View online: http://drupal.org/node/1679820 * Advisory ID: SA-CONTRIB-2012-112 * Project: Ubercart SecureTrading Payment Method [1] (third-party module) * Version: 6.x * Date: 2012-July-11 * Security risk: Highly critical [2] * Exploitable from: Remote * Vulnerability: Failure to follow guideline/specification - integrity check value -------- DESCRIPTION --------------------------------------------------------- The Ubercart SecureTrading Payment Method module provides an Ubercart payment method for the SecureTrading.com gateway. The module's payment method did not properly verify the validity of payment notification information. A malicious user could trick a site into thinking that an item has been paid for when in fact it hasn't. If you do not use the Ubercart SecureTrading Payment Method payment method then your site is not at risk to this vulnerability. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * All versions of the Ubercart SecureTrading Payment Method module. Drupal core is not affected. If you do not use the contributed Ubercart SecureTrading Payment Method [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ There is not currently a fixed version of the module. You should disable the module immediately. You can: * Change to a new gateway. * Work with the module maintainer and/or other users to patch the module. Also see the Ubercart SecureTrading Payment Method [4] project page. -------- REPORTED BY --------------------------------------------------------- * Dylan Tack [5] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ No fix provided. -------- COORDINATED BY ------------------------------------------------------ * Dylan Tack [6] of the Drupal Security Team * Damien Tournoud [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/uc_securetrading [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/uc_securetrading [4] http://drupal.org/project/uc_securetrading [5] http://drupal.org/user/96647 [6] http://drupal.org/user/96647 [7] http://drupal.org/user/22211 [8] http://drupal.org/user/36762 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration