- Security-news - lists.drupal.org

Drupal file upload by anonymous or untrusted users into public file systems -- PSA-2016-003
by security-news＠drupal.org 10 Oct '16

10 Oct '16

View online: https://www.drupal.org/psa-2016-003 * Advisory ID: DRUPAL-PSA-2016-003 * Project: Drupal core [1] * Version: 7.x, 8.x * Date: 2016-October-10 * Security risk: 20/25 ( Critical) AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All [2] -------- DESCRIPTION --------------------------------------------------------- Recently the Drupal Security Team has seen a trend of attacks utilizing a site mis-configuration. This issue only affects sites that allow file uploads by non-trusted or anonymous visitors, and stores those uploads in a public file system. These files are publically accessible allowing attackers to point search engines and people directly to them on the site. The majority of the reports are based around the webform module, however, other modules are vulnerable to this misconfiguration as well. For example, if a webform configured to allow anonymous visitors to upload an image into the public file system, that image would then be accessible by anyone on the internet. The site could be used by an attacker to host images and other files that the legitimate site maintainers would not want made publicly available through their site. -------- TO RESOLVE THIS ISSUE: ---------------------------------------------- 1) Configure upload fields that non-trusted visitors, including anonymous visitors, can upload files with, to utilize use the private file system [3]. 2) Ensure cron is properly running on the site. Read about setting up cron for for Drupal 7 [4] or or Drupal 8 [5]). 3) Consider forcing users to create accounts before submitting content. 4) Audit your public file space to make sure that files that are uploaded there are valid. -------- AWARENESS ACKNOWLEDGMENT -------------------------------------------- The Drupal Security Team became aware of the existence and exploits of this issue because the community reported this issue to the security team [6]. As always, if your site has been exploited, even if the cause is a mistake in configuration, the security team is interested in hearing about the nature of the issue. We use these reports to look for trends and broader solutions. -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team * Alex Pott [9] of the Drupal Security Team * David Snopek [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team * Cash Williams [12] of the Drupal Security Team *This post may be updated as more information is learned.* -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/documentation/modules/file#access [4] https://www.drupal.org/docs/7/setting-up-cron/overview [5] https://www.drupal.org/docs/8/setting-up-cron/overview [6] https://www.drupal.org//www.drupal.org/node/101494” [7] https://www.drupal.org/u/mlhess [8] https://www.drupal.org/u/damienmcKenna [9] https://www.drupal.org/u/alexpott [10] https://www.drupal.org/u/dsnopek [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/cashwilliams [13] https://www.drupal.org/contact [14] https://www.drupal.org/security-team [15] https://www.drupal.org/writing-secure-code [16] https://www.drupal.org/security/secure-configuration

1 0

Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-004
by security-news＠drupal.org 21 Sep '16

