[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <52CE42B4.2090406@redhat.com>
Date: Thu, 09 Jan 2014 12:03:24 +0530
From: Ratul Gupta <ratulg@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request: drupal7-entity: multiple access bypass vulnerabilities
Hello,
The entity module for Drupal was recently reported to be affected by
multiple access bypass vulnerabilites, which could be exploited by an
attacker to gain unauthorized access to the data.
1) Comment, User and Node Statistics property access bypass
The module's entity wrapper access API doesn't sufficiently protect
comment, user and node statistics properties from unprivileged user access.
This vulnerability is mitigated by the fact that a module must be
enabled that relies on the Entity property access API and it must be
configured to expose either comment, user or node statistics properties.
One example would be the RESTful Web Services module (RESTWS) with the
permission configured to access the comment, user or node resource for
untrusted web service consumers.
2) Entity list property access bypass
The module's entity wrapper access API doesn't sufficiently check entity
access on referenced entities such as taxonomy terms.
This vulnerability is mitigated by the fact that a module must be
enabled that uses the access() method of entity metadata wrappers to
determine access to a property which references multiple entities to
which access is not granted. One example would be the RESTful Web
Services module (RESTWS) with respectively configured permissions on an
entity property or (entity reference) field, for example a list of
(unaccessible) referenced user entities on a node entity.
3) Unpublished comments access bypass
The module's entity_access() API doesn't protect unpublished comments
from being viewed by unprivileged users.
This vulnerability is mitigated by the fact a module must be enabled
which uses the provided entity access API on comments and the comment
module must be enabled.
The issues are said to be fixed in drupal7-entity-1.3.
References:
https://drupal.org/node/2169595
https://bugzilla.redhat.com/show_bug.cgi?id=1050802
Can CVE's please be assigned to these issues?
--
Regards,
Ratul Gupta / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
