Security-news

security-news@drupal.org

1 participants
1782 discussions

SA-CONTRIB-2009-052 - Printer, e-mail and PDF versions - Cross site scripting
by security-news＠drupal.org 20 Aug '09

20 Aug '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-052 * Project: Printer, e-mail and PDF versions (Print) (third-party modules) * Version: 5.x, 6.x * Date: 2009-August-19 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Printer, e-mail and PDF versions ("Print") module provides printer-friendly versions of content. The module doesn't properly escape a number of user-supplied variables before output. A user who has the permission to add content could attempt a cross site scripting [1] (XSS) attack which may in some cases lead to the user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Print versions 6.x prior to 6.x-1.8 * Print versions 5.x prior to 5.x-4.8 Drupal core is not affected. If you do not use the contributed Print module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Print module on Drupal 6.x upgrade to 6.x-1.8 [2] * If you use the Print module on Drupal 5.x upgrade to 5.x-4.8 [3] See also the Print module project page [4]. -------- REPORTED BY --------------------------------------------------------- Justin Klein Keane [5]. -------- FIXED BY ------------------------------------------------------------ João Ventura [6], the "Printer, e-mail and PDF versions" project maintainer, with assistance from Ben Jeavons [7] of the Drupal Security Team [8] -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/554328 [3] http://drupal.org/node/554326 [4] http://drupal.org/project/print [5] http://drupal.org/user/302225 [6] http://drupal.org/user/122464 [7] http://drupal.org/user/91990 [8] http://drupal.org/security-team

1 0

SA-2009-051 - ImageCache - Multiple vulnerabilities
by security-news＠drupal.org 19 Aug '09

19 Aug '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-051 * Project: ImageCache (third-party modules) * Version: 5.x, 6.x * Date: 2009-August-19 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- ImageCache allows one to setup presets for image processing to create derivatives. ImageCache will dynamically generate a derivative on access if it doesn't exist. .... Cross site scripting Users with the "administer imagecache" permission are able to execute cross site scripting [1] attacks because the ImageCache module doesn't properly escape a number of user-supplied preset variables before output. .... Access bypass ImageCache doesn't properly check access to originals when generating derivative images. When the private filesystem is enabled, and access to images is restricted, unprivileged users may still access an image if they know the image's filename. -------- VERSIONS AFFECTED --------------------------------------------------- * ImageCache versions for Drupal 5.x prior to 5.x-2.5 * ImageCache versions for Drupal 6.x prior to 6.x-2.0-beta10 Drupal core is not affected. If you do not use the contributed ImageCache module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use ImageCache on Drupal 5.x upgrade to 5.x-2.5 [2] * If you use ImageCache on Drupal 6.x upgrade to 6.x-2.0-beta10 [3] Beta software is not recommended for use on production sites. Such releases are not supported by the security team. Nevertheless, the maintainer elected to release 6.x-2.0-beta10 fixing the issues described in this announcement. See also the ImageCache project page [4]. -------- REPORTED BY --------------------------------------------------------- * The cross site scripting was reported by Justin Klein Keane [5]. * The access bypass was reported by Karl Scheirer [6]. -------- FIXED BY ------------------------------------------------------------ Andrew Morton [7] (the module maintainer). -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/554086 [3] http://drupal.org/node/554090 [4] http://drupal.org/project/imagecache [5] http://drupal.org/user/302225 [6] http://drupal.org/user/128191 [7] http://drupal.org/user/34869

1 0

SA-CONTRIB-2009-050 - Webform report - Cross site scripting
by security-news＠drupal.org 05 Aug '09

05 Aug '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-050 * Project: Webform report (third-party module) * Version: All * Date: 2009-Aug-5 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Cross site scripting -------- DESCRIPTION --------------------------------------------------------- Webform report [1] allows users to create simple, dynamic reports based on data collected by the webform module. When displaying the results of Webform submissions, the module does not properly escape user entered data, leading to a cross-site scripting [2] (XSS) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Webform for Drupal 5.x * Webform for Drupal 6.x Drupal core is not affected. If you do not use the contributed webform report module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ There is no solution available. Please disable the module and remove it from your server. -------- REPORTED BY --------------------------------------------------------- Stéphane Corlosquet [3] -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/webform_report [2] http://en.wikipedia.org/wiki/Cross-site_scripting [3] http://drupal.org/user/52142

1 0

SA-CONTRIB-2009-049 - Live - Privilege escalation, Impersonation
by security-news＠drupal.org 29 Jul '09

29 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-049 * Project: Live (third-party module) * Version: 6.x * Date: 2009-July-29 * Security risk: Highly critical * Exploitable from: Remote * Vulnerability: Impersonation, privilege escalation -------- DESCRIPTION --------------------------------------------------------- The Live module provides dynamic previews of content. When editing certain content (nodes), the current user becomes logged in as the content's original author. -------- VERSIONS AFFECTED --------------------------------------------------- * Live for Drupal 6.x prior to 6.x-1.2 Drupal core is not affected. If you do not use the contributed Live module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Live for Drupal 6.x upgrade to Live 6.x-1.2 [1] See also the Live project page [2]. -------- REPORTED BY --------------------------------------------------------- Roderik Muit [3] -------- FIXED BY ------------------------------------------------------------ frjo [4] -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/534976 [2] http://drupal.org/project/live [3] http://drupal.org/user/8841 [4] http://drupal.org/user/5546

