View online: http://drupal.org/node/1841046
* Advisory ID: DRUPAL-SA-CONTRIB-2012-166 * Project: Table of Contents [1] (third-party module) * Version: 6.x * Date: 2012-November-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass
-------- DESCRIPTION ---------------------------------------------------------
This module enables you to generates a list of select header tags in a box that looks like a table of contents or summary. The links added to that box point to the headers so users can quickly access each section of your documents.
The module doesn't sufficiently check for node access restrictions when displaying the table of contents in a block.
This vulnerability is mitigated by the fact that an attacker must find a node that is not visible to him/her and yet displays its blocks including the table of contents block. In some Drupal installations, this can happen for unpublished nodes. Also, the attacker will only see the headers (content between H1 to H6 tags) appearing in the table of contents, not the entire page.
CVE: Requested
-------- VERSIONS AFFECTED ---------------------------------------------------
* tableofcontents 6.x-3.x versions prior to 6.x-3.8.
Drupal core is not affected. If you do not use the contributed Table of Contents [3] module, there is nothing you need to do.
-------- SOLUTION ------------------------------------------------------------
Install the latest version:
* If you use the table of contents module for Drupal 6.x, upgrade to tableofcontents 6.x-3.8 [4]
Also see the Table of Contents [5] project page.
-------- REPORTED BY ---------------------------------------------------------
* Erik Webb [6]
-------- FIXED BY ------------------------------------------------------------
* Erik Webb [7] the reporter * Alexis Wilke [8] the Drupal 6.x maintainer
-------- COORDINATED BY ------------------------------------------------------
* Greg Knaddison [9] of the Drupal Security Team
-------- CONTACT AND MORE INFORMATION ----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10].
Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13].
[1] http://drupal.org/project/tableofcontents [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/tableofcontents [4] http://drupal.org/node/1841026 [5] http://drupal.org/project/tableofcontents [6] http://drupal.org/user/273404 [7] http://drupal.org/user/273404 [8] http://drupal.org/user/356197 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration