[Security-news] SA-CONTRIB-2011-039 - Bot Alarm - Multiple vulnerabilities

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2011-039
  * Project: Bot Alarm [1] (third-party module)
  * Version: 6.x
  * Date: 2011-August-31
  * Security risk: Critical [2]
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting, Cross Site Request Forgery

-------- DESCRIPTION  
---------------------------------------------------------

This module enables you to set alarms for your IRC bot. The module does not
properly escape the message and channels of alarms in pages listing the
alarms, leading to a Cross Site Scripting (XSS) vulnerability. This
vulnerability is mitigated by the fact that an attacker must have a role with
the permission 'administer bot'. The module does not check for any
one-time-use tokens when deleting an alarm, leading to a Cross Site Request
Forgery (CSRF ) vulnerability. This vulnerability is mitigated by the fact
that an attacker must have a role with the permission 'administer bot'.
-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Bot Alarm 6.x-1.0

Drupal core is not affected. If you do not use the contributed Bot Alarm [3]
module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use the bot_alarm module for Drupal 6.x, upgrade to 6.x-1.2 [4]

See also the Bot Alarm [5] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * CSÉCSY László [6]

-------- FIXED BY  
------------------------------------------------------------

  * Aaron Forsander [7] the module maintainer

-------- RELEASE COORDINATED BY  
----------------------------------------------

  * Michael Hess [8], Greg Knaddison [9] and Ben Jeavons [10] of the Drupal
    Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [11].

Learn more about the Drupal Security team and their policies [12], writing
secure code for Drupal [13], and securing your site [14].


[1] http://drupal.org/project/bot_alarm
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/project/bot_alarm
[4] http://drupal.org/node/1265642
[5] http://drupal.org/project/bot_alarm
[6] http://drupal.org/user/199303
[7] http://drupal.org/user/737486
[8] http://drupal.org/user/102818
[9] http://drupal.org/user/36762
[10] http://drupal.org/user/91990
[11] http://drupal.org/contact
[12] http://drupal.org/security-team
[13] http://drupal.org/writing-secure-code
[14] http://drupal.org/security/secure-configuration