[Security-news] SA-CONTRIB-2012-001 - Registration Codes - Access bypass

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2012-001
  * Project: Registration Codes (third-party module)
  * Version: 6.x
  * Date: 2012-January-04
  * Security risk: Critical
  * Exploitable from: Remote
  * Vulnerability: Access bypass

-------- DESCRIPTION  
---------------------------------------------------------

The Registration Codes module enables site administrators to restrict
registration for new accounts to only users who provide a valid registration
code.

The default module installation provides no access check for the registration
code list, leading to a vulnerability that allows unauthenticated members to
easily view the registration code list.

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Registration Codes module for Drupal 6.x versions prior to 6.x-2.4

Drupal core is not affected. If you do not use the contributed Registration
Codes [1] module, there is nothing you need to do.
-------- SOLUTION  
------------------------------------------------------------

Install the latest version:
  * If you use the Registration Codes module for Drupal 6.x upgrade to
    Registration codes 6.x-2.4 [2] or later.

-------- REPORTED BY  
---------------------------------------------------------

  * Thomas Bonte (toemaz) [3]

-------- FIXED BY  
------------------------------------------------------------

  * Aidan Lister (aidanlis) [4], module maintainer

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
form at http://drupal.org/contact. Learn more about the team and their
policies [5], writing secure code for Drupal [6], and secure configuration
[7] of your site.

[1] http://drupal.org/project/regcode
[2] http://drupal.org/node/877992
[3] http://drupal.org/user/19502
[4] http://drupal.org/user/502018
[5] http://drupal.org/security-team
[6] http://drupal.org/writing-secure-code
[7] http://drupal.org/security/secure-configuration