- Security-news - lists.drupal.org

SA-CONTRIB-2010-037 - Decisions - Access bypass
by security-news＠drupal.org 28 Apr '10

28 Apr '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-037 * Project: Decisions (third-party module) * Version: 5.x, 6.x * Date: 2010-April-28 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- Decisions is a replacement for poll.module and provides advanced voting systems and decision-making tools. It aims to enable groups to take decisions online in a manner that replicates and augments what is possible in face-to-face meeting. In some listings, the Decisions module does not construct its SQL query to respect node access restrictions, thus users can see listings of nodes which should not be accessible to them. -------- VERSIONS AFFECTED --------------------------------------------------- * Decisions for Drupal 5.x versions prior to 5.x-1.2 * Decisions for Drupal 6.x versions prior to 6.x-1.7 Drupal core is not affected. If you do not use the contributed Decisions [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use Decisions for Drupal 5.x upgrade to Decisions 5.x-1.2 [2] * If you use Decisions for Drupal 6.x upgrade to Decisions 6.x-1.7 [3] -------- REPORTED BY --------------------------------------------------------- * Kirill Stealth [4] -------- FIXED BY ------------------------------------------------------------ * Antoine Beaupré [5], module maintainer. * Ezra Barnett Gildesgame [6], module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/decisions [2] http://drupal.org/node/784444 [3] http://drupal.org/node/783766 [4] http://drupal.org/user/205226 [5] http://drupal.org/user/1274 [6] http://drupal.org/user/69959

1 0

SA-CONTRIB-2010-036 - Views - multiple vulnerabilities
by security-news＠drupal.org 08 Apr '10

08 Apr '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-036 * Project: Views (third-party module) * Version: 5.x, 6.x * Date: 2010-April-7 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting (XSS), arbitrary code execution -------- DESCRIPTION --------------------------------------------------------- The Views module provides a flexible method for Drupal site designers to control how lists of content are presented. Views accepts parameters in the URL and uses them in an AJAX callback. The values were not filtered, thus allowing injection of JavaScript code via the AJAX response. A user tricked into visiting a crafted URL could be exposed to arbitrary script or HTML injected into the page. In addition, the Views module does not properly sanitize file descriptions when displaying them in a view, thus the the file desciptions may be used to inject arbitrary script or HTML. Such cross site scripting [1] (XSS) attacks may lead to a malicious user gaining full administrative access. These vulnerabilities affect only the Drupal 6 version. The file description vulnerability is mitigated by the fact that the attacker must have permission to upload files. In both the Drupal 5 and Drupal 6 versions, users with permission to 'administer views' can execute arbitrary PHP code using the views import feature. An additional check for the permission 'use PHP for block visibility' has been added to insure that the site administrator has already granted users of the import functionality the permission to execute PHP. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions of Views for Drupal 6.x prior to 6.x-2.9 * Versions of Views for Drupal 5.x prior to 5.x-1.7 Note - the 6.x-3.x branch alpha releases are affected also. If you do not use the contributed Views module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Views for Drupal 6.x upgrade to Views 6.x-2.9 [2] or any later version. * If you use Views for Drupal 6.x upgrade to Views 5.x-1.7 [3] or any later version. Also see the Views [4] project page. -------- REPORTED BY --------------------------------------------------------- * XSS via AJAX parameters reported by Angel Lozano Alcazar of S21Sec * XSS via file descriptions reported by Martin Barbella [5] * PHP execution reported by Derek Wright (dww [6]) of the Drupal Security Team [7] -------- FIXED BY ------------------------------------------------------------ * Earl Miles (merlinofchaos [8]) Views project maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/765088 [3] http://drupal.org/node/765090 [4] http://drupal.org/project/views [5] http://drupal.org/user/633600 [6] http://drupal.org/user/46549 [7] http://drupal.org/security-team [8] http://drupal.org/user/26979

1 0

SA-CONTRIB-2010-035: Smileys - Cross Site Request Forgery
by security-news＠drupal.org 08 Apr '10

08 Apr '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-035 * Project: Smileys (third-party module) * Versions: 5.x * Date: 2010-April-07 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross-site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Smileys module provides a text filter that substitutes emoticons with images. The module is vulnerable to cross-site request forgeries (CSRF [1]) via the URL used to delete smileys. A user with "administer smileys" permission could be tricked into visiting the smiley delete URL and unwittingly remove smileys from the site. -------- VERSIONS AFFECTED --------------------------------------------------- * Smileys module for Drupal 5.x version prior to 5.x-1.2 [2]. *Note that Smileys version 6.x-1.0-alpha5 and earlier versions for Drupal 6.x are also affected. However, the security team does not provide support for alpha releases.* Drupal core is not affected. If you do not use the contributed Smileys module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use the Smileys module for Drupal 5.x-1.x upgrade to Smileys 5.x-1.2 [3] See also the Smileys project page [4]. -------- REPORTED BY --------------------------------------------------------- * Andrey Tretyakov [5] -------- FIXED BY ------------------------------------------------------------ * Gurpartap Singh [6], the module maintainer * mr.baileys [7] of the Drupal security team. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [8]. [1] http://en.wikipedia.org/wiki/Csrf [2] http://drupal.org/node/764826 [3] http://drupal.org/node/764826 [4] http://drupal.org/project/smileys [5] http://drupal.org/user/169459 [6] http://drupal.org/user/41470 [7] http://drupal.org/user/383424 [8] http://drupal.org/contact

1 0

SA-CONTRIB-2010-034 - Internationalization - Cross Site Scripting
by security-news＠drupal.org 08 Apr '10

08 Apr '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-034 * Project: Internationalization (third-party module) * Version: 6.x * Date: 2010-April-7 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Internationalization module enables translation of user defined strings using Drupal's locale interface. Some of these user defined strings have Input formats associated with them and some of the strings used for translating blocks were not properly filtered before display. Additionally all strings translated using this module were not checked for potential malicious HTML and script code as regular Drupal string translations are. Both issues would allow a user with the 'translate interface' or the 'administer blocks' permissions to attempt a cross site scripting (XSS) attack which may lead to the user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Internationalization 6.x prior to 6.x-1.4 Drupal core is not affected. If you do not use the contributed Internationalization module, there is nothing you need to do. Also if you are not using Internationalization's 'String translation' (i18nstrings) module you don't need to update. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Internationalization module for Drupal 6.x, update to Internationalization 6.x-1.4 [1] and run the Drupal database update. See also the Internationalization project page [2] -------- REPORTED BY --------------------------------------------------------- * Antonio Ospite [3] -------- FIXED BY ------------------------------------------------------------ * Jose Reyero [4], the module maintainer. -------- CONTACT ------------------------------------------------------------- The Security Team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [5]. [1] http://drupal.org/node/764906 [2] http://drupal.org/project/i18n [3] http://drupal.org/user/234884 [4] http://drupal.org/user/4299 [5] http://drupal.org/contact

1 0

SA-CONTRIB-2010-033 - Taxonomy Filter - Cross Site Scripting (XSS)
by security-news＠drupal.org 31 Mar '10

31 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-033 * Project: Taxonomy Filter (third-party module) * Version: 6.x * Date: 2010-March-31 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Taxonomy Filter module enables users to filter node listings by multiple taxonomy terms across multiple vocabularies. Vocabulary names, terms, and filter menus are not sanitized, creating a Cross Site Scripting (XSS) vulnerability. Exploiting this vulnerability would allow a malicious user to gain full administrative access, or worse. To exploit the vulnerability a user would either need to have a role with 'administer taxonomy' permission or a site would need to use free tagging and a user would need the ability to create a node that has free tagging enabled. -------- VERSIONS AFFECTED --------------------------------------------------- * Versions of Taxonomy Filter for Drupal 6.x prior to 6.x-1.1 [1] Versions of Taxonomy Filter for Drupal 5.x are not affected. Drupal core is not affected. If you do not use the 6.x version of the contributed Taxonomy Filter module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Taxonomy Filter for Drupal 6.x upgrade to Taxonomy Filter 6.x-1.1 [2] or any later version. Also see the Taxonomy Filter [3] project page. -------- REPORTED BY --------------------------------------------------------- * Dylan Wilder-Tack [4] of the Drupal security team. -------- FIXED BY ------------------------------------------------------------ * Dylan Wilder-Tack [5] of the Drupal security team. * Solotandem [6], the module maintainer -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/622096 [2] http://drupal.org/node/622096 [3] http://drupal.org/project/taxonomy_filter [4] http://drupal.org/user/96647 [5] http://drupal.org/user/96647 [6] http://drupal.org/user/240748

