[Security-news] SA-CONTRIB-2012-166 - Table of Contents - Access Bypass

[security-news at drupal.org]

View online: http://drupal.org/node/1841046

  * Advisory ID: DRUPAL-SA-CONTRIB-2012-166
  * Project: Table of Contents [1] (third-party module)
  * Version: 6.x
  * Date: 2012-November-14
  * Security risk: Moderately critical [2]
  * Exploitable from: Remote
  * Vulnerability: Access bypass

-------- DESCRIPTION  
---------------------------------------------------------

This module enables you to generates a list of select header tags in a box
that looks like a table of contents or summary. The links added to that box
point to the headers so users can quickly access each section of your
documents.

The module doesn't sufficiently check for node access restrictions when
displaying the table of contents in a block.

This vulnerability is mitigated by the fact that an attacker must find a node
that is not visible to him/her and yet displays its blocks including the
table of contents block. In some Drupal installations, this can happen for
unpublished nodes. Also, the attacker will only see the headers (content
between H1 to H6 tags) appearing in the table of contents, not the entire
page.

CVE: Requested

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * tableofcontents 6.x-3.x versions prior to 6.x-3.8.

Drupal core is not affected. If you do not use the contributed Table of
Contents [3] module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use the table of contents module for Drupal 6.x, upgrade to
    tableofcontents 6.x-3.8 [4]

Also see the Table of Contents [5] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Erik Webb [6]

-------- FIXED BY  
------------------------------------------------------------

  * Erik Webb [7] the reporter
  * Alexis Wilke [8] the Drupal 6.x maintainer

-------- COORDINATED BY  
------------------------------------------------------

  * Greg Knaddison [9] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [10].

Learn more about the Drupal Security team and their policies [11], writing
secure code for Drupal [12], and securing your site [13].


[1] http://drupal.org/project/tableofcontents
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/project/tableofcontents
[4] http://drupal.org/node/1841026
[5] http://drupal.org/project/tableofcontents
[6] http://drupal.org/user/273404
[7] http://drupal.org/user/273404
[8] http://drupal.org/user/356197
[9] http://drupal.org/user/36762
[10] http://drupal.org/contact
[11] http://drupal.org/security-team
[12] http://drupal.org/writing-secure-code
[13] http://drupal.org/security/secure-configuration