21 Sep '16

View online: https://www.drupal.org/SA-CORE-2016-004 -------- DESCRIPTION --------------------------------------------------------- Users who have rights to edit a node, can set the visibility on comments for that node. * Advisory ID: DRUPAL-SA-CORE-2016-004 * Project: Drupal core [1] * Version:li 8.x * Date: 2016-September-21 * Security risk: 18/25 ( Critical) AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] * Vulnerability: -------- DESCRIPTION --------------------------------------------------------- *Users without "Administer comments" can set comment visibility on nodes they can edit. (Less critical)* Users who have rights to edit a node, can set the visibility on comments for that node. This should be restricted to those who have the administer comments permission. *Cross-site Scripting in http exceptions (critical) * An attacker could create a specially crafted url, which could execute arbitrary code in the victim’s browser if loaded. Drupal was not properly sanitizing an exception *Full config export can be downloaded without administrative permissions (critical) * The system.temporary route would allow the download of a full config export. The full config export should be limited to those with Export configuration permission. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- 8.x -------- SOLUTION ------------------------------------------------------------ Upgrade to Drupal 8.1.10 -------- REPORTED BY --------------------------------------------------------- *Users without "Administer comments" can set comment visibility on nodes they can edit.* * Quintus Maximus [4] * Kier Heyl [5] *XSS in http exceptions* * Ivan [6] *Full config export can be downloaded without administrative permissions * * Anton Shubkin [7] -------- FIXED BY ------------------------------------------------------------ *Users without "Administer comments" can set comment visibility on nodes they can edit.* * Lee Rowlands of the Drupal Security Team [8] * Stefan Ruijsenaars of the Drupal Security Team [9] * Andrey Postnikov [10] * Daniel Wehner [11] *XSS in http exceptions* * xjm of the Drupal Security Team [12] * Daniel Wehner [13] * Alex Pott of the Drupal Security Team [14] * Cash Williams of the Drupal Security Team [15] * Pere Orga of the Drupal Security Team [16] * David Snopek of the Drupal Security Team [17] * Heine Deelstra of the Drupal Security Team *Full config export can be downloaded without administrative permissions * * Nathaniel Catchpole of the Drupal Security Team [18] * Alex Pott of the Drupal Security Team [19] * Anton Shubkin [20] * xjm of the Drupal Security Team [21] * Peter Wolanin of the Drupal Security Team [22] -------- COORDINATED BY ------------------------------------------------------ The Drupal Security Team [23] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [24]. Learn more about the Drupal Security team and their policies [25], writing secure code for Drupal [26], and securing your site [27]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [28] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://www.drupal.org/u/q2u [5] https://www.drupal.org/u/kierheyl [6] https://www.drupal.org/user/556138 [7] https://www.drupal.org/user/1060446 [8] http://www.drupal.org/u/larowlan [9] https://www.drupal.org/u/stefanr-0 [10] https://www.drupal.org/user/118908 [11] https://www.drupal.org/user/99340 [12] https://www.drupal.org/user/65776 [13] https://www.drupal.org/user/99340 [14] https://www.drupal.org/user/157725 [15] https://www.drupal.org/user/421070 [16] https://www.drupal.org/u/pere-orga [17] https://www.drupal.org/u/dsnopek [18] https://www.drupal.org/u/catch [19] https://www.drupal.org/user/157725 [20] https://www.drupal.org/user/1060446 [21] https://www.drupal.org/user/65776 [22] https://www.drupal.org/user/49851 [23] https://www.drupal.org/security-team [24] https://www.drupal.org/contact [25] https://www.drupal.org/security-team [26] https://www.drupal.org/writing-secure-code [27] https://www.drupal.org/security/secure-configuration [28] https://twitter.com/drupalsecurity

1 0

Flag Lists - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-051
by security-news＠drupal.org 07 Sep '16

07 Sep '16

View online: https://www.drupal.org/node/2796651 * Advisory ID: DRUPAL-SA-CONTRIB-2016-051 * Project: Flag Lists [1] (third-party module) * Version: 7.x * Date: 2016-September-07 * Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables regular users to create unlimited private flags called lists. The flag_lists module doesn't sufficiently filter the output when applying token strings to flag_lists links leading to a persistent Cross Site Scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the "Create flag lists" permission. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * flag_lists 7.x-3.x versions prior to 7.x-3.1. * flag_lists 7.x-1.x versions prior to 7.x-1.3. Please note that there are two different versions available of the flag_lists module. One 7.x-3.x which is used together with flag 7.x-3.x and one for the earlier flag module prior to 7.x-3.x. Drupal core is not affected. If you do not use the contributed Flag lists module, there is nothing you need to do. Drupal core is not affected. If you do not use the contributed Flag Lists [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the flag_lists module for Drupal 7.x-3.x, upgrade to Flag Lists 7.x-3.1 [5] * If you use the flag_lists module for Drupal 7.x-1.x, upgrade to Flag Lists 7.x-1.3 [6] Also see the Flag Lists [7] project page. -------- REPORTED BY --------------------------------------------------------- * Mike Madison [8] -------- FIXED BY ------------------------------------------------------------ * Thomas Nilsson [9] the flag_lists module maintainer * Joachim Noreiko [10] the flag module maintainer -------- COORDINATED BY ------------------------------------------------------ * Mike Potter [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/flag_lists [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/flag_lists [5] https://www.drupal.org/project/flag_lists/releases/7.x-3.1 [6] https://www.drupal.org/project/flag_lists/releases/7.x-1.3 [7] https://www.drupal.org/project/flag_lists [8] https://www.drupal.org/user/1232054 [9] https://www.drupal.org/user/15938 [10] https://www.drupal.org/user/107701 [11] https://www.drupal.org/user/616192 [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

Flag - Moderately Critical - Access Bypass - SA-CONTRIB-2016-050
by security-news＠drupal.org 31 Aug '16

31 Aug '16

View online: https://www.drupal.org/node/2793115 * Advisory ID: DRUPAL-SA-CONTRIB-2016-050 * Project: Flag [1] (third-party module) * Version: 7.x * Date: 2016-August-31 * Security risk: 12/25 ( Moderately Critical) AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- Flag enables users to mark content with any number of admin-defined flags, such as 'bookmarks' or 'spam'. Flag Bookmark is a submodule within Flag, which provides a 'bookmarks' flag, and default views to list bookmarked content. The provided view that lists each user's bookmarked content as a tab on their user profile has for its access control the permission to use the 'bookmarks' flag. This means that any user who has permission to use the 'bookmarks' flag can see the list of content that any user has bookmarked. This vulnerability is mitigated by the fact that the site must have enabled the Flag Bookmark module to create this view, and an attacker must have a role with the permission "Flag node entities as bookmarks". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Flag 7.x-3.x versions prior to 7.x-3.8. Drupal core is not affected. If you do not use the contributed Flag [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Flag module for Drupal 7.x, upgrade to Flag 7.x-3.8 [5] If you have Flag Bookmark enabled, or have enabled it in the past and still have the flag_bookmarks_tab view active, edit this and change the User: uid contextual filter's as follows: 1) set the validator to 'Current user ID matches argument value' 2) set the action to take if the filter value does not validate to 'Show "Page not found"'. Also see the Flag [6] project page. -------- REPORTED BY --------------------------------------------------------- * Dave Long [7] -------- FIXED BY ------------------------------------------------------------ * Joachim Noreiko [8], the module maintainer * Dave Long [9] -------- COORDINATED BY ------------------------------------------------------ * Lee Rowlands [10] of the Drupal Security Team * Michael Hess [11] of the Drupal Security Team * Mori Sugimoto [12] of the Drupal Security Team * Rick Manelius [13] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [18] [1] https://www.drupal.org/project/flag [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/flag [5] https://www.drupal.org/node/2793073 [6] https://www.drupal.org/project/flag [7] https://www.drupal.org/user/246492 [8] https://www.drupal.org/user/107701 [9] https://www.drupal.org/user/246492 [10] https://www.drupal.org/user/395439 [11] https://www.drupal.org/user/102818 [12] https://www.drupal.org/user/82971 [13] https://www.drupal.org/user/680072 [14] https://www.drupal.org/contact [15] https://www.drupal.org/security-team [16] https://www.drupal.org/writing-secure-code [17] https://www.drupal.org/security/secure-configuration [18] https://twitter.com/drupalsecurity

1 0

Workbench Scheduler - Moderately Critical - Access Bypass - SA-CONTRIB-2016-049
by security-news＠drupal.org 24 Aug '16