1 0

SA-CONTRIB-2009-048 - Bibliography Module - Cross Site Scripting
by security-news＠drupal.org 29 Jul '09

29 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-048 * Project: Bibliography Module (third-party module) * Version: 5.x, 6.x * Date: 2009-July-29 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Bibliography module (Biblio) allows users to manage and display lists of scholarly publications. The module contains a cross site scripting vulnerability because it does not properly sanitize output of titles before display. A user who has the permission to create content displayed by the Bibliography module could attempt a cross site scripting [1] (XSS) attack which may lead to the user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Bibliography Module versions 6.x prior to 6.x-1.6 * Bibliography Module versions 5.x prior to 5.x-1.17 Drupal core is not affected. If you do not use the contributed Bibliography module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Bibliography Module for Drupal 6.x upgrade to Bibliography Module 6.x-1.6 [2] * If you use the Bibliography Module for Drupal 5.x upgrade to Bibliography Module 5.x-1.17 [3] See also the Bibliography Module project page [4]. -------- REPORTED BY --------------------------------------------------------- Justin Klein Keane [5]. -------- FIXED BY ------------------------------------------------------------ Justin Klein Keane [6] and Ron Jerome [7] (the Bibliography module maintainer). -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/534744 [3] http://drupal.org/node/534752 [4] http://drupal.org/project/biblio [5] http://drupal.org/user/302225 [6] http://drupal.org/user/302225 [7] http://drupal.org/user/54997

1 0

SA-CONTRIB-2009-047 - Calendar - Cross Site Scripting
by security-news＠drupal.org 29 Jul '09

29 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-047 * Project: Calendar (third-party module) * Version: 6.x * Date: 2009-July-29 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Calendar module enables Views module to display any Date module date field as a calendar. The module does not properly escape user input when displaying titles of content types that have Date fields. A user with permission to create new content types (including via the Date module's Date Tools sub-module) could attempt a cross site scripting [1] (XSS) attack, leading to the user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Calendar for Drupal 6.x prior to 6.x-2.2 Drupal core is not affected. If you do not use the contributed Calendar module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Calendar for Drupal 6.x upgrade to Calendar 6.x-2.2 [2] See also the Calendar project page [3]. -------- REPORTED BY --------------------------------------------------------- Justin C. Klein Keane [4] -------- FIXED BY ------------------------------------------------------------ Justin C. Klein Keane [5] -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/534336 [3] http://drupal.org/project/calendar [4] http://drupal.org/user/302225 [5] http://drupal.org/user/302225

1 0

SA-CONTRIB-2009-046 - Date - Cross Site Scripting
by security-news＠drupal.org 29 Jul '09

29 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-046 * Project: Date (third-party module) * Version: 6.x * Date: 2009-July-29 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Date module provides a date CCK field that can be added to any content type. The Date Tools module that is bundled with Date module does not properly escape user input when displaying labels for fields on a content type. A malicious user with the 'use date tools' permission of the Date Tools sub-module, or the 'administer content types' permission could attempt a cross site scripting [1] (XSS) attack when creating a new content type, leading to the user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Date for Drupal 6.x prior to 6.x-2.3 Drupal core is not affected. If you do not use the contributed Date module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Date for Drupal 6.x upgrade to Date 6.x-2.3 [2] Note that the 'use date tools' permission has been renamed as 'administer date tools' to clarify that this is an administrative permission (it allows the creation of new content types via a wizard form). You will need to re-assign this permission to any roles that were using it. See also the Date project page [3]. -------- REPORTED BY --------------------------------------------------------- Stella Power [4] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ Stella Power [5] and Karen Stevenson [6], the project maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/534332 [3] http://drupal.org/project/date [4] http://drupal.org/user/66894 [5] http://drupal.org/user/66894 [6] http://drupal.org/user/45874

1 0

SA-CONTRIB-2009-045: Moderation - Cross Site Request Forgery
by security-news＠drupal.org 22 Jul '09

22 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-045 * Project: Moderation (third-party module) * Version: 5.x, 6.x * Date: 2009-07-22 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Cross-site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Moderation module uses Ajax to provide a dynamic moderation queue for nodes and comments. The module is vulnerable to cross-site request forgeries (CSRF [1]) via the AJAX hooks used to toggle the moderation bit. It allows a non-administrative user to trick an admin into publishing arbitrary moderated content by directing them to the url via link or image src, etc. -------- VERSIONS AFFECTED --------------------------------------------------- * Moderation versions 5.x-1.x prior to 5.x-1.2 * Moderation versions 6.x-1.x prior to 6.x-1.3 Drupal core is not affected. If you do not use the contributed Moderation module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Moderation versions for Drupal 5.x upgrade to Moderation version 5.x-1.2 [2] * If you use Moderation versions for Drupal 6.x upgrade to Moderation version 6.x-1.3 [3] See also the Moderation [4] project page. -------- REPORTED BY --------------------------------------------------------- Ben Ford. -------- FIXED BY ------------------------------------------------------------ Stefan Auditor [5], the Moderation project maintainer, with assistance from Ben Jeavons [6] of the Drupal Security Team [7] -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Csrf [2] http://drupal.org/node/527866 [3] http://drupal.org/node/527864 [4] http://drupal.org/project/moderation [5] http://drupal.org/user/28074 [6] http://drupal.org/user/91990 [7] http://drupal.org/security-team

