[Secure-testing-team] Bug#658337: [drupal7] DRUPAL-SA-CORE-2012-001 - Security Update for Drupal 6+7

[Ingo Juergensmann]

Package: drupal7
Version: 7.10-1.1
Severity: critical
Tags: security
X-Debbugs-CC: secure-testing-team at lists.alioth.debian.org

--- Please enter the report below this line. ---

Hi!

There's a security update on drupal.org for Drupal6 and Drupal7 which 
fixes Access Bypass, Cross Site Request Forgery and multiple other 
vulnerabilities. Here's the Drupal Security Announcement:

==================
   * Advisory ID: DRUPAL-SA-CORE-2012-001
   * Project: Drupal core [1]
   * Version: 6.x, 7.x
   * Date: 2012-February-01
   * Security risk: Moderately critical [2]
   * Exploitable from: Remote
   * Vulnerability: Access bypass, Cross Site Request Forgery, Multiple
     vulnerabilities

-------- DESCRIPTION
---------------------------------------------------------

.... Cross Site Request Forgery vulnerability in Aggregator module

CVE: CVE-2012-0826
An XSRF vulnerability can force an aggregator feed to update. Since some
services are rate-limited (e.g. Twitter limits requests to 150 per hour) 
this
could lead to a denial of service.

This issue affects Drupal 6.x and 7.x.

.... OpenID not verifying signed attributes in SREG and AX

CVE: CVE-2012-0825
A group of security researchers identified a flaw in how some OpenID relying
parties implement Attribute Exchange (AX). Not verifying that attributes
being passed through AX have been signed could allow an attacker to modify
users' information.

This issue affects Drupal 6.x and 7.x.

.... Access bypass in File module

CVE: CVE-2012-0827
When using private files in combination with certain field access modules,
the File module will allow users to download the file even if they do not
have access to view the field it was attached to.

This issue affects Drupal 7.x only.

-------- VERSIONS AFFECTED
---------------------------------------------------

   * Drupal 6.x core prior to 6.23.
   * Drupal 7.x core prior to 7.11.

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

   * If you use Drupal 6.x upgrade to 6.23 [3]
   * If you use Drupal 7.x upgrade to 7.11 [4]

See also the Drupal core [5] project page.

-------- REPORTED BY
---------------------------------------------------------

   * The Aggregator module CSRF vulnerability was reported by Dylan Tack 
[6] of
     the Drupal Security Team.
   * The OpenID vulnerability was reported by Rui Wang, Shuo Chen and 
Xiao Feng
     Wang [7].
   * The File module access bypass issue was reported by David Rothstein 
[8] of
     the Drupal Security Team, and by Sascha Grossenbacher [9].

-------- FIXED BY
------------------------------------------------------------

   * Aggregator CSRF issue fixed by Dave Reid [10] of the Drupal 
Security Team
   * OpenID issue fixed by Vojtech Kusy [11] and Christian Schmidt [12]
   * The File module access bypass issue was fixed by David Rothstein 
[13] of
     the Drupal Security Team, Sascha Grossenbacher [14], and Derek 
Wright [15]
     of the Drupal Security Team.

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [16].

Learn more about the Drupal Security team and their policies [17], writing
secure code for Drupal [18], and securing your site [19].


[1] http://drupal.org/project/drupal
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/node/1425082
[4] http://drupal.org/node/1425092
[5] http://drupal.org/project/drupal
[6] http://drupal.org/user/96647
[7] http://openid.net/2011/05/05/attribute-exchange-security-alert/
[8] http://drupal.org/user/124982
[9] http://drupal.org/user/214652
[10] http://drupal.org/user/53892
[11] http://drupal.org/user/56154
[12] http://drupal.org/user/216078
[13] http://drupal.org/user/124982
[14] http://drupal.org/user/214652
[15] http://drupal.org/user/46549
[16] http://drupal.org/contact
[17] http://drupal.org/security-team
[18] http://drupal.org/writing-secure-code
[19] http://drupal.org/security/secure-configuration

==================

--- System information. ---
Architecture: amd64
Kernel:       Linux 3.1.0-1-amd64

Debian Release: wheezy/sid
   500 unstable        www.debian-multimedia.org
   500 unstable        ftp.de.debian.org

--- Package information. ---
Depends                    (Version) | Installed
====================================-+-============
debconf                    (>= 0.5)  | 1.5.41
  OR debconf-2.0                      |
apache2                              | 2.2.21-5
  OR httpd                            |
php5                                 | 5.3.9-6
php5-mysql                           | 5.3.9-6
  OR php5-pgsql                       | 5.3.9-6
php5-gd                              | 5.3.9-6
default-mta                          |
  OR mail-transport-agent             |
wwwconfig-common         (>= 0.0.37) | 0.2.2
mysql-client                         | 5.1.58-1
  OR virtual-mysql-client             |
  OR postgresql-client                | 9.1+128
dbconfig-common                      | 1.8.47+nmu1
curl                                 | 7.24.0-1


Recommends        (Version) | Installed
===========================-+-===========
mysql-server                |
  OR postgresql              | 9.1+128


Package's Suggests field is empty.




-- 
Ciao...            //      Fon: 0381-2744150
       Ingo       \X/       http://blog.windfluechter.net
Please don't share this address with Facebook or Google!
gpg pubkey: http://www.juergensmann.de/ij_public_key.asc