[Security-news] SA-CONTRIB-2012-112 - Ubercart SecureTrading - Failure to follow guideline/specification

[security-news at drupal.org]

View online: http://drupal.org/node/1679820

  * Advisory ID: SA-CONTRIB-2012-112
  * Project: Ubercart SecureTrading Payment Method [1] (third-party module)
  * Version: 6.x
  * Date: 2012-July-11
  * Security risk: Highly critical [2]
  * Exploitable from: Remote
  * Vulnerability: Failure to follow guideline/specification - integrity check
    value

-------- DESCRIPTION  
---------------------------------------------------------

The Ubercart SecureTrading Payment Method module provides an Ubercart payment
method for the SecureTrading.com gateway.
The module's payment method did not properly verify the validity of payment
notification information. A malicious user could trick a site into thinking
that an item has been paid for when in fact it hasn't. If you do not use the
Ubercart SecureTrading Payment Method payment method then your site is not at
risk to this vulnerability.

CVE: Requested

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * All versions of the Ubercart SecureTrading Payment Method module.

Drupal core is not affected. If you do not use the contributed Ubercart
SecureTrading Payment Method [3] module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

There is not currently a fixed version of the module. You should disable the
module immediately.

You can:

  * Change to a new gateway.
  * Work with the module maintainer and/or other users to patch the module.

Also see the Ubercart SecureTrading Payment Method [4] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Dylan Tack [5] of the Drupal Security Team

-------- FIXED BY  
------------------------------------------------------------

No fix provided.

-------- COORDINATED BY  
------------------------------------------------------

  * Dylan Tack [6] of the Drupal Security Team
  * Damien Tournoud [7] of the Drupal Security Team
  * Greg Knaddison [8] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [9].

Learn more about the Drupal Security team and their policies [10], writing
secure code for Drupal [11], and securing your site [12].


[1] http://drupal.org/project/uc_securetrading
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/project/uc_securetrading
[4] http://drupal.org/project/uc_securetrading
[5] http://drupal.org/user/96647
[6] http://drupal.org/user/96647
[7] http://drupal.org/user/22211
[8] http://drupal.org/user/36762
[9] http://drupal.org/contact
[10] http://drupal.org/security-team
[11] http://drupal.org/writing-secure-code
[12] http://drupal.org/security/secure-configuration