24 Aug '16

View online: https://www.drupal.org/node/2789421 * Advisory ID: DRUPAL-SA-CONTRIB-2016-049 * Project: Workbench Scheduler [1] (third-party module) * Version: 7.x * Date: 2016-August-24 * Security risk: 13/25 ( Moderately Critical) AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Workbench Scheduler module provides users with the ability to create schedules that change moderated content from one workbench moderation state to another. An authenticated user could add a schedule to a node even when that content type has schedules disabled. The vulnerability is mitigated by the fact that a attacker must have access to an account in the system with permission to edit content and create schedules. Also, only sites with a specific combination of permissions and modules are affected. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Workbench Scheduler 7.x-1.x versions prior to 7.x-1.9. Drupal core is not affected. If you do not use the contributed Workbench Scheduler [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Workbench Scheduler module for Drupal 7.x, upgrade to Workbench Scheduler 7.x-1.9 [5] Also see the Workbench Scheduler [6] project page. -------- REPORTED BY --------------------------------------------------------- * Caroline Boyden [7] -------- FIXED BY ------------------------------------------------------------ * Caroline Boyden [8] * Joshua Bolduc [9], the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/workbench_scheduler [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/workbench_scheduler [5] https://www.drupal.org/project/workbench_scheduler/releases/7.x-1.9 [6] https://www.drupal.org/project/workbench_scheduler [7] https://www.drupal.org/user/657902 [8] https://www.drupal.org/user/657902 [9] https://www.drupal.org/user/1386490 [10] https://www.drupal.org/u/pere-orga [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

Panelizer - Moderately Critical - Access Bypass - SA-CONTRIB-2016-048
by security-news＠drupal.org 17 Aug '16

17 Aug '16

View online: https://www.drupal.org/node/2785687 * Advisory ID: DRUPAL-SA-CONTRIB-2014-048 * Project: Panelizer [1] (third-party module) * Version: 7.x * Date: 2016-August-17 * Security risk: 12/25 ( Moderately Critical) AC:None/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Panelizer enables you to use Panels to replace the display of any entity, and even modify the Panels configuration in-place using the Panels In-Place Editor (IPE). The default behavior for Panels IPE is to allow any user with the permissions "Use the Panels In-Place Editor" and "Change layouts with the Panels In-Place Editor " access to the IPE regardless of whether or not a user has access to edit the underlying entity. While users cannot edit the entity itself, they can change the layout and the different panel panes shown (effectively allowing them to edit it). This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Use the Panels In-Place Editor" and the IPE must be enabled for the specific content type. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Panelizer 7.x-3.x versions prior to 7.x-3.3. Drupal core is not affected. If you do not use the contributed Panelizer [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Panelizer module for Drupal 7.x, upgrade to Panelizer 7.x-3.3 [5] Also see the Panelizer [6] project page. -------- REPORTED BY --------------------------------------------------------- * Branden Hamilton [7] * Joep Hendrix [8] -------- FIXED BY ------------------------------------------------------------ * Jakob Perry [9] the module maintainer * Damien Mckenna [10] * Mike Potter [11] provisional member of the Drupal Security Team * David Snopek [12] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Mike Potter [13] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [18] [1] https://www.drupal.org/project/panelizer [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/panelizer [5] https://www.drupal.org/project/panelizer/releases/7.x-3.3 [6] https://www.drupal.org/project/panelizer [7] https://www.drupal.org/u/brandenlhamilton [8] https://www.drupal.org/u/joep.hendrix [9] https://www.drupal.org/u/japerry [10] https://www.drupal.org/u/damienmckenna [11] https://www.drupal.org/u/mpotter [12] https://www.drupal.org/u/dsnopek [13] https://www.drupal.org/u/mpotter [14] https://www.drupal.org/contact [15] https://www.drupal.org/security-team [16] https://www.drupal.org/writing-secure-code [17] https://www.drupal.org/security/secure-configuration [18] https://twitter.com/drupalsecurity

1 0

Panels - Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-047
by security-news＠drupal.org 17 Aug '16

