- Security-news - lists.drupal.org

SA-CONTRIB-2009-113 - FAQ - Cross Site Scripting
by security-news＠drupal.org 23 Dec '09

23 Dec '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-113 * Project: FAQ (third-party module) * Version: 5.x, 6.x * Date: 2009-December-23 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Frequently Asked Questions (faq) module allows users, with the appropriate permissions, to create question and answer pairs which are displayed on the 'faq' page, and in the random and recent FAQ blocks. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer faq', 'create faq' or 'edit faq' permissions. If using the FAQ module with the FAQ Ask module, the attacker may also exploit the vulnerability if they have the 'ask question' permission. -------- VERSIONS AFFECTED --------------------------------------------------- * FAQ module 5.x-2.13 and prior versions * FAQ module 6.x-1.10 and prior versions Drupal core is not affected. If you do not use the contributed FAQ [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the FAQ module for Drupal 5.x upgrade to FAQ 5.x-2.14 * If you use the FAQ module for Drupal 6.x upgrade to FAQ 6.x-1.11 See also the FAQ module project page [3]. -------- REPORTED BY --------------------------------------------------------- * stella [4] (the module maintainer) -------- FIXED BY ------------------------------------------------------------ * stella [5] (the module maintainer) -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/faq [3] http://drupal.org/project/faq [4] http://drupal.org/user/66894 [5] http://drupal.org/user/66894

1 0

SA-CORE-2009-009 - Drupal Core - Cross site scripting
by security-news＠drupal.org 16 Dec '09

16 Dec '09

* Advisory ID: DRUPAL-SA-CORE-2009-009 * Project: Drupal core * Version: 5.x, 6.x * Date: 2009-December-16 * Security risk: Not critical * Exploitable from: Remote * Vulnerability: Cross site scripting -------- DESCRIPTION --------------------------------------------------------- Multiple vulnerabilities were discovered in Drupal. .... Contact category name cross-site scripting The Contact module does not correctly handle certain user input when displaying category information. Users privileged to create contact categories can insert arbitrary HTML and script code into the contact module administration page. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting [1] (XSS). This issue affects Drupal 6.x and Drupal 5.x. .... Menu description cross-site scripting The Menu module does not correctly handle certain user input when displaying the menu administration overview. Users privileged to create new menus can insert arbitrary HTML and script code into the menu module administration page. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting [2] (XSS). This issue affects Drupal 6.x only. -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal 5.x before version 5.21. * Drupal 6.x before version 6.15. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you are running Drupal 6.x then upgrade to Drupal 6.15 [3]. * If you are running Drupal 5.x then upgrade to Drupal 5.21 [4]. If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. Theses patches fix the security vulnerability, but do not contain other fixes which were released in Drupal 5.21 or Drupal 6.15. * To patch Drupal 6.14 use SA-CORE-2009-009-6.14.patch [5]. * To patch Drupal 5.20 use SA-CORE-2009-009-5.20.patch [6]. -------- REPORTED BY --------------------------------------------------------- The contact category XSS issue was independently reported by mr.baileys and Justin Klein Keane [7]. The menu description XSS issue was reported by mr.baileys [8]. -------- FIXED BY ------------------------------------------------------------ The contact category XSS issue was fixed by Justin Klein Keane [9] and Dave Reid [10]. The menu description XSS issue was fixed by Gábor Hojtsy [11] and Heine Deelstra [12]. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://en.wikipedia.org/wiki/Cross-site_scripting [3] http://ftp.drupal.org/files/projects/drupal-6.15.tar.gz [4] http://ftp.drupal.org/files/projects/drupal-5.21.tar.gz [5] http://drupal.org/files/sa-core-2009-009/SA-CORE-2009-009-6.14.patch [6] http://drupal.org/files/sa-core-2009-009/SA-CORE-2009-009-5.20.patch [7] http://drupal.org/user/302225 [8] http://drupal.org/user/383424 [9] http://drupal.org/user/302225 [10] http://drupal.org/user/53892 [11] http://drupal.org/user/4166 [12] http://drupal.org/user/17943

1 0

SA-CONTRIB-2009-112 - Sections - Cross Site Scripting
by security-news＠drupal.org 16 Dec '09

