[Security-news] SA-CONTRIB-2013-090 - Revisioning - Access Bypass

[security-news at drupal.org]

View online: https://drupal.org/node/2135257

   * Advisory ID: DRUPAL-SA-CONTRIB-2013-090
   * Project: Revisioning [1] (third-party module)
   * Version: 7.x
   * Date: 2013-November-13
   * Security risk: Moderately critical [2]
   * Exploitable from: Remote
   * Vulnerability: Access bypass

-------- DESCRIPTION
---------------------------------------------------------

This module enables you to create content publication workflows whereby one
version of the content is "live" (publicly visible), while another is being
edited and moderated privately until found fit for publication.
The module doesn't sufficiently apply node access permissions when used in
combination with BOTH the Scheduler module AND a module that modifies the
node access permissions table.

As a result it is possible that content that was Scheduled to be unpublished
can still be viewed by authenticated users who, based on the node access
table, should no longer have permission to view this content.

This vulnerability is mitigated by the fact that this only occurs for
Authenticated users for Scheduled content on Drupal sites with the
combination of all three modules: Revisioning, Scheduler and a module that
modifies the node access table conditional on the publication status of the
content. In this report this was the Organic Groups Moderation module.


-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [3] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

   * Revisioning 7.x-1.x versions prior to 7.x-1.6

Drupal core is not affected. If you do not use the contributed Revisioning
[4] module, there is nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

   * If you use the Revisioning module, version 7.x-1.5 or older, upgrade to
     Revisioning 7.x-1.6 [5]

Also see the Revisioning [6] project page.

-------- REPORTED BY
---------------------------------------------------------

   * Pete Gillis [7]

-------- FIXED BY
------------------------------------------------------------

   * Rik de Boer [8], the module maintainer, with assistance from Pete Gillis
     [9]

-------- COORDINATED BY
------------------------------------------------------

   * Greg Knaddison [10] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [11].

Learn more about the Drupal Security team and their policies [12], writing
secure code for Drupal [13], and securing your site [14].


[1] http://drupal.org/project/revisioning
[2] http://drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] http://drupal.org/project/revisioning
[5] https://drupal.org/node/2133555
[6] http://drupal.org/project/revisioning
[7] http://drupal.org/user/373976
[8] http://drupal.org/user/404007
[9] http://drupal.org/user/373976
[10] http://drupal.org/user/36762
[11] http://drupal.org/contact
[12] http://drupal.org/security-team
[13] http://drupal.org/writing-secure-code
[14] http://drupal.org/security/secure-configuration