- Security-news - lists.drupal.org

SA-CONTRIB-2009-104 - Feed Element Mapper - Cross Site Scripting
by security-news＠drupal.org 18 Nov '09

18 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-104 * Project: Feed Element Mapper (third-party module) * Version: 5.x, 6.x * Date: 2009-November-18 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Feed Element Mapper is an add-on module for FeedAPI that maps elements on a feed item such as tags, or the author name, to taxonomy or CCK fields. These mappings are configurable by a point and click interface. When configuring the mapping, some values coming from external feeds are not sanitized before they are displayed, leading to a Cross Site Scripting (XSS [1]) -------- VERSIONS AFFECTED --------------------------------------------------- * Feed Element Mapper module for Drupal 6.x prior to Feed Element Mapper 6.x-1.3 [2] * Feed Element Mapper module for Drupal 5.x prior to Feed Element Mapper 5.x-1.3 [3] Drupal core is not affected. If you do not use the contributed Feed Element Mapper [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Feed Element Mapper module for Drupal 6.x upgrade to version 6.x-1.3 [5] * If you use Feed Element Mapper module for Drupal 5.x upgrade to version 5.x-1.3 [6] If you use one of the unsupported Feed element mapper 6.x-2.0 alpha versions, upgrade to Feed Element Mapper 6.x-1.0-alpha4 [7]. -------- REPORTED BY --------------------------------------------------------- * Reported by Jose Reyero [8], from the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Fixed by alex_b [9], the module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/636498 [3] http://drupal.org/node/636496 [4] http://drupal.org/project/feedapi_mapper [5] http://drupal.org/node/636498 [6] http://drupal.org/node/636496 [7] http://drupal.org/node/636500 [8] http://drupal.org/user/4299 [9] http://drupal.org/user/53995

1 0

SA-CONTRIB-2009-103 - Strongarm - Cross Site Scripting
by security-news＠drupal.org 18 Nov '09

18 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-103 * Project: Strongarm (third-party module) * Version: 6.x * Date: 2009 November 18 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Strongarm module enables other modules to enforce variable settings programmatically. It can also be used to override any of these variables, and lets the administrator see which variables have been overridden, along with their current values. When using the settings page to see overridden variables, the value field is not sanitized before being displayed, leading to a Cross Site Scripting (XSS [1]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Strongarm module for Drupal 6.x prior to Strongarm 6.x-1.1 [2] Drupal core is not affected. If you do not use the contributed Strongarm [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Strongarm module for Drupal 6.x upgrade to version 6.x-1.1 [4] -------- REPORTED BY --------------------------------------------------------- * Reported by bengtan [5] -------- FIXED BY ------------------------------------------------------------ * Fixed by jmiccolis [6], the module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/636474 [3] http://drupal.org/project/strongarm [4] http://drupal.org/node/636474 [5] http://drupal.org/user/132729 [6] http://drupal.org/user/31731

1 0

SA-CONTRIB-2009-102 - PHPList Integration Module - Cross Site Request Forgery
by security-news＠drupal.org 18 Nov '09

18 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-102 * Project: PHPList Inegration Module (third-party module) * Version: 5.x, 6.x * Date: 2009-November-18 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Cross site request forgery -------- DESCRIPTION --------------------------------------------------------- The PHPList module provides a basic level of integration between Drupal and the PHPList mailing list application. The Drupal Forms API protects against cross site request forgeries (CSRF), where a malicious site can cause a user to unintentionally submit a form to a site where they are authenticated. The links for subscribing and un-subscribing to and from mailing lists in "My Account" do not follow the standard Forms API submission model and are therefore not protected against this type of attack. A CSRF attack may result in unintentional subscription or un-subscription of site users to PHPList mailing lists. -------- VERSIONS AFFECTED --------------------------------------------------- * PHPList Integration Module for Drupal 5 before 5.x-1.2 * PHPList Integration Module for Drupal 6 before 6.x-1.1 Drupal core is not affected. If you do not use the contributed PHPList Integration module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: If you use Drupal 5.x upgrade to PHPList Integration Module 5.x-1.2 [1]. If you use Drupal 6.x upgrade to PHPList Integration Module 6.x-1.1 [2]. See also the PHPList Integration Module [3] project page. -------- REPORTED BY --------------------------------------------------------- Peter Wolanin [4] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ Paul Beaney [5] the module maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/636400 [2] http://drupal.org/node/636398 [3] http://drupal.org/project/phplist [4] http://drupal.org/user/49851 [5] http://drupal.org/user/204611

1 0

SA-CONTRIB-2009-101 - Web Services - Access Bypass
by security-news＠drupal.org 11 Nov '09

