[Security-news] SA-CONTRIB-2009-102 - PHPList Integration Module - Cross Site Request Forgery

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2009-102
  * Project: PHPList Inegration Module (third-party module)
  * Version: 5.x, 6.x
  * Date: 2009-November-18
  * Security risk: Less Critical
  * Exploitable from: Remote
  * Vulnerability: Cross site request forgery

-------- DESCRIPTION  
---------------------------------------------------------

The PHPList module provides a basic level of integration between Drupal and
the PHPList mailing list application. The Drupal Forms API protects against
cross site request forgeries (CSRF), where a malicious site can cause a user
to unintentionally submit a form to a site where they are authenticated. The
links for subscribing and un-subscribing to and from mailing lists in "My
Account" do not follow the standard Forms API submission model and are
therefore not protected against this type of attack. A CSRF attack may result
in unintentional subscription or un-subscription of site users to PHPList
mailing lists.
-------- VERSIONS AFFECTED  
---------------------------------------------------

  * PHPList Integration Module for Drupal 5 before 5.x-1.2
  * PHPList Integration Module for Drupal 6 before 6.x-1.1

Drupal core is not affected. If you do not use the contributed PHPList
Integration module, there is nothing you need to do.
-------- SOLUTION  
------------------------------------------------------------

Install the latest version: If you use Drupal 5.x upgrade to PHPList
Integration Module 5.x-1.2 [1]. If you use Drupal 6.x upgrade to PHPList
Integration Module 6.x-1.1 [2]. See also the PHPList Integration Module [3]
project page.
-------- REPORTED BY  
---------------------------------------------------------

Peter Wolanin [4] of the Drupal Security Team
-------- FIXED BY  
------------------------------------------------------------

Paul Beaney [5] the module maintainer.
-------- CONTACT  
-------------------------------------------------------------

The security contact for Drupal can be reached at security at drupal.org or
via the form at http://drupal.org/contact.

[1] http://drupal.org/node/636400
[2] http://drupal.org/node/636398
[3] http://drupal.org/project/phplist
[4] http://drupal.org/user/49851
[5] http://drupal.org/user/204611