Bourne Again Shell (Bash) Remote Code Execution Vulnerability

Original release date: September 24, 2014

US-CERT is aware of a Bash vulnerability affecting Unix-based operating systems such as Linux and Mac OS X. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code on an affected system.
 
US-CERT recommends users and administrators review the Redhat Security Blog for additional details and to refer to their respective Linux or Unix-based OS vendor(s) for an appropriate patch. A GNU Bash patch is also available for experienced users and administrators to implement.

Operating systems with updates include:


This product is provided subject to this Notification and this Privacy & Use policy.

[ MDVSA-2014:186 ] bash

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:186
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : bash
 Date    : September 24, 2014
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 A flaw was found in the way Bash evaluated certain specially crafted
 environment variables. An attacker could use this flaw to override or
 bypass environment restrictions to execute shell commands. Certain
 services and applications allow remote unauthenticated attackers to
 provide environment variables, allowing them to exploit this issue
 (CVE-2014-6271).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271
 https://rhn.redhat.co

Mozilla Network Security Services (NSS) Library Vulnerability

Original release date: September 24, 2014

A vulnerability in the Mozilla NSS library could allow an attacker to forge an RSA signature, such as an SSL certificate. The package is often included in 3rd party software, including Linux distributions, Google Chrome, and others. It is possible that other cryptographic libraries may be similarly affected.

US-CERT recommends users and administrators review Vulnerability Note VU#772676, Mozilla Foundation Security Advisory 2014-73, and Google Stable Channel Update Blog for additional information and mitigation details.


This product is provided subject to this Notification and this Privacy & Use policy.

As Bug Bounties Become the Norm, Challenges Remain

SEATTLE–For many years, Microsoft and other large software vendors resisted the idea of providing bug bounties or other financial incentives for researchers to report vulnerabilities. That changed when the landscape began to shift and more researchers began reporting vulnerabilities through brokers or selling them on the open market. While bounties have now become commonplace, simply […]

SA-CONTRIB-2014-095 – Safeword – Cross Site Scripting (XSS)

Description

The safeword module provides an automatically generated ‘Machine Name’ when text is entered into a human-readable field.

The module doesn’t sufficiently sanitize the field description that can be used as help text under the machine name editing field.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer taxonomy”.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • Safeword 7.x-1.x versions prior to 7.x-1.9.

Drupal core is not affected. If you do not use the contributed Safeword module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Safeword project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

SA-CONTRIB-2014-093 – Twilio – Information Disclosure

Description

This module enables you to easily add SMS and VOIP functionality to your website by leveraging the Twilio cloud Voip and SMS service.

The module doesn’t expose its own permissions for administration including viewing and editing the Twilio authentication tokens. It relies only on “access administration pages” permission which is frequently granted to less-trusted users.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “access administration pages”.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • Twilio 7.x-1.x versions prior to 7.x-1.9.

Drupal core is not affected. If you do not use the contributed Twilio module,
there is nothing you need to do.

Solution

Install the latest version:

  • If you use the Twiliio module for Drupal 7.x, upgrade to Twilio 7.x-1.9

Also see the Twilio project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: 

SA-CONTRIB-2014-094 – Webform Patched – Cross Site Scripting (XSS)

Description

The Webform Patched module is a fork of the Webform module with Token support added. The module enables you to create forms which can be used for surveys, contact forms or other data collection throughout your site.

The module doesn’t sufficiently sanitize field label titles when two fields have the same form_key, which can only be managed by carefully crafting the webform structure via a specific set of circumstances.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “create webform content”.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • Webform Patched 6.x-3.x versions prior to 6.x-3.20.
  • Webform Patched 7.x-3.x versions prior to 7.x-3.20.

Drupal core is not affected. If you do not use the contributed Webform Patched module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Webform Patched project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: