- Security-news - lists.drupal.org

SA-CONTRIB 2010-075 - Tagging - Cross Site Scripting
by security-news＠drupal.org 21 Jul '10

21 Jul '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-075 * Project: Tagging (third-party module) * Version: 6.x * Date: 2010-July 21 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Tagging module provides an alternative input widget and other features for taxonomy terms. The module does not properly escape user-provided content submitted to free-tagging vocabularies displayed on node previews, leading to a Cross Site Scripting (XSS [1]) vulnerability. Any user with permission to create or edit a node containing a free-tagging vocabulary is vulnerable to attack. -------- VERSIONS AFFECTED --------------------------------------------------- * Tagging module for Drupal 6.x versions prior to 6.x-2.4. Drupal core is not affected. If you do not use the contributed Tagging [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * Upgrade to Tagging 6.x-2.4 [3] See also the Tagging project page [4]. -------- REPORTED BY --------------------------------------------------------- * Mike Stefanello [5] * Barry Jaspan [6] of the Drupal security team -------- FIXED BY ------------------------------------------------------------ * Eugen Mayer [7], module maintainer * Mike Stefanello [8] -------- CONTACT ------------------------------------------------------------- The Drupal security team [9] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/tagging [3] http://drupal.org/node/857494 [4] http://drupal.org/project/tagging [5] http://drupal.org/user/107190 [6] http://drupal.org/user/46413 [7] http://drupal.org/user/108406 [8] http://drupal.org/user/107190 [9] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-074 - Drupad - Cross-site request forgery
by security-news＠drupal.org 14 Jul '10

14 Jul '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-074 * Projects: Drupad (third-party module) * Version: 6.x * Date: 2010-07-14 * Security risks: Critical * Exploitable from: Remote * Vulnerability: CSRF -------- DESCRIPTION --------------------------------------------------------- The Drupad module is the companion module of the iPhone / iPodTouch application also called Drupad. The module doesn't check if the incoming request is made from the application, leading to a CSRF vulneraby. This vulnerability can be used to delete users and content, or set the site in offline mode when a privileged user visits a malicious site. -------- VERSIONS AFFECTED --------------------------------------------------- * Drupad for Drupal 6.x versions prior to 6.x-1.1 Drupal core is not affected. If you do not use the contributed Drupad [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * Upgrade to Drupad 6.x-1.1 [2] See also the Drupad project page [3]. -------- REPORTED BY --------------------------------------------------------- * Heine Deelstra [4] of the Drupal security team -------- FIXED BY ------------------------------------------------------------ * Jérémy Chatard [5], module maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/drupad [2] http://drupal.org/node/854034 [3] http://drupal.org/project/drupad [4] http://drupal.org/user/17943 [5] http://drupal.org/user/130002

1 0

SA-CONTRIB-2010-073 - Multiple Vulnerabilities In Multiple Contributed Modules
by security-news＠drupal.org 14 Jul '10

