- Security-news - lists.drupal.org

SA-CONTRIB-2010-094 - Embedded Media Field - Access bypass
by security-news＠drupal.org 22 Sep '10

22 Sep '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-094 * Project: Embedded Media Field (third-party module) * Version: 5.x, 6.x * Date: 2010-September-22 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- The Embedded Media Field project is a set of modules that enable editors to post URL's and embed codes for third party media providers such as YouTube, Vimeo, or Flickr, which will be automatically parsed and displayed using preset formatters. The Embedded Video Field module (packaged with the project) enables videos to be displayed in a modal popup using the Lightbox2 [1], Shadowbox [2], Colorbox [3], and Thickbox [4] modules. In some cases checks on the user's field level access to the source video were not carried out correctly, allowing direct queries to the backend URL resulting in the display of videos which the user would otherwise be unable to access. -------- VERSIONS AFFECTED --------------------------------------------------- * Embedded Media Field module for Drupal 6.x versions prior to 6.x-1.24 and 6.x-2.0 * Embedded Media Field module for Drupal 5.x versions prior to 5.x-1.10 Drupal core is not affected. If you do not use the contributed Embedded Media Field [5] module, together with the Embedded Video Field module there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Embedded Media Field module for Drupal 6.x upgrade to Embedded Media Field 6.x-2.1 [6] or Embedded Media Field 6.x-1.25 [7] * If you use the Embedded Media Field module for Drupal 5.x upgrade to Embedded Media Field 5.x-1.11 [8] See also the Embedded Media Field project page [9]. .... Important note Users wishing to update from version DRUPAL 6.x-1.x to version DRUPAL 6.x-2.x (or greater) of Embedded Media Field should be aware that as of version DRUPAL 6.x-2.x the module no longer provides direct support for third party media providers, instead it acts as an API for other modules to use. All providers previously supported directly in earlier versions are now supported externally; see the partial list at the project page for a list of modules offering this support (such as Media: YouTube [10], Media: Vimeo [11], and Media: Flickr [12]). Please note that at this time there are not yet specific modules for all the individual providers; if you don't see your desired provider in that list, it most likely will be in one of the 'Flotsam' modules listed at the end of that list, which serve as a temporary placeholder. Developers interested in creating or maintaining one of these individual provider modules are encouraged to contact the module maintainers. -------- REPORTED BY --------------------------------------------------------- * Stella Power (stella) [13], of the Drupal security team -------- FIXED BY ------------------------------------------------------------ * Stella Power (stella) [14], of the Drupal security team * Aaron Winborn (aaron) [15], module co-maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [16] can be reached at security at drupal.org or via the form at http://drupal.org/contact [17]. [1] http://drupal.org/project/lightbox2 [2] http://drupal.org/project/shadowbox [3] http://drupal.org/project/colorbox [4] http://drupal.org/project/thickbox [5] http://drupal.org/project/emfield [6] http://drupal.org/node/919368 [7] http://drupal.org/node/919366 [8] http://drupal.org/node/919364 [9] http://drupal.org/project/emfield [10] http://drupal.org/project/media_youtube [11] http://drupal.org/project/media_vimeo [12] http://drupal.org/project/media_flickr [13] http://drupal.org/user/66894 [14] http://drupal.org/user/66894 [15] http://drupal.org/user/33420 [16] http://drupal.org/security-team [17] http://drupal.org/contact

1 0

SA-CONTRIB-2010-093 - Advanced Taxonomy Blocks - Multiple Vulnerabilities
by security-news＠drupal.org 15 Sep '10

15 Sep '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-093 * Project: Advanced Taxonomy Blocks (third-party module) * Version: 6.x * Date: 2010-September-15 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- Advanced Taxonomy Blocks makes use of the JQuery menu module to create extremely customizable blocks for browsing through single hierarchy taxonomies. The module contained Cross Site Scripting vulnerabilities which could allow a malicious user with one of several non-default permissions to inject arbitrary javascript into the administrative pages provided by this module. The module also contained Cross Site Request Forgery vulnerabilities which could allow an attacker to trick an administrator into unintentionally deleting or resetting blocks provided by this module. -------- VERSIONS AFFECTED --------------------------------------------------- * Advanced Taxonomy Blocks module for Drupal 6.x versions prior to 6.x-3.4 Drupal core is not affected. If you do not use the contributed Advanced Taxonomy Blocks [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Advanced Taxonomy Blocks module for Drupal 6.x upgrade to Advanced Taxonomy Blocks 6.x-3.4 [2] See also the Advanced Taxonomy Blocks [3]. -------- REPORTED BY --------------------------------------------------------- * mr.baileys , of the Drupal Security Team. -------- FIXED BY ------------------------------------------------------------ * Aaron Hawkins , the module maintainer. -------- CONTACT ------------------------------------------------------------- The Drupal security team [4] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/taxonomyblocks [2] http://drupal.org/node/912584 [3] http://drupal.org/project/taxonomyblocks [4] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-092 - Advanced Book Blocks - Multiple Vulnerabilities
by security-news＠drupal.org 15 Sep '10