1 0

SA-CONTRIB-2009-044 - Bubbletimer - Multiple vulnerabilities
by security-news＠drupal.org 22 Jul '09

22 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-044 * Project: Bubbletimer (third-party module) * Version: 6.x * Date: 2009-July-22 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- Bubbletimer allows users to create timesheets based on nodes. It suffers from a cross-site scripting [1] (XSS) vulnerability due to not properly sanitizing node titles before they are displayed. It is also vulnerable to cross-site request forgeries [2] (CSRF) making it possible for users to unknowingly add nodes to, or remove nodes from, their timesheets. Together, these vulnerabilities could lead to an attacker gaining administrator access. Additionally, the module does not respect node access restrictions when displaying node listings. -------- VERSIONS AFFECTED --------------------------------------------------- * Bubbletimer for Drupal 6.x prior to Bubbletimer 6.x-1.5 Drupal core is not affected. If you do not use the contributed Bubbletimer module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Bubbletimer for Drupal 6.x upgrade to Bubbletimer 6.x-1.5 [3] See also the Bubbletimer project page [4]. -------- REPORTED BY --------------------------------------------------------- * The CSRF issue was reported by Andrew Berry [5]. * The XSS issue was reported by Stéphane Corlosquet [6] of the Drupal Security Team. * The access bypass issue was reported by John Morahan [7] of the Drupal Security Team. -------- FIXED BY ------------------------------------------------------------ * Peter Arato [8], the Bubbletimer module maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://en.wikipedia.org/wiki/Cross-site_request_forgery [3] http://drupal.org/node/527372 [4] http://drupal.org/project/bubbletimer [5] http://drupal.org/user/71291 [6] http://drupal.org/user/52142 [7] http://drupal.org/user/58170 [8] http://drupal.org/user/428960

1 0

SA-2009-043 - Image Assist - Multiple vulnerabilities
by security-news＠drupal.org 15 Jul '09

15 Jul '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-043 * Project: Image Assist (third-party module) * Version: 5.x, 6.x * Date: 2009-07-15 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross site scripting, Information disclosure -------- DESCRIPTION --------------------------------------------------------- The Image Assist module for Drupal 5.x and 6.x allows users to upload and insert inline images into posts. Two vulnerabilities and weaknesses were discovered in the contributed Image Assist module. .... Cross site scripting The node title is treated as if it was safe text, and is not escaped before being output. A user with sufficient permissions to create image nodes could insert malicious script code into the title field. Any user with access to the Image Assist properties page or any user viewing an embedded image in a popup is vulnerable to a cross-site scripting attack. Wikipedia has more information about such cross site scripting [1] (XSS) attacks. .... Information disclosure Some pages of the module do not properly check for required access permissions, allowing unprivileged users to view the title and body of arbitrary nodes. -------- VERSIONS AFFECTED --------------------------------------------------- * Image Assist for Drupal 5.x-1.x before version 5.x-1.8 * Image Assist for Drupal 5.x-2.x before version 2.0-alpha4 * Image Assist for Drupal 6.x-1.x before version 6.x-1.1 * Image Assist for Drupal 6.x-2.x before version 2.0-alpha4 * Image Assist for Drupal 6.x-3.x-dev before 2009-07-15 Drupal core is not affected. If you do not use the contributed Image Assist module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you currently use Image Assist 5.x-1.x upgrade to Image Assist 5.x-1.8 [2] * If you currently use Image Assist 5.x-2.x upgrade to Image Assist 5.x-2.0-alpha4 [3] * If you currently use Image Assist 6.x-1.x upgrade to Image Assist 6.x-1.1 [4] * If you currently use Image Assist 6.x-2.x upgrade to Image Assist 6.x-2.0-alpha4 [5] * If you currently use Image Assist 6.x-3.x-dev upgrade to Image Assist 6.x-3.x-dev after 2009-07-15 See also the Image Assist project page [6]. -------- REPORTED BY --------------------------------------------------------- Stefan M. Kudwien (smk-ka) [7] -------- FIXED BY ------------------------------------------------------------ Daniel F. Kudwien (sun) [8], the project maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Xss [2] http://drupal.org/node/520592 [3] http://drupal.org/node/520586 [4] http://drupal.org/node/520590 [5] http://drupal.org/node/520584 [6] http://drupal.org/project/img_assist [7] http://drupal.org/user/48898 [8] http://drupal.org/user/54136

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news