14 Jul '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-073 * Projects: Multiple third party modules - Simple Gallery, OG Menu, Tell A Friend Node, JsMath For Displaying Mathematics With TeX * Version: 5.x, 6.x * Date: 2010-July-14 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Multiple (Cross Site Scripting, Email Header Injection) -------- VERSIONS AFFECTED AND PROPOSED SOLUTIONS ---------------------------- Simple Gallery [1] for Drupal 6.x This module creates a simple gallery using taxonomy and CCK imagefields. The module is vulnerable to a Cross Site Scripting [2] (XSS) attack. This can be exploited by users with the ability to add taxonomy terms or tag content. *Solution:* Disable the module. There is no safe version of the module to use. OG Menu [3] for Drupal 6.x Enables users to manage menus by Organic Groups. The module is vulnerable to a Cross Site Scripting [4] (XSS) attack which can be exploited by users with the "administer og menu" permission . *Solution:* Disable the module. There is no safe version of the module to use. Tell A Friend Node [5] for Drupal 6.x This module provides a Tell A Friend node type for creating multiple tell a friend pages on a site. The module is vulnerable to email header injection attacks by spam bots and can be abused by any user with the "access tellafriend nodes" permission. *Solution:* Disable the module. There is no safe version of the module to use. JsMath For Displaying Mathematics With TeX [6] for Drupal 5.x and 6.x This module enables the jsMath script for displaying mathematical expressions. The module is vulnerable to a Cross Site Scripting [7] (XSS) attack. This vulnerability can only be exploited by users with the "access administration pages" permission. *Solution:* Disable the module. There is no safe version of the module to use. Drupal core is not affected. If you do not use any of the module releases above there is nothing you need to do. -------- ONGOING MAINTENANCE OF THESE MODULES -------------------------------- If you are interested in taking over maintenance of a module, or branch of a module, that is no longer supported, and are capable of fixing security vulnerabilities, you may apply to do so using the abandoned project takeover process [8]. -------- REPORTED BY --------------------------------------------------------- * Simple Gallery issue reported by Owen Barton [9] of the Drupal Security Team * OG Menu issue reported by Justin C. Klein Keane [10] * Tell A Friend Node issue reported by James McDonald [11] * JsMath For Displaying Mathematics With TeX issue reported by Kyle Small [12] -------- CONTACT ------------------------------------------------------------- The security team for Drupal [13] can be reached at security at drupal.org or via the form at http://drupal.org/contact. Read more about the Security Team and Security Advisories at http://drupal.org/security. [1] http://drupal.org/project/simplegallery [2] http://en.wikipedia.org/wiki/Cross_Site_Scripting [3] http://drupal.org/project/og_menu [4] http://en.wikipedia.org/wiki/Cross_Site_Scripting [5] http://drupal.org/project/tellafriend_node [6] http://drupal.org/project/jsmath [7] http://en.wikipedia.org/wiki/Cross_Site_Scripting [8] http://drupal.org/node/251466 [9] http://drupal.org/user/19668 [10] http://drupal.org/user/302225 [11] http://drupal.org/user/418221 [12] http://drupal.org/user/832278 [13] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-072: Hierarchical Select - Cross Site Scripting
by security-news＠drupal.org 07 Jul '10

07 Jul '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-0XX * Project: Hierarchical Select (third-party module) * Version: 5.x, 6.x * Date: 2010-July-07 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Hierarchical Select module provides a "hierarchical_select" form element, which is a greatly enhanced way for letting the user select items in a taxonomy. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability that may lead to a malicious user gaining full administrative access. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer taxonomy' permission. -------- VERSIONS AFFECTED --------------------------------------------------- * Hierarchical Select module for Drupal 5.x versions prior to 5.x-3.2 * Hierarchical Select module for Drupal 6.x versions prior to 6.x-3.2 Drupal core is not affected. If you do not use the contributed Hierarchical Select [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Hierarchical Select module for Drupal 5.x upgrade to Hierarchical Select 5.x-3.2 [3] * If you use the Hierarchical Select module for Drupal 6.x upgrade to Hierarchical Select 6.x-3.2 [4] See also the Hierarchical Select project page [5]. -------- REPORTED BY --------------------------------------------------------- * Jingxiang Rao [6] * Sam Oldak -------- FIXED BY ------------------------------------------------------------ * Wim Leers [7], the module maintainer * Sam Oldak -------- CONTACT ------------------------------------------------------------- The Drupal security team [8] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/hierarchical_select [3] http://drupal.org/node/847286 [4] http://drupal.org/node/847284 [5] http://drupal.org/project/hierarchical_select [6] http://drupal.org/user/623328 [7] http://drupal.org/user/99777 [8] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-071 - MultiSafepay Integration - Cross Site Request Forgery
by security-news＠drupal.org 07 Jul '10

07 Jul '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-071 * Project: MultiSafepay Integration (third-party module) * Version: 6.x * Date: 2010-July-07 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The MultiSafepay Integration module provides integration between the Ubercart e-commerce solution and the MultiSafepay payment system. The module is vulnerable to Cross Site Request Forgeries (CSRF [1]) which would allow a malicious user to alter the status of orders or to trick other users into altering the status of orders. -------- VERSIONS AFFECTED --------------------------------------------------- * MultiSafepay Integration module for Drupal 6.x versions prior to 6.x-1.1 [2] Drupal core is not affected. If you do not use the contributed MultiSafepay Integration [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the MultiSafepay Integration module for Drupal 6.x upgrade to MultiSafepay Integration 6.x-1.1 [4] See also the MultiSafepay Integration project page [5]. -------- REPORTED BY --------------------------------------------------------- * Peter Wolanin (pwolanin [6]) of the Drupal security team -------- FIXED BY ------------------------------------------------------------ * Dieter De Waele (coworks_dieter [7]) the module maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [8] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Csrf [2] http://drupal.org/node/846200 [3] http://drupal.org/project/uc_multisafepay [4] http://drupal.org/node/846200 [5] http://drupal.org/project/uc_multisafepay [6] http://drupal.org/user/49851 [7] http://drupal.org/user/253145 [8] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-070 - Multiple vulnerabilities in multiple contributed modules
by security-news＠drupal.org 23 Jun '10

23 Jun '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-070 * Projects: Multiple third party modules - Easy Translator, Block Queue, Multiple Image Upload (Imagex) * Version: 5.x, 6.x * Date: 2010-06-23 * Security risks: Critical * Exploitable from: Remote * Vulnerability: Multiple (SQL Injection, CSRF, Access bypass) -------- VERSIONS AFFECTED AND PROPOSED SOLUTIONS ---------------------------- Easy Translator [1] for Drupal 6.x The module is vulnerable to SQL injections. *Solution:* Disable the module. There is no safe version of the module to use. Block Queue [2] for Drupal 6.x The Block Queue module allows users to create "queues" of blocks much like NodeQueue allows to create queues for nodes. The module is vulnerable to Cross-Site Request Forgeries as it allows a non-admin user to trick an admin into removing blocks from queues by directing him/her to a url via a link or image. *Solution:* Disable the module. There is no safe version of the module to use. Multiple Image Upload (Imagex) [3] for Drupal 5.x and 6.x The Multiple Image Upload module enables images to be "drag 'n' dropped" uploaded into Drupal. The module is vulnerable to access bypass. *Solution:* Disable the module. There is no safe version of the module to use. All releases of the module were marked unsupported earlier. Drupal core is not affected. If you do not use any of the module releases above there is nothing you need to do. -------- ONGOING MAINTENANCE OF THESE MODULES -------------------------------- If you are interested in taking over maintenance of a module, or branch of a module, that is no longer supported, and are capable of fixing security vulnerabilities, you may apply to do so using the abandoned project takeover process [4]. -------- REPORTED BY --------------------------------------------------------- * Easy Translator issue reported by Jakub Suchy [5] of the Drupal Security Team * Blockqueue issue reported by mr.baileys [6] of the Drupal Security Team * Multiple Image Upload (Imagex) issue reported by Greg Knaddison [7] of the Drupal Security Team -------- CONTACT ------------------------------------------------------------- The security team for Drupal [8] can be reached at security at drupal.org or via the form at http://drupal.org/contact. Read more about the Security Team and Security Advisories at http://drupal.org/security. [1] http://drupal.org/project/vitzo_easy_translator [2] http://drupal.org/project/blockqueue [3] http://drupal.org/project/imagex [4] http://drupal.org/node/251466 [5] http://drupal.org/user/31977 [6] http://drupal.org/user/383424 [7] http://drupal.org/user/36762 [8] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-069 - Case Tracker - Multiple Vulnerabilities
by security-news＠drupal.org 23 Jun '10

