Biztonsági figyelmeztetések

SA-CORE-2014-001 - Drupal core - Multiple vulnerabilities

Biztonsági figyelmeztetések (core) - 2014. január 15. 20.33
  • Advisory ID: DRUPAL-SA-CORE-2014-001
  • Project: Drupal core
  • Version: 6.x, 7.x
  • Date: 2014-January-15
  • Security risk: Highly critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities
Description

Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7.

Impersonation (OpenID module - Drupal 6 and 7 - Highly critical)

A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts.

This vulnerability is mitigated by the fact that the malicious user must have an account on the site (or be able to create one), and the victim must have an account with one or more associated OpenID identities.

Access bypass (Taxonomy module - Drupal 7 - Moderately critical)

The Taxonomy module provides various listing pages which display content tagged with a particular taxonomy term. Custom or contributed modules may also provide similar lists. Under certain circumstances, unpublished content can appear on these pages and will be visible to users who should not have permission to see it.

This vulnerability is mitigated by the fact that it only occurs on Drupal 7 sites which upgraded from Drupal 6 or earlier.

Security hardening (Form API - Drupal 7 - Not critical)

The form API provides a method for developers to submit forms programmatically using the function drupal_form_submit(). During programmatic form submissions, all access checks are deliberately bypassed, and any form element may be submitted regardless of the current user's access level.

This is normal and expected behavior for most uses of programmatic form submissions; however, there are cases where custom or contributed code may need to send data provided by the current (untrusted) user to drupal_form_submit() and therefore need to respect access control on the form.

To facilitate this, a new, optional $form_state['programmed_bypass_access_check'] element has been added to the Drupal 7 form API. If this is provided and set to FALSE, drupal_form_submit() will perform the normal form access checks against the current user while submitting the form, rather than bypassing them.

This change does not fix a security issue in Drupal core itself, but rather provides a method for custom or contributed code to fix security issues that would be difficult or impossible to fix otherwise.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Drupal core 6.x versions prior to 6.30.
  • Drupal core 7.x versions prior to 7.26.
Solution

Install the latest version:

Also see the Drupal core project page.

Reported by
  • The OpenID module impersonation issue was reported by Christian Mainka and Vladislav Mladenov.
  • The Taxonomy module access bypass issue was reported by Matt Vance, and by Damien Tournoud of the Drupal Security Team.
  • The form API access bypass issue was reported by David Rothstein of the Drupal Security Team.
Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 6.xDrupal 7.x

SA-CONTRIB-2014-002 - Anonymous Posting - Cross Site Scripting (XSS)

Biztonsági figyelmeztetések (contrib) - 2014. január 14. 16.09
  • Advisory ID: DRUPAL-SA-CONTRIB-2014-002
  • Project: Anonymous Posting (third-party module)
  • Version: 7.x
  • Date: 2014-01-15
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting
Description

This module allows anonymous users to fill in their contact information (name, email and homepage) when posting any content type including Forum Topics. This allows the submitted name to be shown instead of the usual anonymous string provided by Drupal core.

The module doesn't properly sanitize the name submitted by the anonymous user before it is output.

This vulnerability is mitigated only by the fact that use of anonymous posting data must be enabled on a per content type basis by a user with permission to do so since it is not enabled by default. However when configured for it's intended purpose, the vulnerability is not mitigated.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Anonymous Posting 7.x-1.x versions 7.x-1.2 and 7.x-1.3

Drupal core is not affected. If you do not use the contributed Anonymous Posting module, there is nothing you need to do.

Solution
  • Install the latest version: 7.x-1.4

Also see the Anonymous Posting project page.

Reported by
  • drikc the module maintainer
Fixed by
  • drikc the module maintainer
Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

SA-CONTRIB-2014-001 - Entity API - Access Bypass

Biztonsági figyelmeztetések (contrib) - 2014. január 8. 18.32
  • Advisory ID: DRUPAL-SA-CONTRIB-2014-001
  • Project: Entity API (third-party module)
  • Version: 7.x
  • Date: 2014-January-08
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Access bypass
Description

The Entity API module extends the entity API of Drupal core in order to provide a unified way to deal with entities and their properties.

Comment, User and Node Statistics property access bypass

The module's entity wrapper access API doesn't sufficiently protect comment, user and node statistics properties from unprivileged user access.

This vulnerability is mitigated by the fact that a module must be enabled that relies on the Entity property access API and it must be configured to expose either comment, user or node statistics properties. One example would be the RESTful Web Services module (RESTWS) with the permission configured to access the comment, user or node resource for untrusted web service consumers.

Entity list property access bypass

The module's entity wrapper access API doesn't sufficiently check entity access on referenced entities such as taxonomy terms.

This vulnerability is mitigated by the fact that a module must be enabled that uses the access() method of entity metadata wrappers to determine access to a property which references multiple entities to which access is not granted. One example would be the RESTful Web Services module (RESTWS) with respectively configured permissions on an entity property or (entity reference) field, for example a list of (unaccessible) referenced user entities on a node entity.

Unpublished comments access bypass

The module's entity_access() API doesn't protect unpublished comments from being viewed by unprivileged users.

This vulnerability is mitigated by the fact a module must be enabled which uses the provided entity access API on comments and the comment module must be enabled.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Entity API 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed Entity API module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Entity API project page.

Reported by
  • The Comment, User and Node Statistics property access bypass was reported by Clemens Tolboom.
  • The Entity list property access bypass was reported by Neil Drumm of the Drupal Security Team.
  • The Unpublished comments access bypass was reported by Ezra Barnett Gildesgame.
Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Oldalak

Subscribe to drupal.hu hírolvasó - Biztonsági figyelmeztetések