SA-CONTRIB-2009-038 - Nodequeue - Multiple vulnerabilities - Security-news

10 Jun 2009


      * Advisory ID: DRUPAL-SA-CONTRIB-2009-038
  * Project: Nodequeue (third-party module)
  * Version: 5.x, 6.x
  * Date: 2009-June-10
  * Security risk: Moderately critical
  * Exploitable from: Remote
  * Vulnerability: Multiple vulnerabilities
-------- DESCRIPTION  
---------------------------------------------------------
The Nodequeue module enables an administrator to arbitrarily put nodes in a
group for some purpose, such as providing a listing of nodes or featuring a
particular node. It suffers from a cross-site scripting [1] (XSS)
vulnerability due to not properly sanitizing vocabulary names before they are
displayed. Additionally, the module does not respect node access restrictions
when displaying node titles.
-------- VERSIONS AFFECTED  
---------------------------------------------------
* Nodequeue for Drupal 5.x prior to Nodequeue 5.x-2.7
  * Nodequeue for Drupal 6.x prior to Nodequeue 6.x-2.2
Drupal core is not affected. If you do not use the contributed Nodequeue
module, there is nothing you need to do.
-------- SOLUTION  
------------------------------------------------------------
Upgrade to the latest version:
  * If you use Nodequeue for Drupal 5.x upgrade to Nodequeue 5.x-2.7 [2]
  * If you use Nodequeue for Drupal 6.x upgrade to Nodequeue 6.x-2.2 [3]
See also the Nodequeue project page [4].
-------- REPORTED BY  
---------------------------------------------------------
* The XSS issue was reported by Justin C. Klein Keane [5].
  * The access bypass issue was reported by Ezra Barnett Gildesgame [6].
-------- FIXED BY  
------------------------------------------------------------
* The XSS issue was fixed by Justin C. Klein Keane [7].
  * The access bypass issue was fixed by Ezra Barnett Gildesgame [8] and Earl
    Miles [9].
-------- CONTACT  
-------------------------------------------------------------
The security contact for Drupal can be reached at security at drupal.org or
via the form at http://drupal.org/contact.
[1] http://en.wikipedia.org/wiki/Cross-site_scripting
[2] http://drupal.org/node/488104
[3] http://drupal.org/node/488102
[4] http://drupal.org/project/nodequeue
[5] http://drupal.org/user/302225
[6] http://drupal.org/user/69959
[7] http://drupal.org/user/302225
[8] http://drupal.org/user/69959
[9] http://drupal.org/user/26979