11 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-101 * Project: Web Services (third-party theme) * Version: 6.x * Date: 2009-November-11 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- The Web Services module provides an API for other sites to communicate with a Drupal site, enabling the publishing of content, change of user information, or simply integration of a Flash application. The module fails to implement proper access checks, leading to an Access Bypass vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Web Services module, all versions. Drupal core is not affected. If you do not use the contributed Web Services [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Web Services module is not maintained and there is no direct solution. Disable the module. The Services [2] module, from which Web Services was forked, may be a possible replacement depending on your requirements. -------- REPORTED BY --------------------------------------------------------- * Reported by Paolo Sinelli -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/webservices [2] http://drupal.org/project/services

1 0

SA-CONTRIB-2009-100 - AddToAny - Cross Site Scripting
by security-news＠drupal.org 11 Nov '09

11 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-100 * Project: AddToAny (third-party module) * Version: 5.x, 6.x * Date: 2009 November 11 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- AddToAny module provides a share button for AddToAny service for social networks. The module fails to sanitize a value in node title, leading to a Cross Site Scripting (XSS [1]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * AddToAny module for Drupal 6.x prior to AddToAny 6.x-2.4 [2] * AddToAny module for Drupal 5.x prior to AddToAny 5.x-2.4 [3] Drupal core is not affected. If you do not use the contributed AddToAny module [4], there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use the AddToAny module for Drupal 6.x upgrade to AddToAny 6.x-2.4 [5] * If you use the AddToAny module for Drupal 5.x upgrade to AddToAny 5.x-2.4 [6] -------- REPORTED BY --------------------------------------------------------- * Reported by Jakub Suchy [7] of the Drupal Security Team. -------- FIXED BY ------------------------------------------------------------ * Fixed by Pat Diven [8], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/601110 [3] http://drupal.org/node/630198 [4] http://drupal.org/project/addtoany [5] http://drupal.org/node/601110 [6] http://drupal.org/node/630198 [7] http://drupal.org/user/31977 [8] http://drupal.org/user/260224

1 0

SA-CONTRIB-2009-099 - RootCandy Theme - Cross Site Scripting
by security-news＠drupal.org 11 Nov '09

11 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-099 * Project: RootCandy (third-party theme) * Version: 6.x * Date: 2009-November-11 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- RootCandy is a theme specifically designed for use in the administration section. The theme fails to sanitize a URL value, leading to a Cross Site Scripting (XSS [1]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * RootCandy theme for Drupal 6.x prior to RootCandy 6.x-1.5 [2] Drupal core is not affected. If you do not use the contributed RootCandy theme [3], there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use the RootCandy theme for Drupal 6.x upgrade to RootCandy 6.x-1.5 [4] -------- REPORTED BY --------------------------------------------------------- * Reported by Jim McIntyre -------- FIXED BY ------------------------------------------------------------ * Fixed by Marek Sotak [5], the theme maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/629894 [3] http://drupal.org/project/rootcandy [4] http://drupal.org/node/629894 [5] http://drupal.org/user/37679

1 0

SA-CONTRIB-2009-098 - Zoomify - Cross Site Scripting
by security-news＠drupal.org 04 Nov '09

04 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-098 * Project: Zoomify (third-party module) * Version: 5.x, 6.x * Date: 2009-November-4 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Zoomify module integrates the Zoomify Flash applet into Drupal which can be used to pan and zoom on large images. Images are first preprocessed in order for Zoomify to work. The module fails to sanitize a value in the node title, leading to a Cross Site Scripting (XSS [1]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Zoomify module for Drupal 6.x prior to Zoomify 6.x-1.4 [2] * Zoomify module for Drupal 5.x prior to Zoomify 5.x-2.2 [3] Drupal core is not affected. If you do not use the contributed Zoomify module [4], there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Zoomify module for Drupal 6.x upgrade to Zoomify 6.x-1.4 [5] * If you use Zoomify module for Drupal 5.x upgrade to Zoomify 5.x-2.2 [6] -------- REPORTED BY --------------------------------------------------------- * Reported by Dylan Wilder-Tack [7], the module maintainer -------- FIXED BY ------------------------------------------------------------ * Fixed by Karim Ratib [8], the module maintainer -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/623434 [3] http://drupal.org/node/623436 [4] http://drupal.org/project/zoomify [5] http://drupal.org/node/623434 [6] http://drupal.org/node/623436 [7] http://drupal.org/user/96647 [8] http://drupal.org/user/48424

1 0

SA-CONTRIB-2009-097 - Organic Groups Vocabulary - Cross Site Scripting
by security-news＠drupal.org 04 Nov '09

