REPORTED BY --------------------------------------------------------- * The File access bypass was reported by Florian Weber [5]. -------- FIXED BY ------------------------------------------------------------ * The File access bypass was fixed by Stéphane Corlosquet [6] and Károly Négyesi [7], both members of the Drupal security team. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/drupal [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/drupal-7.6 [4] http://drupal.org/project/drupal [5] http://drupal.org/user/254778 [6] http://drupal.org/user/52142 [7] http://drupal.org/user/9446 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-031 - SunMailer - Access bypass
by security-news＠drupal.org 20 Jul '11

20 Jul '11

* Advisory ID: SA-CONTRIB-2011-31 * Project: SunMailer Newsletter [1] (third-party module) * Version: 6.x * Date: 2011-July-20 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- SunMailer Newsletter creates an email newsletter that users can subscribe to. The module includes a page where authenticated users can view and/or edit their newsletter subscription. Access to this page was accidentally granted to anonymous users, creating an access bypass that disclosed all user's newsletter subscription to anonymous users and also allowed anonymous users to tamper with the newsletter subscription. This vulnerability is mitigated by the fact that it does not disclose the email address of the subscriber. The exploit is also accessible only by directly accessing the URL leading to the user's subscription page; no link to the vulnerable page is shown in the user interface. -------- VERSIONS AFFECTED --------------------------------------------------- * 6.x-1.6 or prior versions Drupal core is not affected. If you do not use the contributed SunMailer Newsletter [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the SunMailer Newsletter module for Drupal 6.x, upgrade to version 6.x-1.7 [4] See also the SunMailer Newsletter [5] project page. -------- REPORTED BY --------------------------------------------------------- * Mike Wacker [6] the module maintainer -------- FIXED BY ------------------------------------------------------------ * Mike Wacker [7] the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/sunmailer [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/sunmailer [4] http://drupal.org/node/1199658 [5] http://drupal.org/project/sunmailer [6] http://drupal.org/user/79520 [7] http://drupal.org/user/79520 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-030 - Devel - Cross Site Request Forgery
by security-news＠drupal.org 20 Jul '11

20 Jul '11

* Advisory ID: SA-CONTRIB-2011-030 * Project: Devel [1] (third-party module) * Version: 6.x, 7.x * Date: 2011-July-20 * Security risk: Not critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The devel module is designed as a tool to accelerate Drupal software development. One of its features enables a highly permissioned developer to quickly switch to another user's account, without providing credentials. The module is vulnerable to Cross Site Request Forgeries (CSRF) via the links and form in the Switch User block. -------- VERSIONS AFFECTED --------------------------------------------------- * 6.x-1.24 and prior * 7.x-1.0 and prior Note: prior versions are no longer maintained by the security team. Drupal core is not affected. If you do not use the contributed Devel module, there is nothing you need to do. Drupal core is not affected. If you do not use the contributed Devel [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Devel module for Drupal 7.x upgrade to Devel 7.x-1.1 [4] * If you use the Devel module for Drupal 6.x upgrade to Devel 6.x-1.25 [5] See also the Devel project page [6]. See also the Devel [7] project page. -------- REPORTED BY --------------------------------------------------------- The vulnerability was reported independently by: * Dylan Wilder-Tack (grendzy) [8] of the Drupal Security Team * Andrew Berry (deviantintegral) [9] -------- FIXED BY ------------------------------------------------------------ * Hans Salvisberg (salvis [10]) the module co-maintainer. * Moshe Weitzman [11] module maintainer and member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/devel [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/devel [4] http://drupal.org/node/1224846 [5] http://drupal.org/node/1224842 [6] http://drupal.org/project/devel [7] http://drupal.org/project/devel [8] http://drupal.org/user/96647 [9] http://drupal.org/user/71291 [10] http://drupal.org/user/82964 [11] http://drupal.org/user/23 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-029 - Taxonomy Filter - Cross Site Scripting
by security-news＠drupal.org 20 Jul '11

20 Jul '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-029 * Project: Taxonomy Filter [1] (third-party module) * Version: 6.x, 7.x * Date: 2011-July-20 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Taxonomy Filter module enables users to filter taxonomy listings to find content tagged by multiple terms. Older versions of the module were susceptible to a Cross Site Scripting (XSS) attack by way of vocabulary names. The vulnerability was mitigated by the fact that an attacker must have a role with the "administer taxonomy" permission. The 6.x-1.6 release of Taxonomy Filter also corrects an XSS issue in Taxonomy Filter menu names that requires the "administer site configuration" permission. Vulnerabilities that require the "administer site configuration" permission to exploit [3] do not necessitate Security Advisories, however no Advisory had been issued for previous insecure releases. -------- VERSIONS AFFECTED --------------------------------------------------- * 6.x-1.3 and earlier * 7.x-1.x-dev Drupal core is not affected. If you do not use the contributed Taxonomy Filter [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Taxonomy Filter module for Drupal 6.x upgrade to 6.x-1.6 [5] * If you use the Taxonomy Filter module for Drupal 7.x upgrade to the latest 7.x-1.x-dev [6] release See also the Taxonomy Filter [7] project page. -------- REPORTED BY --------------------------------------------------------- * Sam Oldak -------- FIXED BY ------------------------------------------------------------ * Jim Berry [8] the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/taxonomy_filter [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/security-advisory-policy [4] http://drupal.org/project/taxonomy_filter [5] http://drupal.org/node/1223666 [6] http://drupal.org/node/96252 [7] http://drupal.org/project/taxonomy_filter [8] http://drupal.org/user/240748 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-028 - Simple Clean - Cross Site Scripting
by security-news＠drupal.org 06 Jul '11

06 Jul '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-028 * Project: Simple Clean [1] (third-party module) * Version: 7.x * Date: 2011-July-06 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Simple Clean is a simple and stripped clean theme for Drupal. The theme contains a cross site scripting (XSS) vulnerability that can be exploited when posting comments. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "post comments". -------- VERSIONS AFFECTED --------------------------------------------------- * 7.x-1.2 and prior Drupal core is not affected. If you do not use the contributed Simple Clean [3] theme, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Simple Clean theme for Drupal 7.x upgrade to Simple Clean 7.x-1.3 [4] See also the Simple Clean [5] project page. -------- REPORTED BY --------------------------------------------------------- * Ben Jeavons [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Mattias Axelsson [7] the project maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/simpleclean [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/simpleclean [4] http://drupal.org/node/1210954 [5] http://drupal.org/project/simpleclean [6] http://drupal.org/user/91990 [7] http://drupal.org/user/765764 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0