- Security-news - lists.drupal.org

SA-CONTRIB-2010-008 - Recent Comments - Cross Site Scripting
by security-news＠drupal.org 20 Jan '10

20 Jan '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-008 * Project: Recent Comments (third-party module) * Version: 6.x-1.0, 5.x-1.2 * Date: 2010-January-20 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Recent Comments module provides a high-performance, fully themable block of recent comments. This release includes a fix for a cross-site scripting (XSS [1]) vulnerability in which JavaScript could be inserted in the title of the Recent Comments block via a custom block title interface. This custom title interface has been removed, as Drupal 5.x and later allow overriding the a block's title from its configuration screen. -------- VERSIONS AFFECTED --------------------------------------------------- * Recent Comments module 5.x-1.2 and prior versions * Recent Comments module 6.x-1.0 and prior versions Drupal core is not affected. If you do not use the contributed Recent Comments module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Recent Comments module for Drupal 5.x upgrade to Recent Comments 5.x-1.3 [2] * If you use the Recent Comments module for Drupal 6.x upgrade to Recent Comments 6.x-1.1 [3] See also the Recent Comments [4] page. -------- REPORTED BY --------------------------------------------------------- Dylan Tack [5] of the Drupal Security Team. -------- FIXED BY ------------------------------------------------------------ Dylan Tack [6] of the Drupal Security Team and Todd Nienkerk [7]. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/688636 [3] http://drupal.org/node/688632 [4] http://drupal.org/project/recent_comments [5] http://drupal.org/user/96647 [6] http://drupal.org/user/96647 [7] http://drupal.org/user/92096

1 0

SA-CONTRIB-2010-007 - Control Panel - Cross Site Scripting
by security-news＠drupal.org 20 Jan '10

20 Jan '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-007 * Project: Control Panel (third-party module) * Version: 5.x, 6.x * Date: 2010-January-20 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Control Panel module enables users to add a new graphical control panel page. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability. Only users with the 'administer blocks' permission are able to exploit this vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Control Panel module 5.x-1.5 and prior versions * Control Panel module 6.x-1.2 and prior versions Drupal core is not affected. If you do not use the contributed Control Panel [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ The Drupal 5.x version of this module is no longer supported and should be disabled. For Drupal 6.x, install the latest version: * If you use Control Panel module for Drupal 6.x upgrade to Control Panel 6.x-1.3 [3] See also the Control Panel project page [4]. -------- REPORTED BY --------------------------------------------------------- * Reported by Dylan Wilder-Tack [5] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Dylan Wilder-Tack [6] -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/controlpanel [3] http://drupal.org/node/686428 [4] http://drupal.org/project/controlpanel [5] http://drupal.org/user/96647 [6] http://drupal.org/user/96647

1 0

SA-CONTRIB-2010-006 - Bibliography Module - Cross Site Scripting
by security-news＠drupal.org 13 Jan '10

13 Jan '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-006 * Project: Bibliography (third-party module) * Version: 5.x, 6.x * Date: 2010-January-13 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Bibliography module enables users to manage and display lists of scholarly publications. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability. Only users with the 'administer biblio' permission are able to exploit this vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Bibliography module 5.x-1.17 and prior versions * Bibliography module 6.x-1.9 and prior versions Drupal core is not affected. If you do not use the contributed Bibliography [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Bibliography for Drupal 5.x upgrade to Bibliography 5.x-1.18 [3] * If you use Bibliography for Drupal 6.x upgrade to Bibliography 6.x-1.10 [4] See also the Bibliography project page [5]. -------- REPORTED BY --------------------------------------------------------- * grendzy [6] of the Drupal Security Team. -------- FIXED BY ------------------------------------------------------------ Ron Jerome [7], the Bibliography project maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/biblio [3] http://drupal.org/node/682694 [4] http://drupal.org/node/682696 [5] http://drupal.org/project/biblio [6] http://drupal.org/user/96647 [7] http://drupal.org/user/54997

1 0

SA-CONTRIB-2010-005 - Own Term - Cross site scripting
by security-news＠drupal.org 13 Jan '10

13 Jan '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-005 * Project: Own Term (third-party module) * Version: 6.x-1.0 * Date: 2010-January-13 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Own Term module allows users to create taxonomy terms in a designated vocabulary and when creating content this term is automatically added to the node. The module does not sanitize the term description on a term listing page which opens a cross-site scripting (XSS [1]) attack. Users with a role containing the permission 'create additional terms' can exploit this vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Own Term module 6.x-1.0 Drupal core is not affected. If you do not use the contributed Own Term module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Own Term module for Drupal 6.x upgrade to Own Term 6.x-1.1 [2] See also the Own Term project page [3]. -------- REPORTED BY --------------------------------------------------------- Benjamin Jeavons [4], Own Term module comaintainer. -------- FIXED BY ------------------------------------------------------------ Benjamin Jeavons [5], Own Term module comaintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/683544 [3] http://drupal.org/project/ownterm [4] http://drupal.org/user/91990 [5] http://drupal.org/user/91990

1 0

SA-CONTRIB-2010-004 - Node block - Cross site scripting
by security-news＠drupal.org 13 Jan '10

13 Jan '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-004 * Project: Node Block (third-party module) * Version: 6.13, 5.11 * Date: 2010-January-13 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module allows you to specify content type(s) as being a block. This allows the content managers of the site to edit the block text and title without having to access the block administration page. Users only need edit access to that node in order to edit it. Users with administer block access will see region and weight options on the node form. The Node Block module creates a block from specified content type(s). Node block doesn't properly escape titles allowing users with permissions to create/edit the specified content type(s) to inject arbitrary code into the site. Such a cross site scripting (XSS) attack may lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Node Blocks module 5.x-1.1 and prior versions * Node Blocks module 6.x-1.3 and prior versions Drupal core is not affected. If you do not use the contributed Feed Block module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Node Blocks module for Drupal 5.x upgrade to Node Blocks 5.x-1.2 [1] * If you use the Node Blocks module for Drupal 6.x upgrade to Node Blocks 6.x-1.4 [2] See also the Node Block project page [3]. -------- REPORTED BY --------------------------------------------------------- Martin Barbella [4] and Khalid Baheyeldin [5] -------- FIXED BY ------------------------------------------------------------ Thomas Turnbull [6]. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/683586 [2] http://drupal.org/node/683584 [3] http://drupal.org/project/nodeblock [4] http://drupal.org/user/633600 [5] http://drupal.org/user/4063 [6] http://drupal.org/user/125573

1 0

SA-CONTRIB-2010-003 - Forward - Cross site scripting
by security-news＠drupal.org 07 Jan '10

07 Jan '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-003 * Project: Forward (third-party module) * Version: 6.x * Date: 2010-January-6 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Multiple XSS vulnerabilities -------- DESCRIPTION --------------------------------------------------------- This module allows users to forward a link to a specific node on your site to a friend. The Forward module does not properly sanitize user supplied data, allowing users with the "access administration pages" and "administer forward" permissions, or users with "access administration pages" and "administer site configuration" permissions to inject scripts into Drupal generated output, leading to a cross-site scripting (XSS [1]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Forward version prior to 6.x-1.12 Drupal core is not affected. If you do not use the contributed Forward [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: upgrade to Forward 6.x-1.12 [3]. See also the Forward module project page [4]. -------- REPORTED BY --------------------------------------------------------- mr.baileys [5] -------- FIXED BY ------------------------------------------------------------ mr.baileys [6]. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/forward [3] http://drupal.org/node/676494 [4] http://drupal.org/project/forward [5] http://drupal.org/user/383424 [6] http://drupal.org/user/383424

1 0

DRUPAL-SA-CONTRIB-2010-002 Cross site scripting in Currency Exchange
by security-news＠drupal.org 06 Jan '10

06 Jan '10

* Advisory ID: DRUPAL-SA-CONTRIB-2009-002 * Project: Currency Exchange (third-party module) * Version: 6.x * Date: 2009-January-6 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module provides a site with the ability to display currency exchange rates. The module does not sanitize some of the user-supplied data before logging it to the watchdog, leading to a cross-site scripting (XSS [1]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Currency Exchange version prior to 6.x-1.2 Drupal core is not affected. If you do not use the contributed Currency Exchange [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: upgrade to Currency Exchange 6.x-1.2 [3]. See also the Currency Exchange module project page [4]. -------- REPORTED BY --------------------------------------------------------- mr.baileys [5] -------- FIXED BY ------------------------------------------------------------ mr.baileys [6] and kbahey [7] one of the module's maintainers. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/currency [3] http://drupal.org/node/676214 [4] http://drupal.org/project/currency [5] http://drupal.org/user/383424 [6] http://drupal.org/user/383424 [7] http://drupal.org/user/4063

