Security-news

security-news@drupal.org

1 participants
1782 discussions

SA-CONTRIB-2010-044: Bibliography - Cross Site Scripting
by security-news＠drupal.org 12 May '10

12 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-044 * Project: Bibliography (third-party module) * Version: 5.x, 6.x * Date: 2010-May-12 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Bibliography module enables users to manage and display lists of scholarly publications. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability. This is mitigated by the fact that only users with the 'administer biblio' permission are able to exploit this vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Bibliography module 5.x-1.17 and prior versions * Bibliography module 6.x-1.9 and prior versions Drupal core is not affected. If you do not use the contributed Bibliography [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Bibliography for Drupal 5.x upgrade to Bibliography 5.x-1.20 [3] * If you use Bibliography for Drupal 6.x upgrade to Bibliography 6.x-1.11 [4] See also the Bibliography project page [5]. -------- REPORTED BY --------------------------------------------------------- * Martin Barbella [6] -------- FIXED BY ------------------------------------------------------------ Ron Jerome [7], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [8]. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/biblio [3] http://drupal.org/node/796498 [4] http://drupal.org/node/796502 [5] http://drupal.org/project/biblio [6] http://drupal.org/user/633600 [7] http://drupal.org/user/54997 [8] http://drupal.org/contact

1 0

SA-CONTRIB-2010-043: Wordfilter - Cross Site Scripting
by security-news＠drupal.org 12 May '10

12 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-043 * Project: Wordfilter (third-party module) * Version: 5.x, 6.x * Date: 2010-May-12 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Wordfilter module implements an input filter that rewrites content to remove improper or foul language. Wordfilter does not sanitize the list of words that are filtered along with their replacements, allowing users with permissions to manage the list of banned words to insert arbitrary HTML and script code. Such a cross site scripting [1] (XSS) attack may lead to a malicious user gaining full administrative access. This vulnerability is mitigated by the attacker needing the "administer words filtered" permission in order to exploit it. -------- VERSIONS AFFECTED --------------------------------------------------- * Wordfilter 5.x prior to 5.x-1.1 [2] * Wordfilter 6.x prior to 6.x-1.1 [3] Drupal core is not affected. If you do not use the contributed Wordfilter module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Wordfilter module for Drupal 5.x, update to Wordfilter 5.x-1.1 [4]. * If you use Wordfilter module for Drupal 6.x, update to Wordfilter 6.x-1.1 [5]. See also the Wordfilter project page [6] -------- REPORTED BY --------------------------------------------------------- * mr.baileys [7] of the Drupal Security Team [8]. -------- FIXED BY ------------------------------------------------------------ * Jeff Warrington (jaydub) [9], module co-maintainer. -------- CONTACT ------------------------------------------------------------- The Security Team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [10]. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/796620 [3] http://drupal.org/node/796618 [4] http://drupal.org/node/796620 [5] http://drupal.org/node/796618 [6] http://drupal.org/project/wordfilter [7] http://drupal.org/user/383424 [8] http://drupal.org/security-team [9] http://drupal.org/user/46257 [10] http://drupal.org/contact

1 0

SA-CONTRIB-2010-042: LoginToboggan - Session fixation
by security-news＠drupal.org 12 May '10

12 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-042 * Project: LoginToboggan (third-party module) * Version: 5.x, 6.x * Date: 2010-05-12 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Session fixation -------- DESCRIPTION --------------------------------------------------------- The LoginToboggan module provides a customized log in workflow. Attackers may be able to exploit the workflow to initiate a session fixation [1] attack. -------- VERSIONS AFFECTED --------------------------------------------------- * LoginToboggan versions for the 5.x and 6.x versions of Drupal Drupal core is not affected. If you do not use the contributed LoginToboggan module for Drupal 5.x or 6.x, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version of the module: * 5.x: LoginToboggan 5.x-1.7 [2] * 6.x: LoginToboggan 6.x-1.7 [3] See also the LoginToboggan [4] project page. -------- REPORTED BY --------------------------------------------------------- * Chad Phillips (hunmonk [5]), the module maintainer and member of the Drupal Security Team. -------- FIXED BY ------------------------------------------------------------ * Chad Phillips (hunmonk [6]), the module maintainer and member of the Drupal Security Team. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [7]. Read more about the Security Team and Security Advisories at http://drupal.org/security. [1] http://en.wikipedia.org/wiki/Session_fixation [2] http://drupal.org/node/797154 [3] http://drupal.org/node/797158 [4] http://drupal.org/project/logintoboggan [5] http://drupal.org/user/22079 [6] http://drupal.org/user/22079 [7] http://drupal.org/contact

1 0

SA-CONTRIB-2010-041: ImageField - Access Bypass
by security-news＠drupal.org 06 May '10

