Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.0063.2
DRUPAL-SA-CORE-2014-001
21 January 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Drupal
Publisher: Drupal Security Team
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Administrator Compromise -- Existing Account
Access Privileged Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2014-1476 CVE-2014-1475
Original Bulletin:
https://drupal.org/SA-CORE-2014-001
Revision History: January 21 2014: Added CVEs
January 16 2014: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
* Advisory ID: DRUPAL-SA-CORE-2014-001
* Project: Drupal core [1]
* Version: 6.x, 7.x
* Date: 2014-January-15
* Security risk: Highly critical [2]
* Exploitable from: Remote
* Vulnerability: Multiple vulnerabilities
- -------- DESCRIPTION ---------------------------------------------------------
Multiple vulnerabilities were fixed in the supported Drupal core versions 6
and 7.
.... Impersonation (OpenID module - Drupal 6 and 7 - Highly critical)
A vulnerability was found in the OpenID module that allows a malicious user
to log in as other users on the site, including administrators, and hijack
their accounts.
This vulnerability is mitigated by the fact that the malicious user must have
an account on the site (or be able to create one), and the victim must have
an account with one or more associated OpenID identities.
.... Access bypass (Taxonomy module - Drupal 7 - Moderately critical)
The Taxonomy module provides various listing pages which display content
tagged with a particular taxonomy term. Custom or contributed modules may
also provide similar lists. Under certain circumstances, unpublished content
can appear on these pages and will be visible to users who should not have
permission to see it.
This vulnerability is mitigated by the fact that it only occurs on Drupal 7
sites which upgraded from Drupal 6 or earlier.
.... Security hardening (Form API - Drupal 7 - Not critical)
The form API provides a method for developers to submit forms
programmatically using the function drupal_form_submit(). During
programmatic form submissions, all access checks are deliberately bypassed,
and any form element may be submitted regardless of the current user's access
level.
This is normal and expected behavior for most uses of programmatic form
submissions; however, there are cases where custom or contributed code may
need to send data provided by the current (untrusted) user to
drupal_form_submit() and therefore need to respect access control on the
form.
To facilitate this, a new, optional
$form_state['programmed_bypass_access_check'] element has been added to the
Drupal 7 form API. If this is provided and set to FALSE, drupal_form_submit()
will perform the normal form access checks against the current user while
submitting the form, rather than bypassing them.
This change does not fix a security issue in Drupal core itself, but rather
provides a method for custom or contributed code to fix security issues that
would be difficult or impossible to fix otherwise.
- -------- CVE IDENTIFIER(S) ISSUED --------------------------------------------
* /A CVE identifier [3] will be requested, and added upon issuance, in
accordance with Drupal Security Team processes./
- -------- VERSIONS AFFECTED ---------------------------------------------------
* Drupal core 6.x versions prior to 6.30.
* Drupal core 7.x versions prior to 7.26.
- -------- SOLUTION ------------------------------------------------------------
Install the latest version:
* If you use Drupal 6.x, upgrade to Drupal core 6.30 [4].
* If you use Drupal 7.x, upgrade to Drupal core 7.26 [5].
Also see the Drupal core [6] project page.
- -------- REPORTED BY ---------------------------------------------------------
* The OpenID module impersonation issue was reported by Christian Mainka
[7]
and Vladislav Mladenov.
* The Taxonomy module access bypass issue was reported by Matt Vance [8],
and by Damien Tournoud [9] of the Drupal Security Team.
* The form API access bypass issue was reported by David Rothstein [10] of
the Drupal Security Team.
- -------- FIXED BY ------------------------------------------------------------
* The OpenID module impersonation issue was fixed by Damien Tournoud [11],
Heine Deelstra [12], Peter Wolanin [13], and David Rothstein [14], all of
the Drupal Security Team.
* The Taxonomy module access bypass issue was fixed by Jibran Ijaz [15],
and
by Lee Rowlands [16] of the Drupal Security Team.
* The form API access bypass issue was fixed by Damien Tournoud [17] and
David Rothstein [18] of the Drupal Security Team, and by Marc Ingram [19]
and Kyle Browning [20].
- -------- COORDINATED BY ------------------------------------------------------
* The Drupal Security Team [21]
- -------- CONTACT AND MORE INFORMATION ----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [22].
Learn more about the Drupal Security team and their policies [23], writing
secure code for Drupal [24], and securing your site [25].
Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [26]
[1] http://drupal.org/project/drupal
[2] http://drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] http://drupal.org/drupal-6.30-release-notes
[5] http://drupal.org/drupal-7.26-release-notes
[6] http://drupal.org/project/drupal
[7] https://drupal.org/user/1096424
[8] https://drupal.org/user/88338
[9] https://drupal.org/user/22211
[10] https://drupal.org/user/124982
[11] https://drupal.org/user/22211
[12] https://drupal.org/user/17943
[13] https://drupal.org/user/49851
[14] https://drupal.org/user/124982
[15] https://drupal.org/user/1198144
[16] https://drupal.org/user/395439
[17] https://drupal.org/user/22211
[18] https://drupal.org/user/124982
[19] https://drupal.org/user/77320
[20] https://drupal.org/user/211387
[21] http://drupal.org/security-team
[22] http://drupal.org/contact
[23] http://drupal.org/security-team
[24] http://drupal.org/writing-secure-code
[25] http://drupal.org/security/secure-configuration
[26] https://twitter.com/drupalsecurity
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUt3eQxLndAQH1ShLAQLrYhAAskWqutoP4QhZgGtGqg4KhIsGMX7JKikH
aPC+YdYpGFKg+GGiC58bVjJMByItjLQLHcphFjayA5GLx7JtVOhBR+TVndheYM/r
FeEsrvUn19YAAXJlA2r4TsVteq4KbkXWv7aZGoa7VIqU2p3LgQ5vtb87VQe7hQFb
AX78f9D19tIbu48UDAsMsbPwBA7sFfNul2mL0GqXM813sGIVJqG17Ma3JvNZLOeh
wU/xrRpfMuVoe9N6coEmxtPE4tWM6izZF0Nw/UK8v3hOwnXYgHsBpXqgRLVkTlsN
7LUkS/ypd8VCwRb4/ZygYSeBYgXVDFitq5430aXCFywybaIKg2ewLbSWfxV1ZyxL
x2KoG9pL/nwTv+JsNBf8En18HWPojgR0its5pc7iwtlz7xR7LnToGdmiqICXEXS+
oUIEh3DAg7/Xd09N+lUYYQgRivRo2GRF6UWNHTCluums2oZsShbP0CbiVnlGjCv2
IY+mzChlY3Vr9k3PRJHCpKdRyh9c1uxIlWzKpgwBL53nGSML5ZtCwqRe2i90RwvE
ziElM83C/5Ikz7b9sXvGucmLXiVB3d0kxrHI23VRQ9VC/+Ibt0vVitCSRrsP0y7J
NFrf+FSRGA5MJxnc5+jJqKThKCpr0eWc1OhzfXvX/9pYqBo7QZFZgXxSs2zRrroI
Rh5+ZPQxVOg=
=I0zF
-----END PGP SIGNATURE-----