Dynamic display block – Less Critical – Access bypass – Unsupported – SA-CONTRIB-2015-104

Description

This module enables you to showcase featured content at a prominent place on the front page of the site in an attractive way.

The module doesn’t sufficiently protect access to content a user has no access to. In certain scenarios a user with the “administer ddblock” permission can see titles of content for which this user has no access.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer ddblock” permission.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

All versions of Dynamic display block module.

Drupal core is not affected. If you do not use the contributed Dynamic display block module, there is nothing you need to do.

Solution

If you use the Dynamic display block module you should uninstall it.

Also see the Dynamic display block project page.

Reported by

Fixed by

Not applicable.

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

From Hacker to Security Force

Well – at least Kevin Mitnick decided to do so. In the early 90s Mitnick became the world’s most wanted hacker. He hacked into and stole corporate secrets of more than 40 major corporations. Some even suspected him of wire-tapping the FBI. No wonder he eventually ended up on the FBI’s most wanted list!

The fact that he managed to elude being captured for years just proves how careful, successful and good he was at what he was doing. It took another computer expert, namely Tsutomu Shimomura, to track him down in the end.

According to news.com.au Mitnickwas charged with wire fraud, interception of wire or electronic communications, possession of unauthorised access devices, unauthorised access to a federal computer and causing damage to a computer. After five years behind bars he was finally released from prison in 2000.

We already know what life currently looks like for Higinio Ochoa, another convicted hacker. Mitnick decided to use his skills for good and founded his own company, Mitnick Security. In addition to that he has written and published several books and is a public speaker.

To find out more about Mitnicks life as a hacker and his current activities, head over to news.com.au to read the whole article.

The post From Hacker to Security Force appeared first on Avira Blog.

An Insider’s Look at the History of Cybersecurity

Vinton Cerf, often known as one of the “Fathers of the Internet”, was featured in a talk presented by The City Arts and Lectures, held in San Francisco on April 29.

For those who don’t know, Cerf was the co-designer, with Robert Kahn, of the TCP/IP protocols that founded the essential architecture of the Internet. He worked on building what would become Internet protocols as a graduate student. He now has the role of Chief Internet Evangelist for Google.

Cerf was brilliant and charming.  The audience listened intently to his anecdotes and stories about what grew to become the Internet – and so much a part of our daily lives. His talk was supposed to be focused on the Internet of Things, but ended up being wide-ranging and provided a lot of food for thought.

As we celebrate nearly 26 years of the Internet, Cerf’s shared that early Internet security considerations were hampered because work on public key cryptography systems remained top secret.

As Cerf noted in a video interview here:

“I worked with the National Security Agency on the design of a secured version of the Internet but we used classified security technology at the time and I couldn’t share that with my colleagues… If I could start over again I would have introduced a lot more strong authentication and cryptography into the system.”

Specifically in terms of the Internet of Things, Cerf said, it has a great capacity to reduce waste and costs in our everyday lives, but he also noted it definitely has security issues.

Cerf also detailed the fine line between the accessibility of digital data and the right to privacy. This is something he has obviously considered for a long time.

He chose healthcare as one example, where a patient’s heartbeat and temperature can be digitized, and that it is a great tool for medical professionals, but as Cerf said it “wields both ways,” as a hacker or crook would love to know the state of your health or when you’re going to be in the hospital.

Hearing the talk made me wonder what better security and encryption would have meant from the get-go for the Internet. Theoretically, it could have saved us many of the cybersecurity issues we face today.

Interestingly, as a backdrop, Cerf’s talk came on the heels of news of the White House being hacked. The White House had a data breach where Russian hackers apparently gained access to its unclassified computer system. This was reported back in October, but lightly, and now new details are emerging.

The good news is this hack didn’t include classified emails and information. The bad news: The hackers reportedly first breached the State Department system –via a phishing scam –and from there gained access to the White House network. You can read more in The New York Times article.

As they say, hindsight is 20/20, and the Internet is all about moving forward.

We all know cybersecurity issues will only become more important with IoT. If we are to change the course of cybercrime, it will require great minds like Vint Cerf along with champions for cybersecurity in both the private and public sector, more vigilance by businesses and better educated consumers who proactively take responsibility for their own cyber security. We’re certainly committed to doing our part.

You can hear Vint Cerf’s Internet of Things interview broadcast on City Arts & Lectures on Public Radio in the U.S. on May 24.

Title image courtesy of The Guardian

Fedora EPEL 6 Security Update: t1utils-1.39-1.el6

Resolved Bugs
1218365 – t1utils: buffer overflow flaw
1218367 – t1utils: buffer overflow flaw [epel-all]<br
t1utils Version 1.39 (2015-02-26)
=================================
* t1disasm: Security fixes for buffer overrun reported by Jakub Wilk and Niels Thykier.
t1utils Version 1.38 (2013-09-29)
=================================
* t1disasm: Fix an infinite loop on some fonts reported by Niels Thykier.

Fedora EPEL 7 Security Update: t1utils-1.39-1.el7

Resolved Bugs
1218365 – t1utils: buffer overflow flaw
1218367 – t1utils: buffer overflow flaw [epel-all]<br
t1utils Version 1.39 (2015-02-26)
=================================
* t1disasm: Security fixes for buffer overrun reported by Jakub Wilk and Niels Thykier.
t1utils Version 1.38 (2013-09-29)
=================================
* t1disasm: Fix an infinite loop on some fonts reported by Niels Thykier.