23 Jun '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-069 * Project: Case Tracker (third-party module) * Version: 5.x * Date: 2010-June-23 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Multiple Vulnerabilities -------- DESCRIPTION --------------------------------------------------------- The Case Tracker module enables teams to track outstanding cases which need resolution by attaching a status, priority and type. -------- CROSS SITE SCRIPTING (XSS) ------------------------------------------ The module does not sanitize some of the user-supplied data before displaying it, leading to a cross site scripting (XSS [1]) vulnerability that may lead to a malicious user gaining full administrative access. This vulnerability is mitigated by the fact that an attacker must have the "administer casetracker" permission, which should generally only be granted to trusted roles. -------- ACCESS BYPASS ------------------------------------------------------- The module provides the "access case tracker" permission which is used to restrict access to reports and other functionality provided. However it was also used to restrict access to individual project and case nodes but only in some instances. This access check has been removed and instead users are encouraged to install a content access module to restrict access to these nodes. -------- VERSIONS AFFECTED --------------------------------------------------- * Case Tracker module for Drupal 5.x versions prior to 5.x-1.4 Drupal core is not affected. If you do not use the contributed Case Tracker [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Case Tracker module for Drupal 5.x upgrade to Case Tracker 5.x-1.4 [3] As the "access case tracker" permission no longer controls access to project and case nodes, users are encouraged to install a content access module to restrict access to these nodes as necessary. See also the Case Tracker project page [4]. -------- REPORTED BY --------------------------------------------------------- * Mariano D'Agostino [5] * Clemens Tolboom [6] -------- FIXED BY ------------------------------------------------------------ * Jeff Miccolis [7], module maintainer * David Rothstein [8] of the Drupal security team -------- CONTACT ------------------------------------------------------------- The Drupal security team [9] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/casetracker [3] http://drupal.org/node/835962 [4] http://drupal.org/project/casetracker [5] http://drupal.org/user/154086 [6] http://drupal.org/user/125814 [7] http://drupal.org/user/31731 [8] http://drupal.org/user/124982 [9] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-068 - Masquerade - Cross Site Request Forgery
by security-news＠drupal.org 23 Jun '10

23 Jun '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-068 * Project: Masquerade (third-party module) * Version: 5.x, 6.x * Date: 2010-June-23 * Security risk: Not critical * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The masquerade module is designed as a tool for site designers and administrators, allowing a user with the right permissions to temporarily masquerade as another user. The module is vulnerable to Cross Site Request Forgeries (CSRF [1]) via the masquerade/switch and masquerade/unswitch paths. -------- VERSIONS AFFECTED --------------------------------------------------- * The unsupported Masquerade module for Drupal 5.x versions * Masquerade module for Drupal 6.x versions prior to 6.x-1.4 Drupal core is not affected. If you do not use the contributed Masquerade [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the unsupported Masquerade module for Drupal 5.x, either disable the module or upgrade to the latest 6.x versions of Drupal core and the Masquerade module. * If you use the Masquerade module for Drupal 6.x upgrade to Masquerade 6.x-1.4 [3] See also the Masquerade project page [4]. -------- REPORTED BY --------------------------------------------------------- * Ivo Van Geertruyen (mr.baileys [5]) of the Drupal security team * Peter Wolanin (pwolanin [6]) of the Drupal security team -------- FIXED BY ------------------------------------------------------------ * Andrew Berry (deviantintegral [7]), module co-maintainer * Allen Freeman (afreeman [8]) * Ivo Van Geertruyen (mr.baileys [9]) of the Drupal security team -------- CONTACT ------------------------------------------------------------- The Drupal security team [10] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Csrf [2] http://drupal.org/project/masquerade [3] http://drupal.org/node/835692 [4] http://drupal.org/project/Masquerade [5] http://drupal.org/user/383424 [6] http://drupal.org/user/49851 [7] http://drupal.org/user/71291 [8] http://drupal.org/user/450370 [9] http://drupal.org/user/383424 [10] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-067 - Views - Multiple vulnerabilities
by security-news＠drupal.org 17 Jun '10

