[Security-news] SA-CONTRIB-2014-011 - Push Notifications - Information Disclosure

[security-news at drupal.org]

View online: https://drupal.org/node/2189643

   * Advisory ID: DRUPAL-SA-CONTRIB-2014-011
   * Project: Push Notifications [1] (third-party module)
   * Version: 7.x
   * Date: 2014-February-05
   * Security risk: Less critical [2]
   * Exploitable from: Remote
   * Vulnerability: Information Disclosure

-------- DESCRIPTION
---------------------------------------------------------

This module enables the delivery of push notifications to iOS and Android
devices.

The module doesn't sufficiently randomize the certificate filenames required
for Apple's Push Notification service or protect the files from being
publicly accessible, which could allow an attacker to acquire the
certificates and broadcast push notifications to the target's user base.

This vulnerability primarily affects sites that did not follow the general
security best practice of placing certificates into a directory outside of
the webroot and did not use password-protected certificate files.


-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [3] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

   * push_notifications 7.x-1.x versions prior to 7.x-1.1

Drupal core is not affected. If you do not use the contributed Push
Notifications [4] module, there is nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

   * If you use the push_notifications module for Drupal 7.x and your APNS
     certificate files are stored in the default directory, upgrade to
     push_notifications 7.x-1.1 [5]
   * Navigate to the configuration page for the push_notifications module
     (admin/config/services/push_notifications/configure) and click the
     "Generate new certificate string" button to generate a random filename.
     Then, rename your APNS certificates according to the instructions on the
     push notification configuration page.

Also see the Push Notifications [6] project page.

-------- REPORTED BY
---------------------------------------------------------

   * Graham Bates [7] of the Drupal Security Team

-------- FIXED BY
------------------------------------------------------------

   * Daniel Hanold [8] the module maintainer

-------- COORDINATED BY
------------------------------------------------------

   * Laurence Liss [9] provisional member of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [10].

Learn more about the Drupal Security team and their policies [11], writing
secure code for Drupal [12], and securing your site [13].

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [14]


[1] http://drupal.org/project/push_notifications
[2] http://drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] http://drupal.org/project/push_notifications
[5] http://drupal.org/node/2188983
[6] http://drupal.org/project/push_notifications
[7] http://drupal.org/user/16029
[8] http://drupal.org/user/339733
[9] http://drupal.org/user/724750
[10] http://drupal.org/contact
[11] http://drupal.org/security-team
[12] http://drupal.org/writing-secure-code
[13] http://drupal.org/security/secure-configuration
[14] https://twitter.com/drupalsecurity