17 Aug '16

View online: https://www.drupal.org/node/2785631 * Advisory ID: DRUPAL-SA-CONTRIB-2016-047 * Project: Panels [1] (third-party module) * Version: 7.x * Date: 2016-August-17 * Security risk: 15/25 ( Critical) AC:None/A:None/CI:All/II:None/E:Theoretical/TD:All [2] * Vulnerability: Access bypass, Information Disclosure -------- DESCRIPTION --------------------------------------------------------- .... Panels does not check access on some routes (Critical) Panels allows users with certain permissions to modify the layout and panel panes on pages or entities utilizing panels. Much of the functionality to modify these panels rely on backend routes that call administrative forms. These forms did not provide any access checks, or site specific encoded urls. This can allow an attacker to guess the backend url as an anonymous user and see data loaded for the form. There is no mitigation for this exploit. Any site with panels enabled is vulnerable. .... Panels In-place Editor does not properly check for access (Moderately Critical) The Panels In-Place Editor (IPE) allows users with certain permissions to modify the layout and panel content of pages. The default behavior for Panels IPE is to allow any user with the permissions "Use the Panels In-Place Editor" and "Change layouts with the Panels In-Place Editor " access to the IPE regardless of whether or not a user has proper access to the page. While users cannot edit the page content itself, they can change the layout and the different panel panes shown. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Use the Panels In-Place Editor" and the IPE must be enabled for the specific content type. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Panels 7.x-3.x versions prior to 7.x-3.6. Drupal core is not affected. If you do not use the contributed Panels [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the panels module for Drupal 7x, upgrade to Panels 7.x-3.6 [5] Also see the Panels [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] of the Drupal Security Team * John Coltrane [8] * Branden Hamilton [9] * Joep Hendrix [10] -------- FIXED BY ------------------------------------------------------------ * Jakob Perry [11] the module maintainer * Damien Mckenna [12] * Mike Potter [13] provisional member of the Drupal Security Team * David Snopek [14] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Mike Potter [15] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [16]. Learn more about the Drupal Security team and their policies [17], writing secure code for Drupal [18], and securing your site [19]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [20] [1] https://www.drupal.org/project/panels [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/panels [5] https://www.drupal.org/node/2785597/edit [6] https://www.drupal.org/project/panels [7] https://www.drupal.org/u/pere-orga [8] https://www.drupal.org/u/jcoltrane [9] https://www.drupal.org/u/brandenlhamilton [10] https://www.drupal.org/user/125580 [11] https://www.drupal.org/u/japerry [12] https://www.drupal.org/u/damienmckenna [13] https://www.drupal.org/u/mpotter [14] https://www.drupal.org/u/dsnopek [15] https://www.drupal.org/u/mpotter [16] https://www.drupal.org/contact [17] https://www.drupal.org/security-team [18] https://www.drupal.org/writing-secure-code [19] https://www.drupal.org/security/secure-configuration [20] https://twitter.com/drupalsecurity

1 0

Hosting - Less Critical - Access bypass - SA-CONTRIB-2016-046
by security-news＠drupal.org 17 Aug '16

17 Aug '16

View online: https://www.drupal.org/node/2785531 * Advisory ID: DRUPAL-SA-CONTRIB-2016-046 * Project: Hosting [1] (third-party module) * Version: 7.x * Date: 2016-August-17 * Security risk: 9/25 ( Less Critical) AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Hosting module is a core component of the Aegir Hosting System. This install profile, and accompanying suite of modules, is a hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites. The Hosting module does not sufficiently control access to any custom content types created by the user. The default content types are sufficiently protected. This vulnerability is mitigated by the fact that on a typical installation the users who have access normally have admin privilege already, and few installations will have created additional custom content types. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Hosting 7.x-3.x versions prior to 7.x-3.7. Drupal core is not affected. If you do not use the contributed Hosting [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the hosting module for Drupal 7.x, upgrade to hosting 7.x-3.7 [5] Also see the Hosting [6] project page. -------- REPORTED BY --------------------------------------------------------- * Robin van Sloten (Neograph734) [7] -------- FIXED BY ------------------------------------------------------------ * Herman van Rink (helmo) [8] on of the module maintainers -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/hosting [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/hosting [5] https://www.drupal.org/project/hosting/releases/7.x-3.7 [6] https://www.drupal.org/project/hosting [7] https://www.drupal.org/user/2397482 [8] https://www.drupal.org/u/helmo [9] https://www.drupal.org/u/mlhess [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

Require Login - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2016-045
by security-news＠drupal.org 10 Aug '16

10 Aug '16

View online: https://www.drupal.org/node/2782109 * Advisory ID: SA-CONTRIB-2016-045 * Project: Require Login [1] (third-party module) * Version: 7.x, 8.x * Date: 2016-August-10 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting, Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to restrict site access without using user roles or permissions. The module does not sufficiently escape some of its settings, and, in some cases, allows malicious users to bypass the protection offered by Require Login. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Require Login 7.x-2.x versions prior to 7.x-2.4 * Require Login 8.x-1.x versions prior to 8.x-1.8 Drupal core is not affected. If you do not use the contributed Require Login [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Require Login module for Drupal 7.x, upgrade to Require Login 7.x-2.4 [5] * If you use the Require Login module for Drupal 8.x, upgrade to Require Login 8.x-1.8 [6] Also see the Require Login [7] project page. -------- REPORTED BY --------------------------------------------------------- * Ivo Van Geertruyen [8] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Robert Phillips [9] the module maintainer * Ivo Van Geertruyen [10] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Ivo Van Geertruyen [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/require_login [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/require_login [5] https://drupal.org/project/require_login/releases/7.x-2.4 [6] https://drupal.org/project/require_login/releases/8.x-1.8 [7] https://www.drupal.org/project/require_login [8] https://www.drupal.org/u/mr.baileys [9] https://www.drupal.org/user/459772 [10] https://www.drupal.org/u/mr.baileys [11] https://www.drupal.org/u/mr.baileys [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

OAuth2 Client- Moderately Critical - Cross Site Request Forgery - SA-CONTRIB-2016-044
by security-news＠drupal.org 10 Aug '16

10 Aug '16

View online: https://www.drupal.org/node/2782035 * Advisory ID: DRUPAL-SA-CONTRIB-2016-044 * Project: OAuth2 Client [1] (third-party module) * Version: 7.x * Date: 2016-August-10 * Security risk: 10/25 ( Moderately Critical) AC:Complex/A:None/CI:None/II:None/E:Proof/TD:All [2] * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- This module provides an OAuth2 client. The module does not check the validity of the state parameter, during server-side flow, before getting a token. This may allow a malicious user to feed a fake access_token to another user, and subsequently provide him fake data from the server. This page explains it in more details: http://www.twobotechnologies.com/blog/2014/02/importance-of-state-in-oau... [3] -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * OAuth2 Client 7.x-1.x versions prior to 7.x-1.5. Drupal core is not affected. If you do not use the contributed OAuth2 Client [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the OAuth2 Client module for Drupal 7.x, upgrade to OAuth2 Client 7.x-1.5 [6] Also see the OAuth2 Client [7] project page. -------- REPORTED BY --------------------------------------------------------- * Jason Woods [8] -------- FIXED BY ------------------------------------------------------------ * Dashamir Hoxha [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/oauth2_client [2] https://www.drupal.org/security-team/risk-levels [3] http://www.twobotechnologies.com/blog/2014/02/importance-of-state-in-oauth2… [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/oauth2_client [6] https://www.drupal.org/project/oauth2_client/releases/7.x-1.5 [7] https://www.drupal.org/project/oauth2_client [8] https://www.drupal.org/u/Driskell [9] https://www.drupal.org/u/dashohoxha [10] https://www.drupal.org/u/mlhess [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0