17 Jun '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-067 * Project: Views (third-party module) * Version: 5.x, 6.x * Date: 2010-June-16 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- The Views module provides a flexible method for Drupal site designers to control how lists and tables of content are presented. -------- CROSS SITE REQUEST FORGERY (CSRF) ----------------------------------- The Views UI module, which is included with Views, can be used to enable/disable Views by following a link to a particular page (e.g. admin/build/views/disable/frontpage). As no protections, such as form tokens, are in place to prevent forged requests to these pages, the feature is vulnerable to a Cross Site Request Forgery (CSRF [1]) that would allow an attacker to enable/disable all Views on a site. Mitigating factors: If Views UI module is disabled Views will no longer be affected by this vulnerability. This issue affects Views for Drupal 5 and Drupal 6. -------- CROSS SITE SCRIPTING (XSS) ------------------------------------------ Under certain circumstances, Views could display URLs or aggregator feed titles without escaping, resulting in a Cross Site Scripting (XSS [2]) vulnerability. An attacker could exploit this to gain full administrative access. This issue affects Views for Drupal 6 only. -------- VERSIONS AFFECTED --------------------------------------------------- * Views module for Drupal 5.x versions prior to 5.x-1.8 * Views module for Drupal 6.x versions prior to 6.x-2.11 Drupal core is not affected. If you do not use the contributed Views [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Views module for Drupal 5.x upgrade to Views 5.x-1.8 [4] * If you use the Views module for Drupal 6.x upgrade to Views 6.x-2.11 [5] See also the Views project page [6]. -------- REPORTED BY --------------------------------------------------------- * The Cross Site Request Forgery (CSRF) vulnerability was reported by Martin Barbella (mbarbella [7]). * The Cross Site Scripting (XSS) vulnerabilities were reported by Earl Miles (merlinofchaos [8]), module maintainer and Daniel Wehner (dereine [9]), module co-maintainer -------- FIXED BY ------------------------------------------------------------ * Earl Miles (merlinofchaos [10]), module maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [11] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Csrf [2] http://en.wikipedia.org/wiki/Cross-site_scripting [3] http://drupal.org/project/views [4] http://drupal.org/node/829848 [5] http://drupal.org/node/829846 [6] http://drupal.org/project/views [7] http://drupal.org/user/633600 [8] http://drupal.org/user/26979 [9] http://drupal.org/user/99340 [10] http://drupal.org/user/26979 [11] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-066 - FileField - Cross Site Scripting
by security-news＠drupal.org 17 Jun '10

17 Jun '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-066 * Project: FileField (third-party module) * Version: 5.x, 6.x * Date: 2010-June-16 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- FileField module integrates with the Content Construction Kit to provide a file upload field. It also integrates with the Views and Token modules. The module does not sanitize some of the user-supplied data before displaying it (for Drupal 6.x-3.x only), or before adding it to tokens (both 5.x-2.x and 6.x-3.x), leading to a Cross Site Scripting (XSS [1]) vulnerability that may lead to a malicious user gaining full administrative access. This vulnerability is mitigated by the fact that the attacker must be able to create or edit content with a FileField, and the site administrator must have configured a vulnerable display format ('Path to File' or 'URL to File') or be using token containing the filename, filepath, or description. -------- VERSIONS AFFECTED --------------------------------------------------- * FileField module for Drupal 5.x versions prior to 5.x-2.5 * FileField module for Drupal 6.x versions prior to 6.x-3.4 Drupal core is not affected. If you do not use the contributed FileField [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the FileField module for Drupal 5.x upgrade to FileField 5.x-2.5 [3] * If you use the FileField module for Drupal 6.x upgrade to FileField 6.x-3.4 [4] See also the FileField project page [5]. -------- REPORTED BY --------------------------------------------------------- * Justin Klein Keane [6] * Peter Wolanin [7] of the Drupal security team -------- FIXED BY ------------------------------------------------------------ * Peter Wolanin [8] of the Drupal security team * Justin Klein Keane [9] * Nathan Haug [10], the module maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [11] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/filefield [3] http://drupal.org/node/829790 [4] http://drupal.org/node/829754 [5] http://drupal.org/project/filefield [6] http://drupal.org/user/302225 [7] http://drupal.org/user/49851 [8] http://drupal.org/user/49851 [9] http://drupal.org/user/302225 [10] http://drupal.org/user/35821 [11] http://drupal.org/security-team

1 0