06 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-41 * Project: ImageField (third-party module) * Version: 6.x * Date: 2010-May-5 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- ImageField provides a file upload field for CCK, allowing files to be attached to a node. ImageField intends to set a default extension of "png jpg gif" for all new fields, but may actually save an empty string allowing all of the "png jpg gif" extensions if an administrator does not save the field configuration page after creating a new field. Any ImageField that has been initially saved or edited with any extensions specified is not affected. This vulnerability is mitigated by the attacker needing permission to create or edit content with an unconfigured ImageField. ImageField also creates thumbnails after uploading a new image. A second vulnerability is that this thumbnail is not properly checked for access if using the Private Downloads setting, allowing users that may not have access to view the full size image to still view the administrative thumbnail. -------- VERSIONS AFFECTED --------------------------------------------------- * ImageField for Drupal 6.x versions prior to 6.x-3.3 Drupal core is not affected. If you do not use the contributed ImageField [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use ImageField for Drupal 6.x upgrade to ImageField 6.x-3.3 [2] -------- REPORTED BY --------------------------------------------------------- * vb1 [3] -------- FIXED BY ------------------------------------------------------------ * Nathan Haug [4] the module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/imagefield [2] http://drupal.org/node/791030 [3] http://drupal.org/user/690402 [4] http://drupal.org/user/35821

1 0

SA-CONTRIB-2010-040: FileField - Access Bypass
by security-news＠drupal.org 06 May '10

06 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-40 * Project: FileField (third-party module) * Version: 6.x * Date: 2010-May-5 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- FileField provides a file upload field for CCK, allowing files to be attached to a node. FileField intends to set a default extension of "txt" for all new fields, but may actually save an empty string allowing all extensions if an administrator does not save the field configuration page after creating a new field. Execution of code in uploaded files is normally prevented by .htaccess rules, regardless of file extension. Any FileField that has been initially saved or edited with any extensions specified is not affected. This vulnerability is mitigated by the attacker needing permission to create or edit content with an unconfigured FileField. -------- VERSIONS AFFECTED --------------------------------------------------- * FileField for Drupal 6.x versions prior to 6.x-3.3 Drupal core is not affected. If you do not use the contributed FileField [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use FileField for Drupal 6.x upgrade to FileField 6.x-3.3 [2] -------- REPORTED BY --------------------------------------------------------- * David Rothstein [3] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Nathan Haug [4] the module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/filefield [2] http://drupal.org/node/791032 [3] http://drupal.org/user/124982 [4] http://drupal.org/user/35821

1 0

SA-CONTRIB-2010-039: CCK TableField - Cross Site Scripting
by security-news＠drupal.org 05 May '10

05 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-039 * Project: CCK TableField (third-party module) * Version: 6.x * Date: 2010-May-05 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The CCK TableField module provides a generic method to attach tabular data to a node. CCK TableField does not sanitize table headers before output, allowing anyone with permissions to create or edit a node containing one or more TableField fields to insert arbitrary HTML and script code. Such a cross site scripting [1] (XSS) attack may also lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * CCK TableField module for Drupal 6.x version prior to 6.x-1.2. Drupal core is not affected. If you do not use the contributed CCK TableField module for Drupal 6.x, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version or disable the module. * If you use CCK TableField 6.x-1.1 or older, upgrade to CCK TableField 6.x-1.2 [2] See also the CCK TableField [3] project page. -------- REPORTED BY --------------------------------------------------------- * mr.baileys [4] of the Drupal Security Team [5]. -------- FIXED BY ------------------------------------------------------------ * Kevin Hankens [6], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [7]. Read more about the Security Team and Security Advisories at http://drupal.org/security. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/790364 [3] http://drupal.org/project/tablefield [4] http://drupal.org/user/383424 [5] http://drupal.org/security-team [6] http://drupal.org/user/78090 [7] http://drupal.org/contact

1 0

SA-CONTRIB-2010-038 - Privatemsg - Access bypass
by security-news＠drupal.org 28 Apr '10

28 Apr '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-038 * Project: Privatemsg (third-party module) * Version: 6.x * Date: 2010-April-28 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- The Privatemsg module allows to send private messages between users. Additionally, the sub module Privatemsg Email Notification sends e-mail notification when such a message is sent. The page to configure the template for these e-mails does not use the correct access permission which allows all users with the read privatemsg permission to access and alter the settings on that page. -------- VERSIONS AFFECTED --------------------------------------------------- * Privatemsg for Drupal 6.x versions prior to 6.x-1.2 Drupal core is not affected. If you do not use the contributed Privatemsg [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use Privatemsg for Drupal 6.x upgrade to Privatemsg 6.x-1.2 [2] -------- REPORTED BY --------------------------------------------------------- * Lee Rowlands [3], module maintainer -------- FIXED BY ------------------------------------------------------------ * Lee Rowlands [4], module maintainer. * Sascha Grossebacher [5], module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/privatemsg [2] http://drupal.org/node/784598 [3] http://drupal.org/user/395439 [4] http://drupal.org/user/395439 [5] http://drupal.org/user/214652

1 0

SA-CONTRIB-2010-037 - Decisions - Access bypass
by security-news＠drupal.org 28 Apr '10