16 Dec '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-112 * Project: Sections (third-party module) * Version: 5.x, 6.x * Date: 2009-December-16 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Sections module allows the creation of sections within a site. Each section has an installed template, theme or style attached to it. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability. Users who can take advantage of this vulnerability could gain administrator access to a site. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer sections' permission. -------- VERSIONS AFFECTED --------------------------------------------------- * Sections module 5.x-1.2 and prior versions * Sections module 6.x-1.2 and prior versions Drupal core is not affected. If you do not use the contributed Sections [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Sections module for Drupal 5.x upgrade to Sections 5.x-1.3 [3] * If you use the Sections module for Drupal 6.x upgrade to Sections 6.x-1.3 [4] See also the Sections module project page [5] -------- REPORTED BY --------------------------------------------------------- Justin C. Klein Keane [6] -------- FIXED BY ------------------------------------------------------------ Alexander Hass [7] the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/sections [3] http://drupal.org/node/660794 [4] http://drupal.org/node/660796 [5] http://drupal.org/project/sections [6] http://drupal.org/user/302225 [7] http://drupal.org/user/85918

1 0

SA-CONTRIB-2009-111 - Randomizer - Cross Site Scripting
by security-news＠drupal.org 09 Dec '09

09 Dec '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-111 * Project: Randomizer (third-party module) * Version: 5.x, 6.x * Date: 2009-December-09 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Randomizer module assists researchers and students who want an easy way to perform random sampling or assign participants to experimental conditions. It accepts form input as parameters for generating a pseudo-random list of numbers. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Randomizer module 5.x-1.0 and prior versions * Randomizer module 6.x-1.0 and prior versions Drupal core is not affected. If you do not use the contributed Randomizer [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ The Randomizer module is not maintained and there is no direct solution. Disable the module. -------- REPORTED BY --------------------------------------------------------- * grendzy [3] -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/randomizer [3] http://drupal.org/user/96647

1 0

SA-CONTRIB-2009-110 - Taxonomy Timer - SQL Injection
by security-news＠drupal.org 02 Dec '09

02 Dec '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-110 * Project: Taxonomy Timer (third-party module) * Version: 5.x, 6.x * Date: 2009-November-25 * Security risk: Critical * Exploitable from: Remote * Vulnerability: SQL Injection -------- DESCRIPTION --------------------------------------------------------- The Taxonomy Timer module enables users to set expiration dates for Taxonomy Terms. At the time of expiration other terms can be assigned, or nodes can be unpublished. In some cases the module does not properly sanitize user input, leading to a SQL Injection [1] vulnerability. Such an attack may lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Taxonomy Timer module 5.x-1.8 and prior versions * Taxonomy Timer module 6.x-alpha1 and prior versions Drupal core is not affected. If you do not use the contributed Taxonomy Timer module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Taxonomy Timer module for Drupal 5.x upgrade to Taxonomy Timer module 5.x-1.9 [2] * If you use the Taxonomy Timer module for Drupal 6.x upgrade to Taxonomy Timer module 6.x-1.0-rc1 [3] See also the Taxonomy Timer [4] project page. -------- REPORTED BY --------------------------------------------------------- * Dylan Wilder-Tack [5] -------- FIXED BY ------------------------------------------------------------ * Suydam [6], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/SQL_Injection [2] http://drupal.org/node/641050 [3] http://drupal.org/node/641064 [4] http://drupal.org/project/taxonomy_timer [5] http://drupal.org/user/96647 [6] http://drupal.org/user/50195

1 0

SA-CONTRIB-2009-109 - Printfriendly - Cross Site Scripting
by security-news＠drupal.org 18 Nov '09

18 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-109 * Project: Printfriendly (third-party module) * Version: 6.x * Date: 2009-November-18 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Printfriendly module integrates with printfriendly.com's print service. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Printfriendly module for Drupal 6.x prior to Printfriendly 6.x-1.6 [2] Drupal core is not affected. If you do not use the contributed Printfriendly module [3], there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use the Printfriendly module for Drupal 6.x upgrade to Printfriendly 6.x-1.6 [4] -------- REPORTED BY --------------------------------------------------------- * Reported by Dylan Wilder-Tack [5] -------- FIXED BY ------------------------------------------------------------ * Fixed by Emil Stjerneman [6], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/636670 [3] http://drupal.org/project/printfriendly [4] http://drupal.org/node/636670 [5] http://drupal.org/user/96647 [6] http://drupal.org/user/464598

1 0

SA-CONTRIB-2009-108 - Gallery Assist - Cross Site Scripting
by security-news＠drupal.org 18 Nov '09

18 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-108 * Project: Gallery Assist (third-party module) * Version: 6.x * Date: 2009-November-18 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Gallery Assist module provides a simple way to create image galleries on a site. The module does not sanitize node titles, leading to a Cross Site Scripting (XSS [1]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Gallery Assist module for Drupal 6.x prior to Gallery Assist 6.x-1.7 [2] Drupal core is not affected. If you do not use the contributed Gallery Assist module [3], there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use the Gallery Assist module for Drupal 6.x upgrade to Gallery Assist 6.x-1.7 [4] -------- REPORTED BY --------------------------------------------------------- * Reported by Dylan Wilder-Tack [5] -------- FIXED BY ------------------------------------------------------------ * Fixed by Juan Carlos Morejon Carabajo [6], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/636488 [3] http://drupal.org/project/gallery_assist [4] http://drupal.org/node/636488 [5] http://drupal.org/user/96647 [6] http://drupal.org/user/320731

