OneLogin confirmed this week an attacker took advantage of a bug in its system and was able to view sensitive notes, thought to be secure, posted by users.
Monthly Archives: August 2016
Flag – Moderately Critical – Access Bypass – SA-CONTRIB-2016-050
- Advisory ID: DRUPAL-SA-CONTRIB-2016-050
- Project: Flag (third-party module)
- Version: 7.x
- Date: 2016-August-31
- Security risk: 12/25 ( Moderately Critical) AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default
- Vulnerability: Information Disclosure
Description
Flag enables users to mark content with any number of admin-defined flags, such as ‘bookmarks’ or ‘spam’. Flag Bookmark is a submodule within Flag, which provides a ‘bookmarks’ flag, and default views to list bookmarked content.
The provided view that lists each user’s bookmarked content as a tab on their user profile has for its access control the permission to use the ‘bookmarks’ flag. This means that any user who has permission to use the ‘bookmarks’ flag can see the list of content that any user has bookmarked.
This vulnerability is mitigated by the fact that the site must have enabled the Flag Bookmark module to create this view, and an attacker must have a role with the permission “Flag node entities as bookmarks”.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
- Flag 7.x-3.x versions prior to 7.x-3.8.
Drupal core is not affected. If you do not use the contributed Flag module, there is nothing you need to do.
Solution
Install the latest version:
- If you use the Flag module for Drupal 7.x, upgrade to Flag 7.x-3.8
If you have Flag Bookmark enabled, or have enabled it in the past and still have the flag_bookmarks_tab view active, edit this and change the User: uid contextual filter’s as follows:
- set the validator to ‘Current user ID matches argument value’
- set the action to take if the filter value does not validate to ‘Show “Page not found”‘.
Also see the Flag project page.
Reported by
Fixed by
- Joachim Noreiko, the module maintainer
- Dave Long
Coordinated by
- Lee Rowlands of the Drupal Security Team
- Michael Hess of the Drupal Security Team
- Mori Sugimoto of the Drupal Security Team
- Rick Manelius of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Top 5 threats for online gamers and how to avoid them
This piece looks at the five threats online gamers face and what they can do to protect themselves. It’s important to be wary of these to stay safe and secure.
The post Top 5 threats for online gamers and how to avoid them appeared first on WeLiveSecurity.
CVE-2016-5674 (nvrmini_2, nvrsolo, readynas_surveillance)
__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.
CVE-2016-5675 (crystal, nvrmini_2, nvrsolo, readynas_surveillance)
handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.
CVE-2016-5676 (nvrmini_2, nvrsolo, readynas_surveillance)
cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action.
CVE-2016-5677 (nvrmini_2, nvrsolo, readynas_surveillance)
NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php request.
CVE-2016-5678 (nvrmini_2, nvrsolo)
NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative access via unspecified vectors.
CVE-2016-5679 (nvrmini_2, readynas_surveillance)
cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the sn parameter to the transfer_license command.
CVE-2016-5680 (nvrmini_2, readynas_surveillance)
Stack-based buffer overflow in cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary code via the sn parameter to the transfer_license command.