28 Apr '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-037 * Project: Decisions (third-party module) * Version: 5.x, 6.x * Date: 2010-April-28 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- Decisions is a replacement for poll.module and provides advanced voting systems and decision-making tools. It aims to enable groups to take decisions online in a manner that replicates and augments what is possible in face-to-face meeting. In some listings, the Decisions module does not construct its SQL query to respect node access restrictions, thus users can see listings of nodes which should not be accessible to them. -------- VERSIONS AFFECTED --------------------------------------------------- * Decisions for Drupal 5.x versions prior to 5.x-1.2 * Decisions for Drupal 6.x versions prior to 6.x-1.7 Drupal core is not affected. If you do not use the contributed Decisions [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use Decisions for Drupal 5.x upgrade to Decisions 5.x-1.2 [2] * If you use Decisions for Drupal 6.x upgrade to Decisions 6.x-1.7 [3] -------- REPORTED BY --------------------------------------------------------- * Kirill Stealth [4] -------- FIXED BY ------------------------------------------------------------ * Antoine Beaupré [5], module maintainer. * Ezra Barnett Gildesgame [6], module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/decisions [2] http://drupal.org/node/784444 [3] http://drupal.org/node/783766 [4] http://drupal.org/user/205226 [5] http://drupal.org/user/1274 [6] http://drupal.org/user/69959

1 0

SA-CONTRIB-2010-036 - Views - multiple vulnerabilities
by security-news＠drupal.org 08 Apr '10

08 Apr '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-036 * Project: Views (third-party module) * Version: 5.x, 6.x * Date: 2010-April-7 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting (XSS), arbitrary code execution -------- DESCRIPTION --------------------------------------------------------- The Views module provides a flexible method for Drupal site designers to control how lists of content are presented. Views accepts parameters in the URL and uses them in an AJAX callback. The values were not filtered, thus allowing injection of JavaScript code via the AJAX response. A user tricked into visiting a crafted URL could be exposed to arbitrary script or HTML injected into the page. In addition, the Views module does not properly sanitize file descriptions when displaying them in a view, thus the the file desciptions may be used to inject arbitrary script or HTML. Such cross site scripting [1] (XSS) attacks may lead to a malicious user gaining full administrative access. These vulnerabilities affect only the Drupal 6 version. The file description vulnerability is mitigated by the fact that the attacker must have permission to upload files. In both the Drupal 5 and Drupal 6 versions, users with permission to 'administer views' can execute arbitrary PHP code using the views import feature. An additional check for the permission 'use PHP for block visibility' has been added to insure that the site administrator has already granted users of the import functionality the permission to execute PHP. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions of Views for Drupal 6.x prior to 6.x-2.9 * Versions of Views for Drupal 5.x prior to 5.x-1.7 Note - the 6.x-3.x branch alpha releases are affected also. If you do not use the contributed Views module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Views for Drupal 6.x upgrade to Views 6.x-2.9 [2] or any later version. * If you use Views for Drupal 6.x upgrade to Views 5.x-1.7 [3] or any later version. Also see the Views [4] project page. -------- REPORTED BY --------------------------------------------------------- * XSS via AJAX parameters reported by Angel Lozano Alcazar of S21Sec * XSS via file descriptions reported by Martin Barbella [5] * PHP execution reported by Derek Wright (dww [6]) of the Drupal Security Team [7] -------- FIXED BY ------------------------------------------------------------ * Earl Miles (merlinofchaos [8]) Views project maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/765088 [3] http://drupal.org/node/765090 [4] http://drupal.org/project/views [5] http://drupal.org/user/633600 [6] http://drupal.org/user/46549 [7] http://drupal.org/security-team [8] http://drupal.org/user/26979

1 0

SA-CONTRIB-2010-035: Smileys - Cross Site Request Forgery
by security-news＠drupal.org 07 Apr '10

07 Apr '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-035 * Project: Smileys (third-party module) * Versions: 5.x * Date: 2010-April-07 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross-site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Smileys module provides a text filter that substitutes emoticons with images. The module is vulnerable to cross-site request forgeries (CSRF [1]) via the URL used to delete smileys. A user with "administer smileys" permission could be tricked into visiting the smiley delete URL and unwittingly remove smileys from the site. -------- VERSIONS AFFECTED --------------------------------------------------- * Smileys module for Drupal 5.x version prior to 5.x-1.2 [2]. *Note that Smileys version 6.x-1.0-alpha5 and earlier versions for Drupal 6.x are also affected. However, the security team does not provide support for alpha releases.* Drupal core is not affected. If you do not use the contributed Smileys module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use the Smileys module for Drupal 5.x-1.x upgrade to Smileys 5.x-1.2 [3] See also the Smileys project page [4]. -------- REPORTED BY --------------------------------------------------------- * Andrey Tretyakov [5] -------- FIXED BY ------------------------------------------------------------ * Gurpartap Singh [6], the module maintainer * mr.baileys [7] of the Drupal security team. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [8]. [1] http://en.wikipedia.org/wiki/Csrf [2] http://drupal.org/node/764826 [3] http://drupal.org/node/764826 [4] http://drupal.org/project/smileys [5] http://drupal.org/user/169459 [6] http://drupal.org/user/41470 [7] http://drupal.org/user/383424 [8] http://drupal.org/contact

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news