04 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-097 * Project: Organic Groups Vocabulary (third-party module) * Version: 6.x * Date: 2009-November-4 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Organic Groups Vocabulary module enables a vocabulary to be restricted for use to a specific Organic Group. The module does not sanitize before outputting the group title in some cases, resulting in a cross-site scripting (XSS [1]) vulnerability. Such an attack may lead to a malicious user gaining full administrative access. -------- VERSIONS AFFECTED --------------------------------------------------- * Organic Groups Vocabulary versions for Drupal 6.x prior to Organic Groups Vocabulary 6.x-1.1 [2] Drupal core is not affected. If you do not use the contributed Organic Groups Vocabulary module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Organic Groups Vocabulary for Drupal 6.x upgrade to version 6.x-1.1 [3] See also the Organic Groups Vocabulary module project page [4]. -------- REPORTED BY --------------------------------------------------------- * Stéphane Corlosquet [5] of the Drupal Security Team and Dylan Wilder-Tack [6] -------- FIXED BY ------------------------------------------------------------ * Amitaibu [7], the module maintainer -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/621960 [3] http://drupal.org/node/621960 [4] http://drupal.org/project/og_vocab [5] http://drupal.org/user/52142 [6] http://drupal.org/user/96647 [7] http://drupal.org/user/57511

1 0

SA-CONTRIB-2009-096 - Link - Cross Site Scripting
by security-news＠drupal.org 04 Nov '09

04 Nov '09

* Advisory ID: DRUPAL-SA-CONTRIB-2009-096 * Project: Link (third-party module) * Version: 5.x, 6.x * Date: 2009-November-4 * Security risk: Moderately Critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Link module provides a CCK field which enables links to be added to content types, that can include a URL, title, and target attribute. When using the "Separate title and URL" formatter supplied by the module, the link title field is not sanitized before being displayed, leading to a Cross Site Scripting (XSS [1]) vulnerability. -------- VERSIONS AFFECTED --------------------------------------------------- * Link module for Drupal 6.x prior to Link 6.x-2.7 [2] * Link module for Drupal 5.x prior to Link 5.x-2.6 [3] Drupal core is not affected. If you do not use the contributed Link module [4], there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Link module for Drupal 6.x upgrade to version 6.x-2.7 [5] * If you use Link module for Drupal 5.x upgrade to version 5.x-2.6 [6] -------- REPORTED BY --------------------------------------------------------- * Reported by mr.baileys [7] -------- FIXED BY ------------------------------------------------------------ * Fixed by dropcube [8], Link module co-maintainer, and mr.baileys [9] -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/620668 [3] http://drupal.org/node/620662 [4] http://drupal.org/project/link [5] http://drupal.org/node/620668 [6] http://drupal.org/node/620662 [7] http://drupal.org/user/383424 [8] http://drupal.org/user/37031 [9] http://drupal.org/user/383424

1 0

SA-CONTRIB-2009-095 - Smartqueue OG - Access Bypass
by security-news＠drupal.org 04 Nov '09

04 Nov '09

* Advisory ID: SA-CONTRIB-2009-095 * Project: Smartqueues for Organic Groups (smartqueue_og) (third-party module) * Version: 6.x * Date: 2009 November 4 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Smartqueue_og [1] module uses Nodequeue's Smartqueue API to provide a Nodequeue [2] for organic groups which is editable by members of that group or the group's administrators. Users with the "administer nodequeue" permission have the option to batch create subqueues (individual instances of a queue) for all eligible organic group nodes. For each subqueue that is created, a confirmation message is displayed containing the name of the organic group. The displayed message does not check that the current user has permission to view the group node. A similar message is also displayed when an eligible group node is submitted. Smartqueue_og users should also note: Subqueue titles contain the title of the organic group node to which the subqueue is related. Users with the 'manipulate all queues' or 'manipulate all og queues' permissions will be able to view all smartqueue_og subqueue titles, and therefore the node titles of all groups that have a subqueue, regardless of node access restrictions. This is by design and is not changed in the latest version. -------- VERSIONS AFFECTED --------------------------------------------------- * Smartqueue_og module for Drupal 6.x prior to Smartqueue_og 6.x-1.0-rc3 [3] * Smartqueue_og module for Drupal 5.x prior to Smartqueue_og 5.x-1.3 [4] Drupal core is not affected. If you do not use the contributed Smartqueue_og module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version. * If you use the Smartqueue_og module for Drupal 6.x upgrade to Smartqueue_og module 6.x-1.0-rc3 [5] * If you use the Smartqueue_og module for Drupal 5.x upgrade to Smartqueue_og module 5.x-1.3 [6]. See also the Smartqueue_og [7] module project page. -------- REPORTED BY --------------------------------------------------------- * Ezra Barnett Gildesgame [8], the module maintainer. -------- FIXED BY ------------------------------------------------------------ * Ezra Barnett Gildesgame [9], the module maintainer. -------- CONTACT ------------------------------------------------------------- The security team for Drupal can be reached at security(a)drupal.org [10] or via the form at http://drupal.org/contact. [1] http://drupal.org/project/smartqueue_og [2] http://drupal.org/project/nodequeue [3] http://drupal.org/node/617496 [4] http://drupal.org/node/617500 [5] http://drupal.org/node/617496 [6] http://drupal.org/node/617500 [7] http://drupal.org/project/smartqueue_og [8] http://drupal.org/user/69959 [9] http://drupal.org/user/69959 [10] mailto:security@drupal.org

1 0