- Security-news - lists.drupal.org

SA-CONTRIB-2010-047: Services - Access Bypass
by security-news＠drupal.org 12 May '10

12 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-047 * Project: Services (third-party module) * Version: 6.x * Date: 2010-May-12 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- The Services module allows users to expose Drupal functionality to remote users. Services provides the ability for developers to define access callbacks in code for exposed services. When using session ID authentication without API key authentication, the module does not properly check access when a service is using the default access callback. This allows users to access functionality which should have been controlled by user permissions. This vulnerability is nonexistent if session ID authentication is used in combination with API key authentication. -------- VERSIONS AFFECTED --------------------------------------------------- * Services module for Drupal 6.x versions prior to 6.x-2.1 Drupal core is not affected. If you do not use the contributed Services [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use the Services module for Drupal 6.x upgrade to Services 6.x-2.1 [2] -------- REPORTED BY --------------------------------------------------------- * Edsko de Vries [3] * Greg Dunlap [4], the module maintainer -------- FIXED BY ------------------------------------------------------------ * Greg Dunlap [5], the module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [6]. Read more about the Security Team and Security Advisories at http://drupal.org/security. [1] http://drupal.org/project/services [2] http://drupal.org/node/797264 [3] http://drupal.org/user/527220 [4] http://drupal.org/user/128537 [5] http://drupal.org/user/128537 [6] http://drupal.org/contact

1 0

SA-CONTRIB-2010-046: Award - Cross Site Scripting
by security-news＠drupal.org 12 May '10

12 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-046 * Project: Award (third-party module) * Version: 5.x, 6.x * Date: 2010-May-12 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Award module allows administrators to identify one or more content types as "awards" that can be granted to users. When the title of an award is displayed on a user's profile page it is not properly sanitized, resulting in a cross site scripting vulnerability. Attackers must have the permission to create Award content to exploit. -------- VERSIONS AFFECTED --------------------------------------------------- * Award module for Drupal 5.x versions prior to 5.x-1.2 * Award module for Drupal 6.x versions prior to 6.x-1.1 Drupal core is not affected. If you do not use the contributed Award [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use the Award module for Drupal 5.x upgrade to Award 5.x-1.2 [2] * If you use the Award module for Drupal 6.x upgrade to Award 6.x-1.1 [3] -------- REPORTED BY --------------------------------------------------------- * Martin Barbella [4] -------- FIXED BY ------------------------------------------------------------ * Josh Benner [5], the module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [6]. Read more about the Security Team and Security Advisories at http://drupal.org/security. [1] http://drupal.org/project/award [2] http://drupal.org/node/795836 [3] http://drupal.org/node/795828 [4] http://drupal.org/user/633600 [5] http://drupal.org/user/150069 [6] http://drupal.org/contact

1 0

SA-CONTRIB-2010-045 - Auto Assign Role - Access bypass
by security-news＠drupal.org 12 May '10

12 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-045 * Project: Auto Assign Role (third-party module) * Version: 6.x * Date: 2010-May-12 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- The Auto Assign Role serves three primary purposes. The first is to provide an automatic assignment of roles when a new account is created. The second is to allow the end user the option of choosing their own role or roles when they create their account. The third is to provide paths that will trigger a specific role when an account is created. Auto Assign Role recently added a node autocomplete that did not properly utilize the Drupal node access API. This may allow users with the 'administer autoassignrole' permission users to view the content of nodes that they should not have permission to access. -------- VERSIONS AFFECTED --------------------------------------------------- * AutoAssign Role [1] module for Drupal 6.x version prior to 6.x-1.2. Drupal core is not affected. If you do not use the contributed Auto Assign Role module for Drupal 6.x, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version or disable the module. If you use Auto Assign Role prior to 6.x-1.2, upgrade to Auto Assign Role 6.x-1.2 [2] -------- REPORTED BY --------------------------------------------------------- * mr.baileys [3]. -------- FIXED BY ------------------------------------------------------------ * Kevin Bridges [4], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [5]. Read more about the Security Team and Security Advisories at http://drupal.org/security. [1] http://drupal.org/project/autoassignrole [2] http://drupal.org/node/795926 [3] http://drupal.org/user/383424 [4] [5] http://drupal.org/contact

1 0

SA-CONTRIB-2010-044: Bibliography - Cross Site Scripting
by security-news＠drupal.org 12 May '10