1 0

SA-CONTRIB-2010-001 - Wunderbar - Cross Site Scripting
by security-news＠drupal.org 06 Jan '10

06 Jan '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-001 * Project: Wunderbar! (third-party module) * Version: 6.x * Date: 2010-January-6 * Security risk: Not Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Wunderbar! module provides a floating bar with configurable buttons and the ability to link off to social networking sites. The module does not properly escape user names, potentially allowing a cross site scripting [1] (XSS) attack which may lead to the user gaining full administrative access. The risk is mitigated by Drupal's default configuration, which disallows some characters (<, >, &, and quotes) in user names. A site would only be vulnerable to this attack if it uses an alternate means to create usernames. -------- VERSIONS AFFECTED --------------------------------------------------- * Wunderbar! versions 6.x prior to 6.x-0.6 Drupal core is not affected. If you do not use the Wunderbar! module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Wunderbar! for Drupal 6.x upgrade to Wunderbar! 6.x-0.6 [2] See also the Wunderbar! project page [3]. -------- REPORTED BY --------------------------------------------------------- Isaac Sukin [4]. -------- FIXED BY ------------------------------------------------------------ Bryan Ollendyke [5], the Wunderbar! project maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/675968 [3] http://drupal.org/project/wunderbar [4] http://drupal.org/user/201425 [5] http://drupal.org/user/24286

1 0

SA-CONTRIB-2009-115 - Autocomplete Widgets for CCK Text and Number - Information Disclosure
by security-news＠drupal.org 30 Dec '09

30 Dec '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-115 * Project: Autocomplete Widgets for CCK Text and Number (third-party module) * Version: 6.x * Date: 2009-December-30 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- Autocomplete Widgets module adds 2 autocomplete widgets for CCK fields of type Text and Number. The autocomplete callback implemented by this module does not honor permissions to access CCK fields, allowing users to see field values even though they are not authorized to access that information. -------- VERSIONS AFFECTED --------------------------------------------------- * Autocomplete Widgets module 6.x-1.2 and prior versions on the 6.x-1.x branch Drupal core is not affected. If you do not use the contributed Autocomplete Widgets [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Autocomplete Widgets module for Drupal 6.x, upgrade to Autocomplete Widgets 6.x-1.3 [2] See also the Autocomplete Widgets module project page [3]. -------- REPORTED BY --------------------------------------------------------- mr.baileys [4] -------- FIXED BY ------------------------------------------------------------ markus_petrux [5], the Autocomplete Widgets module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/autocomplete_widgets [2] http://drupal.org/node/670928 [3] http://drupal.org/project/autocomplete_widgets [4] http://drupal.org/user/383424 [5] http://drupal.org/user/39593

1 0

SA-CONTRIB-2009-114 - Automated Logout - Cross Site Scripting
by security-news＠drupal.org 24 Dec '09

24 Dec '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-114 * Project: Automated Logout (third-party module) * Version: 6.x * Date: 2009-December-23 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module provides a site administrator the ability to log users out after a specified time of inactivity. The module does not sanitize some of the user-supplied data before displaying it, leading to a cross-site scripting (XSS [1]) vulnerability. Users who can take advantage of this vulnerability could gain administrator access to a site. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer autologout' permission. -------- VERSIONS AFFECTED --------------------------------------------------- * Automated Logout module 6.x-1.6 and prior versions on the 6.x-1.x branch * Automated Logout module 6.x-2.2 and prior versions on the 6.x-2.x branch Note that the Drupal 5 version of the Automated Logout module is also affected, but the attacker must have a role with the 'administer site configuration' permission. The 'administer site configuration' permission is inherently unsafe and should only be granted to trusted users; therefore, this issue is not considered a security vulnerability for Drupal 5 (see http://drupal.org/node/475848) Drupal core is not affected. If you do not use the contributed Automated Logout [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Automated Logout module for Drupal 6.x, upgrade to either Automated Logout 6.x-1.7 [3] or Automated Logout 6.x-2.3 [4] See also the Automated Logout module project page [5]. -------- REPORTED BY --------------------------------------------------------- mr.baileys [6] -------- FIXED BY ------------------------------------------------------------ jvandervort [7], one of the Automated Logout module maintainers -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/autologout [3] http://drupal.org/node/667084 [4] http://drupal.org/node/667086 [5] http://drupal.org/project/autologout [6] http://drupal.org/user/383424 [7] http://drupal.org/user/35604

1 0