15 Sep '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-092 * Project: Advanced Book Blocks (third-party module) * Version: 6.x * Date: 2010-September-15 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Advanced Book Blocks module enables you to integrate with the API provided by the JQuery Menu module (version 1.8 and higher) to provide click and expand book menus with the ability to customize each block individually. The module contained Cross Site Scripting vulnerabilities which could allow a malicious user with one of several non-default permissions to inject arbitrary javascript into the administrative pages provided by this module. The module also contained Cross Site Request Forgery vulnerabilities which could allow an attacker to trick an administrator into unintentionally deleting or resetting blocks provided by this module. -------- VERSIONS AFFECTED --------------------------------------------------- * Advanced Book Blocks module for Drupal 6.x versions prior to 6.x-2.2 Drupal core is not affected. If you do not use the contributed Advanced Book Blocks [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Advanced Book Blocks module for Drupal 6.x upgrade to Advanced Book Blocks 6.x-2.2 [2] See also the Advanced Book Blocks [3]. -------- REPORTED BY --------------------------------------------------------- * Matt Chapman , of the Drupal Security Team. -------- FIXED BY ------------------------------------------------------------ * Aaron Hawkins , the module maintainer. * Matt Chapman , of the Drupal Security Team. -------- CONTACT ------------------------------------------------------------- The Drupal security team [4] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/advancedbookblocks [2] http://drupal.org/node/912586 [3] http://drupal.org/project/advancedbookblocks [4] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-091 - Mollom - Information Disclosure
by security-news＠drupal.org 15 Sep '10

15 Sep '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-091 * Project: Mollom (third-party module) * Version: 6.x * Date: 2010-September-15 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- The Mollom module provides a combination of CAPTCHA challenges with text analysis to intelligently block spam. In some configurations, sensitive user data (e.g., a user's plain-text password) might be logged through calls to Drupal's watchdog API. This vulnerability is mitigated by the fact that this information would only be disclosed to users with access to view log messages, usually a role with the 'access site reports' permission or access to system syslog files, which should generally only be granted to trusted users. -------- VERSIONS AFFECTED --------------------------------------------------- * Mollom module for Drupal 6.x versions prior to 6.x-1.14 Mollom for Drupal 5.x is not affected, but the alpha Mollom release for Drupal 7.x is affected. Drupal core is not affected. If you do not use the contributed Mollom module there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Mollom module for Drupal 6.x upgrade to the 6.x-1.14 version [1] See also the Mollom project page [2]. -------- REPORTED BY --------------------------------------------------------- * Katherine Senzee (ksenzee) [3] -------- FIXED BY ------------------------------------------------------------ * Daniel Kudwien (sun) [4], module co-maintainer * Dries [5], module co-maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [6] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/912420 [2] http://drupal.org/project/mollom [3] http://drupal.org/user/139855 [4] http://drupal.org/user/54136 [5] http://drupal.org/user/1 [6] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-090 - Yr Weatherdata - SQL Injection
by security-news＠drupal.org 08 Sep '10

08 Sep '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-090 * Project: Yr Weatherdata (third-party module) * Version: 6.x * Date: 2010-September-08 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: SQL Injection -------- DESCRIPTION --------------------------------------------------------- The Yr Weatherdata module displays weather forecasts, and enables users with the proper permission to set the sort method. When setting the sorting method the module does not filter the value input by the user correctly. This vulnerability can be exploited to perform an SQL Injection attack [1]. -------- VERSIONS AFFECTED --------------------------------------------------- * Yr Weatherdata module for Drupal 6.x before version 6.x-1.6 Drupal core is not affected. If you do not use the contributed Yr Weatherdata [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Yr Weatherdata module for Drupal 6.x before version 6.x-1.6 upgrade to Yr Weatherdata 6.x-1.6 [3] or later, preferably the current Yr Weatherdata 6.x-1.10 [4] See also the Yr Weatherdata project page [5]. -------- REPORTED BY --------------------------------------------------------- * Fredrik Kilander (tjodolv [6]), module maintainer -------- FIXED BY ------------------------------------------------------------ * Fredrik Kilander (tjodolv [7]), module maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [8] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Sql_injection [2] http://drupal.org/project/yr_verdata [3] http://drupal.org/node/606290 [4] http://drupal.org/node/824368 [5] http://drupal.org/project/yr_verdata [6] http://drupal.org/user/196733 [7] http://drupal.org/user/196733 [8] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-089 - Simplenews Content Selection - Cross Site Scripting
by security-news＠drupal.org 18 Aug '10