1 0

SA-CONTRIB-2010-032 - Taxonomy Breadcrumb - Cross Site Scripting (XSS)
by security-news＠drupal.org 31 Mar '10

31 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-032 * Project: Taxonomy Breadcrumb (third-party module) * Versions: 6.x-1.x, 5.x-1.x * Date: 2010-March-31 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Taxonomy Breadcrumb module generates taxonomy based breadcrumbs on node pages and taxonomy/term pages. This module does not properly sanitize taxonomy term name and, for 6.x, node titles when displayed in breadcrumbs, leading to a Cross Site Scripting (XSS [1]) vulnerability. XSS vulnerabilities may lead to compromise of administrative accounts or other attacks against site visitors. -------- VERSIONS AFFECTED --------------------------------------------------- * Taxonomy Breadcrumb module for Drupal 6.x version prior to 6.x-1.1. * Taxonomy Breadcrumb module for Drupal 5.x versions prior to 5.x-1.5. Drupal core is not affected. If you do not use the contributed Taxonomy Breadcrumb module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use the Taxonomy Breadcrumb module for Drupal 6.x-1.x upgrade to Taxonomy Breadcrumb 6.x-1.1 [2] * If you use the Taxonomy Breadcrumb module for Drupal 5.x-1.x upgrade to Taxonomy Breadcrumb 5.x-1.5 [3] -------- REPORTED BY --------------------------------------------------------- * Martin Barbella [4] -------- FIXED BY ------------------------------------------------------------ * Martin Barbella [5] * Peter Wolanin [6] of the Drupal Security Team [7]. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/757980 [3] http://drupal.org/node/757974 [4] http://drupal.org/user/633600 [5] http://drupal.org/user/633600 [6] http://drupal.org/user/49851 [7] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-031 - Menu Block - Cross Site Scripting (XSS)
by security-news＠drupal.org 25 Mar '10

25 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-031 * Project: Menu Block (third-party module) * Versions: 6.x-2.x, 5.x-2.x, 5.x-1.x * Date: 2010-March-24 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Menu Block module generates full or partial menu trees that are presented in configurable blocks. When partial menu trees are displayed, the block title uses the text from the partial menu tree's parent menu item. However, that text is not properly sanitized, leading to a Cross Site Scripting (XSS) vulnerability. XSS vulnerabilities may expose site administrative accounts which could lead to a variety of additional compromises. This vulnerability is mitigated by the fact that an attacker must have the "administer menu" permission which should generally only be granted to trusted roles. -------- VERSIONS AFFECTED --------------------------------------------------- * Menu Block module for Drupal 6.x version prior to 6.x-2.3. * Menu Block module for Drupal 5.x versions prior to 5.x-2.1 or 5.x-1.1. Drupal core is not affected. If you do not use the contributed Menu Block module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use the Menu Block module for Drupal 6.x-2.x upgrade to Menu Block 6.x-2.3 [1] * If you use the Menu Block module for Drupal 5.x-2.x upgrade to Menu Block 5.x-2.1 [2] * If you use the Menu Block module for Drupal 5.x-1.x upgrade to Menu Block 5.x-1.1 [3] -------- REPORTED BY --------------------------------------------------------- * imonemus [4] -------- FIXED BY ------------------------------------------------------------ * JohnAlbin [5], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/752248 [2] http://drupal.org/node/752246 [3] http://drupal.org/node/752244 [4] http://drupal.org/user/682372 [5] http://drupal.org/user/32095

1 0

SA-CONTRIB-2010-030: Mime Mail - Arbitrary code execution
by security-news＠drupal.org 24 Mar '10