1 0

SA-CONTRIB-2009-107 - Ubercart - Access bypass, Cross site request forgery
by security-news＠drupal.org 18 Nov '09

18 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-107 * Project: Ubercart (third-party module) * Version: 5.x, 6.x * Date: 2009-November-18 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Access bypass, Cross-site request forgery -------- DESCRIPTION --------------------------------------------------------- Ubercart's PayPal Website Payments Standard integration exposes a path for completed orders without properly checking that the order is valid for the current user. In the event that the order has already been processed for checkout, this can result in duplicate actions taking place inadvertently. Furthermore, if the checkout completion message has been modified to include order details, information disclosure can happen. The Ubercart order management was also affected by a minor cross-site request forgery vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Ubercart module for Drupal 6.x prior to Ubercart 6.x-2.1 [1] * Ubercart module for Drupal 5.x prior to Ubercart 5.x-1.9 [2] Drupal core is not affected. If you do not use the contributed Ubercart [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Ubercart module for Drupal 6.x upgrade to version 6.x-2.1 [4] * If you use Ubercart module for Drupal 5.x upgrade to version 5.x-1.9 [5] -------- REPORTED BY --------------------------------------------------------- * Reported by Daniel Duvall [6] -------- FIXED BY ------------------------------------------------------------ * Fixed by Ryan Szrama [7], the module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/636616 [2] http://drupal.org/node/636614 [3] http://drupal.org/project/ubercart [4] http://drupal.org/node/636616 [5] http://drupal.org/node/636614 [6] http://drupal.org/user/584298 [7] http://drupal.org/user/49344

1 0

SA-CONTRIB-2009-106 - Agreement - Cross Site Scripting
by security-news＠drupal.org 18 Nov '09

18 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-106 * Project: Agreement (third-party module) * Version: 6.x * Date: 2009-November-18 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Agreement module enables the display of a text-based agreement (think "Terms of Service") that users of a particular role must accept before they are given access to the site. The module does not sanitize some of the user-supplied fields, leading to a Cross Site Scripting (XSS [1]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Agreement module for Drupal 6.x prior to Agreement 6.x-1.2 [2] Drupal core is not affected. If you do not use the contributed Agreement module [3], there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use the Agreement module for Drupal 6.x upgrade to Agreement 6.x-1.2 [4] -------- REPORTED BY --------------------------------------------------------- * Reported by Dylan Wilder-Tack [5] -------- FIXED BY ------------------------------------------------------------ * Fixed by Yuriy Babenko [6], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/631538 [3] http://drupal.org/project/agreement [4] http://drupal.org/node/631538 [5] http://drupal.org/user/96647 [6] http://drupal.org/user/212855

1 0

SA-CONTRIB-2009-105 - Subgroups for Organic Groups - Cross Site Scripting
by security-news＠drupal.org 18 Nov '09

18 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-105 * Project: Subgroups for Organic Groups (third-party module) * Version: 5.x * Date: 2009-November-18 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Subgroups For Organic Groups module enables users to set group hierarchy. The module does not filter the titles of some nodes before output, leading to a cross-site scripting (XSS [1]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Subgroups For Organic Groups versions for Drupal 5.x prior to 5.x-4.0 Drupal core is not affected. If you do not use the contributed Subgroups For Organic Groups module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use the Subgroups For Organic Groups 3.3 release for Drupal 5.x upgrade to version 5.x-3.4 [2] * If you use the Subgroups For Organic Groups 2.0 release for Drupal 5.x upgrade to versions 5.x-3.4 [3] or 5.x-4.0 [4] See also the Subgroups For Organic Groups [5] project page. -------- REPORTED BY --------------------------------------------------------- * The vulnerability was reported by Greg Knaddison [6] -------- FIXED BY ------------------------------------------------------------ * XSS vulnerability fixed by Ezra Barnett Gildesgame [7], Subgroups For Organic Groups module maintainer -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross_Site_Scripting [2] http://drupal.org/node/630004 [3] http://drupal.org/node/630004 [4] http://drupal.org/node/270602 [5] http://drupal.org/project/og_subgroups [6] http://drupal.org/user/36762 [7] http://drupal.org/user/69959

1 0