12 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-044 * Project: Bibliography (third-party module) * Version: 5.x, 6.x * Date: 2010-May-12 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Bibliography module enables users to manage and display lists of scholarly publications. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability. This is mitigated by the fact that only users with the 'administer biblio' permission are able to exploit this vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Bibliography module 5.x-1.17 and prior versions * Bibliography module 6.x-1.9 and prior versions Drupal core is not affected. If you do not use the contributed Bibliography [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Bibliography for Drupal 5.x upgrade to Bibliography 5.x-1.20 [3] * If you use Bibliography for Drupal 6.x upgrade to Bibliography 6.x-1.11 [4] See also the Bibliography project page [5]. -------- REPORTED BY --------------------------------------------------------- * Martin Barbella [6] -------- FIXED BY ------------------------------------------------------------ Ron Jerome [7], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [8]. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/biblio [3] http://drupal.org/node/796498 [4] http://drupal.org/node/796502 [5] http://drupal.org/project/biblio [6] http://drupal.org/user/633600 [7] http://drupal.org/user/54997 [8] http://drupal.org/contact

1 0

SA-CONTRIB-2010-043: Wordfilter - Cross Site Scripting
by security-news＠drupal.org 12 May '10

12 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-043 * Project: Wordfilter (third-party module) * Version: 5.x, 6.x * Date: 2010-May-12 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Wordfilter module implements an input filter that rewrites content to remove improper or foul language. Wordfilter does not sanitize the list of words that are filtered along with their replacements, allowing users with permissions to manage the list of banned words to insert arbitrary HTML and script code. Such a cross site scripting [1] (XSS) attack may lead to a malicious user gaining full administrative access. This vulnerability is mitigated by the attacker needing the "administer words filtered" permission in order to exploit it. -------- VERSIONS AFFECTED --------------------------------------------------- * Wordfilter 5.x prior to 5.x-1.1 [2] * Wordfilter 6.x prior to 6.x-1.1 [3] Drupal core is not affected. If you do not use the contributed Wordfilter module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Wordfilter module for Drupal 5.x, update to Wordfilter 5.x-1.1 [4]. * If you use Wordfilter module for Drupal 6.x, update to Wordfilter 6.x-1.1 [5]. See also the Wordfilter project page [6] -------- REPORTED BY --------------------------------------------------------- * mr.baileys [7] of the Drupal Security Team [8]. -------- FIXED BY ------------------------------------------------------------ * Jeff Warrington (jaydub) [9], module co-maintainer. -------- CONTACT ------------------------------------------------------------- The Security Team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [10]. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/796620 [3] http://drupal.org/node/796618 [4] http://drupal.org/node/796620 [5] http://drupal.org/node/796618 [6] http://drupal.org/project/wordfilter [7] http://drupal.org/user/383424 [8] http://drupal.org/security-team [9] http://drupal.org/user/46257 [10] http://drupal.org/contact

1 0

SA-CONTRIB-2010-042: LoginToboggan - Session fixation
by security-news＠drupal.org 12 May '10

12 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-042 * Project: LoginToboggan (third-party module) * Version: 5.x, 6.x * Date: 2010-05-12 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Session fixation -------- DESCRIPTION --------------------------------------------------------- The LoginToboggan module provides a customized log in workflow. Attackers may be able to exploit the workflow to initiate a session fixation [1] attack. -------- VERSIONS AFFECTED --------------------------------------------------- * LoginToboggan versions for the 5.x and 6.x versions of Drupal Drupal core is not affected. If you do not use the contributed LoginToboggan module for Drupal 5.x or 6.x, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version of the module: * 5.x: LoginToboggan 5.x-1.7 [2] * 6.x: LoginToboggan 6.x-1.7 [3] See also the LoginToboggan [4] project page. -------- REPORTED BY --------------------------------------------------------- * Chad Phillips (hunmonk [5]), the module maintainer and member of the Drupal Security Team. -------- FIXED BY ------------------------------------------------------------ * Chad Phillips (hunmonk [6]), the module maintainer and member of the Drupal Security Team. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [7]. Read more about the Security Team and Security Advisories at http://drupal.org/security. [1] http://en.wikipedia.org/wiki/Session_fixation [2] http://drupal.org/node/797154 [3] http://drupal.org/node/797158 [4] http://drupal.org/project/logintoboggan [5] http://drupal.org/user/22079 [6] http://drupal.org/user/22079 [7] http://drupal.org/contact

1 0

SA-CONTRIB-2010-041: ImageField - Access Bypass
by security-news＠drupal.org 06 May '10

06 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-41 * Project: ImageField (third-party module) * Version: 6.x * Date: 2010-May-5 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- ImageField provides a file upload field for CCK, allowing files to be attached to a node. ImageField intends to set a default extension of "png jpg gif" for all new fields, but may actually save an empty string allowing all of the "png jpg gif" extensions if an administrator does not save the field configuration page after creating a new field. Any ImageField that has been initially saved or edited with any extensions specified is not affected. This vulnerability is mitigated by the attacker needing permission to create or edit content with an unconfigured ImageField. ImageField also creates thumbnails after uploading a new image. A second vulnerability is that this thumbnail is not properly checked for access if using the Private Downloads setting, allowing users that may not have access to view the full size image to still view the administrative thumbnail. -------- VERSIONS AFFECTED --------------------------------------------------- * ImageField for Drupal 6.x versions prior to 6.x-3.3 Drupal core is not affected. If you do not use the contributed ImageField [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use ImageField for Drupal 6.x upgrade to ImageField 6.x-3.3 [2] -------- REPORTED BY --------------------------------------------------------- * vb1 [3] -------- FIXED BY ------------------------------------------------------------ * Nathan Haug [4] the module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/imagefield [2] http://drupal.org/node/791030 [3] http://drupal.org/user/690402 [4] http://drupal.org/user/35821

1 0

SA-CONTRIB-2010-040: FileField - Access Bypass
by security-news＠drupal.org 06 May '10

06 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-40 * Project: FileField (third-party module) * Version: 6.x * Date: 2010-May-5 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- FileField provides a file upload field for CCK, allowing files to be attached to a node. FileField intends to set a default extension of "txt" for all new fields, but may actually save an empty string allowing all extensions if an administrator does not save the field configuration page after creating a new field. Execution of code in uploaded files is normally prevented by .htaccess rules, regardless of file extension. Any FileField that has been initially saved or edited with any extensions specified is not affected. This vulnerability is mitigated by the attacker needing permission to create or edit content with an unconfigured FileField. -------- VERSIONS AFFECTED --------------------------------------------------- * FileField for Drupal 6.x versions prior to 6.x-3.3 Drupal core is not affected. If you do not use the contributed FileField [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use FileField for Drupal 6.x upgrade to FileField 6.x-3.3 [2] -------- REPORTED BY --------------------------------------------------------- * David Rothstein [3] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Nathan Haug [4] the module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/filefield [2] http://drupal.org/node/791032 [3] http://drupal.org/user/124982 [4] http://drupal.org/user/35821

1 0

SA-CONTRIB-2010-039: CCK TableField - Cross Site Scripting
by security-news＠drupal.org 06 May '10

06 May '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-039 * Project: CCK TableField (third-party module) * Version: 6.x * Date: 2010-May-05 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The CCK TableField module provides a generic method to attach tabular data to a node. CCK TableField does not sanitize table headers before output, allowing anyone with permissions to create or edit a node containing one or more TableField fields to insert arbitrary HTML and script code. Such a cross site scripting [1] (XSS) attack may also lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * CCK TableField module for Drupal 6.x version prior to 6.x-1.2. Drupal core is not affected. If you do not use the contributed CCK TableField module for Drupal 6.x, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version or disable the module. * If you use CCK TableField 6.x-1.1 or older, upgrade to CCK TableField 6.x-1.2 [2] See also the CCK TableField [3] project page. -------- REPORTED BY --------------------------------------------------------- * mr.baileys [4] of the Drupal Security Team [5]. -------- FIXED BY ------------------------------------------------------------ * Kevin Hankens [6], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [7]. Read more about the Security Team and Security Advisories at http://drupal.org/security. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/790364 [3] http://drupal.org/project/tablefield [4] http://drupal.org/user/383424 [5] http://drupal.org/security-team [6] http://drupal.org/user/78090 [7] http://drupal.org/contact

1 0

SA-CONTRIB-2010-038 - Privatemsg - Access bypass
by security-news＠drupal.org 28 Apr '10

28 Apr '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-038 * Project: Privatemsg (third-party module) * Version: 6.x * Date: 2010-April-28 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- The Privatemsg module allows to send private messages between users. Additionally, the sub module Privatemsg Email Notification sends e-mail notification when such a message is sent. The page to configure the template for these e-mails does not use the correct access permission which allows all users with the read privatemsg permission to access and alter the settings on that page. -------- VERSIONS AFFECTED --------------------------------------------------- * Privatemsg for Drupal 6.x versions prior to 6.x-1.2 Drupal core is not affected. If you do not use the contributed Privatemsg [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use Privatemsg for Drupal 6.x upgrade to Privatemsg 6.x-1.2 [2] -------- REPORTED BY --------------------------------------------------------- * Lee Rowlands [3], module maintainer -------- FIXED BY ------------------------------------------------------------ * Lee Rowlands [4], module maintainer. * Sascha Grossebacher [5], module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/privatemsg [2] http://drupal.org/node/784598 [3] http://drupal.org/user/395439 [4] http://drupal.org/user/395439 [5] http://drupal.org/user/214652

1 0