24 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-030 * Project: Mime Mail (third-party module) * Version: 5.x * Date: 2010-March-24 * Security risk: Highly critical * Exploitable from: Remote * Vulnerability: Arbitrary code execution -------- DESCRIPTION --------------------------------------------------------- The Mime Mail module is an helper module providing support for MIME mails, for use by other modules. Due to improper use of the PCRE regular expression engine, users with the ability to send HTML email with the Mime Mail module were able to execute arbitrary PHP code on the server. -------- VERSIONS AFFECTED --------------------------------------------------- * Mime Mail for Drupal 5.x prior to 5.x-1.1 *Note that Mime Mail version 6.x-1.0-alpha1 and earlier versions for Drupal 6.x are also affected. However, the security team does not provide support for alpha releases.* Drupal core is not affected. If you do not use the contributed Mime Mail module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Mime Mail for Drupal 5.x upgrade to Mime Mail 5.x-1.1 [1] See also the Mime Mail project page [2]. -------- REPORTED BY --------------------------------------------------------- * Martin Barbella [3] * Damien Tournoud [4] of the Drupal Security Team [5]. -------- FIXED BY ------------------------------------------------------------ * Peter Wolanin [6] of the Drupal Security Team [7]. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/752166 [2] http://drupal.org/project/mimemail [3] http://drupal.org/user/633600 [4] http://drupal.org/user/22211 [5] http://drupal.org/security-team [6] http://drupal.org/user/49851 [7] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-029: Keys - Cross-site Request Forgery
by security-news＠drupal.org 17 Mar '10

17 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-029 * Project: Keys (third-party module) * Version: 6.x * Date: 2010-March-17 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross-site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Keys module provides management of various API keys. The module is vulnerable to cross-site request forgeries (CSRF [1]) via the keys delete form. This would allow a malicious user to trick an admin with the "administer keys" permission into deleting keys by directing them to the url via link or image src, etc. -------- VERSIONS AFFECTED --------------------------------------------------- * Keys for Drupal 6.x prior to Keys 6.x-2.0 Drupal core is not affected. If you do not use the contributed Keys module for Drupal 6.x, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Keys for Drupal 6.x upgrade to Keys 6.x-2.0 [2] or simply disable the Keys module. Be sure to backup saved keys prior to upgrade. See also the Keys project page [3]. -------- REPORTED BY --------------------------------------------------------- Steven Jones [4]. -------- FIXED BY ------------------------------------------------------------ James Jeffery [5], Keys module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Csrf [2] http://drupal.org/node/676104 [3] http://drupal.org/project/keys [4] http://drupal.org/user/99644 [5] http://drupal.org/user/173855

1 0

SA-CONTRIB-2010-028 - Tag Order - Cross Site Scripting
by security-news＠drupal.org 17 Mar '10

17 Mar '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-028 * Project: Tag Order (third-party module) * Version: 5.x, 6.x * Date: 2010-March-17 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Tag Order module allows you to select vocabularies whose terms you would like to preserve in the original order entered per node. Taxonomy vocabulary names are not sanitized when being displayed on an administrative page, leading to a cross-site scripting (XSS [1]) vulnerability. Such an attack may lead to a malicious user gaining full administrative access. Mitigating factor: only users with the 'administer taxonomy' permission can enter or edit vocabulary names. -------- VERSIONS AFFECTED --------------------------------------------------- * Tag Order for Drupal 6.x prior to 6.x-1.4 * Tag Order for Drupal 5.x prior to 5.x-1.4 Drupal core is not affected. If you do not use the contributed Tag Order module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Tag Order for Drupal 6.x upgrade to Tag Order 6.x-1.4 [2] * If you use Tag Order for Drupal 5.x upgrade to Tag Order 5.x-1.4 [3] See also the Tag Order project page [4]. -------- REPORTED BY --------------------------------------------------------- * Martin Barbella [5] -------- FIXED BY ------------------------------------------------------------ * Martin Barbella [6] -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/745338 [3] http://drupal.org/node/745346 [4] http://drupal.org/project/tagorder [5] http://drupal.org/user/633600 [6] http://drupal.org/user/633600

1 0