[Security-news] SA-CONTRIB-2009-082 - Filefield module access bypass

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2009-082
  * Project: FileField (third-party module)
  * Version: 6.x
  * Date: 2009-October-20
  * Security risk: Moderately Critical
  * Exploitable from: Remote
  * Vulnerability: Access bypass

.... Description

The FileField module allows users to upload files through an AJAX-upload
widget that can be added to content types through CCK. In the 3.1 version of
FileField, the module would not restrict access to files based on node-access
permissions when using Drupal core's private file system.
.... Versions affected

  * FileField module 6.x-3.1 only

Drupal core is not affected. If you do not use the contributed FileField
module, there is nothing you need to do.
.... Solution

Install the latest version.
  * If you use the FileField module for Drupal 6.x upgrade to FileField module
    6.x-3.2 [1]

See also the FileField module project page [2].
.... Reported by

isaac77 [3].
.... Fixed by

isaac77 [4] and quicksketch [5] the module maintainer.
.... Contact

The security team for Drupal can be reached at security at drupal.org or via
the form at http://drupal.org/contact.

[1] http://drupal.org/node/609874
[2] http://drupal.org/project/filefield
[3] http://drupal.org/user/49318
[4] http://drupal.org/user/49318
[5] http://drupal.org/user/35821