18 Aug '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-089 * Project: Simplenews content selection (third-party module) * Version: 6.x * Date: 2010-August-18 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Cross site scripting -------- DESCRIPTION --------------------------------------------------------- This module allows you to select content from your website and send a newsletter with the selected content. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability that may lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Simplenews Content Selection module 6.x-1.5 Drupal core is not affected. If you do not use the contributed Simplenews Content Selection [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Simplenews Content Selection module for Drupal 6.x upgrade to Simplenews Content Selection 6.x-1.6 [3] See also the Simplenews Content Selection project page [4]. -------- REPORTED BY --------------------------------------------------------- * Henry Sudhof [5]. -------- FIXED BY ------------------------------------------------------------ * De Waele Dieter [6], module maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [7] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/simplenews_content_selection [3] http://drupal.org/node/887110 [4] http://drupal.org/project/simplenews_content_selection [5] http://drupal.org/user/730666 [6] http://drupal.org/user/253145 [7] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-088 - Content Construction Kit (CCK) - Access Bypass
by security-news＠drupal.org 12 Aug '10

12 Aug '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-088 * Project: Content Construction Kit (CCK) (third-party module) * Version: 6.x * Date: 2010-August-11 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- The Content Construction Kit (CCK) project is a set of modules that allows you to add custom fields to nodes using a web browser. The CCK "Node Reference" module provides a backend URL that is used for asynchronous requests by the "autocomplete" widget to locate nodes the user can reference. In some cases, this was not correctly checking that the user had field level access to the source field, allowing direct queries to the backend URL to return node titles and IDs which the user would otherwise be unable to access. Note that as Drupal 5 CCK does not have any field access control functionality, this issue only applies to the Drupal 6 version. This advisory is a follow-up related to advisory SA-CONTRIB-2010-065 [1]. -------- VERSIONS AFFECTED --------------------------------------------------- * Content Construction Kit (CCK) module for Drupal 6.x versions prior to 6.x-2.8 Drupal core is not affected. If you do not use the contributed Content Construction Kit (CCK) [2] module, together with any node or field access module there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Content Construction Kit (CCK) module for Drupal 6.x upgrade to Content Construction Kit (CCK) 6.x-2.8 [3] See also the Content Construction Kit (CCK) project page [4]. -------- REPORTED BY --------------------------------------------------------- * Alexis Wilke [5] -------- FIXED BY ------------------------------------------------------------ * Marc Ferran (markus_petrux) [6], module co-maintainer * Peter Wolanin (pwolanin) [7], of the Drupal security team -------- CONTACT ------------------------------------------------------------- The Drupal security team [8] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/829566 [2] http://drupal.org/project/cck [3] http://drupal.org/node/880732 [4] http://drupal.org/project/cck [5] http://drupal.org/user/356197 [6] http://drupal.org/user/39593 [7] http://drupal.org/user/49851 [8] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-087 - GovDelivery - Cross site scripting
by security-news＠drupal.org 12 Aug '10

12 Aug '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-087 * Project: GovDelivery Integration (third-party module) * Version: 6.x * Date: 2010-Aug-11 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross site scripting -------- DESCRIPTION --------------------------------------------------------- The GovDelivery module provides integration with the GovDelivery On-Demand Mailer service, a web service for GovDelivery customers that sends messages directly based on configured account information. The module replaces the backend of SMTP library in your Drupal site with calls to the GovDelivery service, so all mail sent from your site uses the ODM service. The module does not sanitize some of the user-supplied data before displaying it (for Drupal 6.x-1.0 only), leading to a Cross Site Scripting (XSS) vulnerability that may lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * GovDelivery module for Drupal 6.x versions prior to 6.x-1.1 Drupal core is not affected. If you do not use the contributed GovDelivery Integration [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the GovDelivery module for Drupal 6.x upgrade to GovDelivery 6.x-1.1 [2] See also the GovDelivery Integration project page [3]. -------- REPORTED BY --------------------------------------------------------- * ben.bunk [4], module co-maintainer -------- FIXED BY ------------------------------------------------------------ * ben.bunk [5], module co-maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [6] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/govdelivery [2] http://drupal.org/node/880684 [3] http://drupal.org/project/govdelivery [4] http://drupal.org/user/764808 [5] http://drupal.org/user/764808 [6] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-086 - Prepopulate - Access Bypass
by security-news＠drupal.org 12 Aug '10

12 Aug '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-086 * Project: Prepopulate (third-party module) * Version: 5.x and 6.x * Date: 2010-Aug-11 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- The Prepopulate module provides the ability for form fields to be pre-populated via the request sent for the form. The module is vulnerable to access bypass which would allow a malicious user to change the value of fields they would not otherwise have access to alter. -------- VERSIONS AFFECTED --------------------------------------------------- * Prepopulate module for Drupal 6.x versions prior to 6.x-2.0 [1] * Prepopulate module for Drupal 5.x versons prior to 5.x-1.5 [2] Drupal core is not affected. If you do not use the contributed Prepopulate [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Prepopulate module for Drupal 6.x upgrade to Prepopulate 6.x-2.0 [4] * If you use the Prepopulate module for Drupal 5.x upgrade to Prepopulate 5.x-1.5 [5] See also the Prepopulate project page [6]. -------- REPORTED BY --------------------------------------------------------- * Aren Cambre [7] -------- FIXED BY ------------------------------------------------------------ * Joshua Brauer (jbrauer [8]) the module maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [9] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/880652 [2] http://drupal.org/node/880656 [3] http://drupal.org/project/prepopulate [4] http://drupal.org/node/880652 [5] http://drupal.org/node/880656 [6] http://drupal.org/project/prepopulate [7] http://drupal.org/user/97356 [8] http://drupal.org/user/253145 [9] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-085 - Pathauto - Cross Site Scripting
by security-news＠drupal.org 11 Aug '10

11 Aug '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-085 * Project: Pathauto (third-party module) * Version: 5.x, 6.x * Date: 2010-August-11 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Pathauto module automatically generates path aliases for various kinds of content (nodes, categories, users) without requiring the user to manually specify the path alias. It also provides additional tokens that can be used in URL alias patterns and anywhere else that the Token API [1] is used. The module does not sanitize the text in the [bookpathalias], [catalias], and [termalias] tokens. Under rare circumstances those tokens could cause a Cross Site Scripting (XSS [2]) vulnerability that may lead to a malicious user gaining full administrative access. This vulnerability is mitigated by the fact that a malicious user must have "create url aliases" permission and then one of those tokens must be used to display output on an HTML page (for instance, displaying a message to the user using an action from the token_actions.module). The normal circumstance of using these tokens as part of a Pathauto URL alias pattern is not vulnerable. -------- VERSIONS AFFECTED --------------------------------------------------- * Pathauto module for Drupal 5.x versions prior to 5.x-2.4 * Pathauto module for Drupal 6.x versions prior to 6.x-1.4 Drupal core is not affected. If you do not use the contributed Pathauto [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Pathauto module for Drupal 5.x upgrade to Pathauto 5.x-2.4 [4] * If you use the Pathauto module for Drupal 6.x upgrade to Pathauto 6.x-1.4 [5] See also the Pathauto project page [6]. -------- SAFE USE OF TOKENS -------------------------------------------------- The existing [bookpathalias], [termalias], and [catalias] tokens are now sanitized. New [bookpathalias-raw], [termalias-raw], and [catalias-raw] companion tokens have been added for the un-sanitized versions of each token respectfully. This is also a reminder to modules that use the Token API [7] to display output on an HTML page (such as displaying a message to the user), that no tokens with the -raw suffix should be used. -------- REPORTED BY --------------------------------------------------------- * Dave Reid [8] of the Drupal security team and module co-maintainer -------- FIXED BY ------------------------------------------------------------ * Dave Reid [9] of the Drupal security team and module co-maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [10] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/token [2] http://en.wikipedia.org/wiki/Cross-site_scripting [3] http://drupal.org/project/pathauto [4] http://drupal.org/node/880462 [5] http://drupal.org/node/880464 [6] http://drupal.org/project/pathauto [7] http://drupal.org/project/token [8] http://drupal.org/user/53892 [9] http://drupal.org/user/53892 [10] http://drupal.org/security-team

1 0