[Security-news] SA-CONTRIB-2012-065 - Sitedoc - Information disclosure

[security-news at drupal.org]

View online: http://drupal.org/node/1547686

  * Advisory ID: DRUPAL-SA-CONTRIB-2012-065
  * Project: Site Documentation [1] (third-party module)
  * Version: 6.x
  * Date: 2012-April-25
  * Security risk: Moderately critical [2]
  * Exploitable from: Remote
  * Vulnerability: Information Disclosure

-------- DESCRIPTION  
---------------------------------------------------------

This module enables you to display a plethora of information about your
site's structure. Optionally, the information may be saved into a file for
later comparison.

The module doesn't sufficiently verify that the saved file is protected by
the Private File System.

This vulnerability is mitigated by the fact that the administrator must have
configured the module to save the HTML report file to disk.

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Sitedoc 6.x-1.x versions prior to 6.x-1.4.

Drupal core is not affected. If you do not use the contributed Site
Documentation [3] module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use the Sitedoc module for Drupal 6.x, upgrade to Sitedoc 6.x-1.4
    [4], and
  * Enable the private file system if you want to save the output file.

Also see the Site Documentation [5] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Jakub Suchý [6] of the Drupal Security Team

-------- FIXED BY  
------------------------------------------------------------

  * Nancy Wichmann [7], the module maintainer

-------- COORDINATED BY  
------------------------------------------------------

  * Forest Monsen [8] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [9].

Learn more about the Drupal Security team and their policies [10], writing
secure code for Drupal [11], and securing your site [12].


[1] http://drupal.org/project/sitedoc
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/project/sitedoc
[4] http://drupal.org/node/1546224
[5] http://drupal.org/project/sitedoc
[6] http://drupal.org/user/31977
[7] http://drupal.org/user/101412
[8] http://drupal.org/user/181798
[9] http://drupal.org/contact
[10] http://drupal.org/security-team
[11] http://drupal.org/writing-secure-code
[12] http://drupal.org/security/secure-configuration