[Security-news] SA-CONTRIB-2012-056 - Janrain Engage - Sensitive Data Protection Vulnerability

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2012-056
  * Project: Janrain Engage (formerly RPX) [1] (third-party module)
  * Version: 6.x, 7.x
  * Date: 2012-April-04
  * Security risk: Less critical [2]
  * Exploitable from: Not exploitable
  * Vulnerability: Sensitive Data Protection Vulnerability

-------- DESCRIPTION  
---------------------------------------------------------

Using Janrain Engage, Drupal sites can authenticate new and existing users
with popular social networks, map user profile data from these websites to
Drupal fields, and share Drupal content with a user's friends on their social
networks.

The module permanently retains the complete user profile data returned from
Engage in the users table. Only a subset of that data is needed for a limited
time. The profile data is also stored in the sessions table. This is
undesirable as it may include sensitive information (such as provider access
tokens).

This is not an immediate vulnerability per se as it does not create an attack
vector (i.e. it cannot be exploited) but it makes other weaknesses much more
critical (e.g. a data breach could be parlayed into privilege escalation).

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Janrain Engage (formerly RPX) 6.x-1.x versions (all).
  * Janrain Engage (formerly RPX) 6.x-2.x versions prior to 6.x-2.2.
  * Janrain Engage (formerly RPX) 7.x-2.x versions prior to 7.x-2.2.

Drupal core is not affected. If you do not use the contributed Janrain Engage
(formerly RPX) [3] module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use Janrain Engage (formerly RPX) for Drupal 6.x, upgrade to
    version 6.x-2.2 [4]
  * If you use Janrain Engage (formerly RPX) for Drupal 7.x, upgrade to
    version 7.x-2.2 [5]

Also see the Janrain Engage (formerly RPX) [6] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Peter Wolanin [7] of the Drupal Security Team

-------- FIXED BY  
------------------------------------------------------------

  * George Katsitadze [8] the module maintainer

-------- COORDINATED BY  
------------------------------------------------------

  * Peter Wolanin [9] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [10].

Learn more about the Drupal Security team and their policies [11], writing
secure code for Drupal [12], and securing your site [13].


[1] http://drupal.org/project/rpx
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/project/rpx
[4] http://drupal.org/node/1515114
[5] http://drupal.org/node/1515120
[6] http://drupal.org/project/rpx
[7] http://drupal.org/user/49851
[8] http://drupal.org/user/933066
[9] http://drupal.org/user/49851
[10] http://drupal.org/contact
[11] http://drupal.org/security-team
[12] http://drupal.org/writing-secure-code
[13] http://drupal.org/security/secure-configuration