Drupal Quick Tabs 6.x / 7.x Access Bypass

  1. Drupal Quick Tabs third party module versions 6.x and 7.x suffer from an access bypass vulnerability.
  2. View online: https://drupal.org/node/2103187
  3. * Advisory ID: DRUPAL-SA-CONTRIB-2013-078
  4. * Project: Quick Tabs [1] (third-party module)
  5. * Version: 6.x, 7.x
  6. * Date: 2013-October-02
  7. * Security risk: Moderately critical [2]
  8. * Exploitable from: Remote
  9. * Vulnerability: Access bypass
  10. ——– DESCRIPTION
  11. ———————————————————
  12. The Quick Tabs module allows you to create blocks of tabbed content,
  13. specifically views, blocks, nodes and other quicktabs. You can create a block
  14. on your site containing multiple tabs with corresponding content.
  15. The module does not sufficiently check block permissions before rendering a
  16. Quick Tab. Before this vulnerability was addressed, if a block had been
  17. restricted to only appear for certain roles, that access was not checked
  18. before rending it within a Quick Tab – leaving the contents of that block
  19. visible to the world.
  20. This vulnerability is mitigated by the fact that node and view permissions
  21. are respected, meaning the vulnerability primarily exists for custom blocks
  22. created for specific roles.
  23. ——– CVE IDENTIFIER(S) ISSUED
  24. ——————————————–
  25. * /A CVE identifier [3] will be requested, and added upon issuance, in
  26. accordance with Drupal Security Team processes./
  27. ——– VERSIONS AFFECTED
  28. —————————————————
  29. * Quick Tabs 7.x-3.x versions prior to 7.x-3.6.
  30. * Quick Tabs 6.x-3.x versions prior to 6.x-3.2.
  31. * Quick Tabs 6.x-2.x versions prior to 6.x-2.2.
  32. Drupal core is not affected. If you do not use the contributed Quick Tabs [4]
  33. module, there is nothing you need to do.
  34. ——– SOLUTION
  35. ————————————————————
  36. Install the latest version:
  37. * If you use the Quick Tabs 3.x module for Drupal 7.x, upgrade to Quick Tabs
  38. 7.x-3.6 [5]
  39. * If you use the Quick Tabs 3.x module for Drupal 6.x, upgrade to Quick Tabs
  40. 6.x-3.2 [6]
  41. * If you use the Quick Tabs 2.x module for Drupal 6.x, upgrade to Quick Tabs
  42. 6.x-2.2 [7]
  43. Also see the Quick Tabs [8] project page.
  44. ——– REPORTED BY
  45. ———————————————————
  46. * Steven Wiliam [9]
  47. ——– FIXED BY
  48. ————————————————————
  49. * Fengtan [10]
  50. * Matt Tucker [11] (one of) the module maintainers
  51. ——– COORDINATED BY
  52. ——————————————————
  53. * Lee Rowlands [12] of the Drupal Security Team
  54. ——– CONTACT AND MORE INFORMATION
  55. —————————————-
  56. The Drupal security team can be reached at security at drupal.org or via the
  57. contact form at http://drupal.org/contact [13].
  58. Learn more about the Drupal Security team and their policies [14], writing
  59. secure code for Drupal [15], and securing your site [16].
  60. [1] http://drupal.org/project/quicktabs
  61. [2] http://drupal.org/security-team/risk-levels
  62. [3] http://cve.mitre.org/
  63. [4] http://drupal.org/project/quicktabs
  64. [5] https://drupal.org/node/2103113
  65. [6] https://drupal.org/node/2103121
  66. [7] https://drupal.org/node/2103127
  67. [8] http://drupal.org/project/quicktabs
  68. [9] http://drupal.org/user/299097
  69. [10] http://drupal.org/user/847318
  70. [11] http://drupal.org/user/153963
  71. [12] http://drupal.org/user/395439
  72. [13] http://drupal.org/contact
  73. [14] http://drupal.org/security-team
  74. [15] http://drupal.org/writing-secure-code
  75. [16] http://drupal.org/security/secure-configuration

评论关闭。