CVE-2014-9362

Cross-site scripting (XSS) vulnerability in the path-based meta tag editing form in the Meta tags quick module 7.x-2.x before 7.x-2.8 for Drupal allows remote authenticated users with the “Edit path based meta tags” permission to inject arbitrary web script or HTML via vectors related to deleting a Path-based Metatag.

CVE-2014-9363

Open redirect vulnerability in the path-based meta tag editing form in the Meta tags quick module 7.x-2.x before 7.x-2.8 for Drupal allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter.

CVE-2014-9364

Cross-site scripting (XSS) vulnerability in the Unified Login form in the LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

SA-CONTRIB-2014-125 – Organic Groups Menu – Access bypass

Description

This module enables you to associate menus with Organic Groups (OG). It allows you to create one or more menus per group, configure and apply menu permissions in a group context, add/edit menu links directly from the entity form, etc.

The module doesn’t sufficiently check the menu parameters passed in the path, creating an access bypass vulnerability allowing an attacker to edit or delete any menu link on the site. There is also an information disclosure vulnerability of menu info.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer og menu”.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • Organic Groups Menu (OG Menu) 6.x-2.x versions prior to 6.x-2.5.
  • Organic Groups Menu (OG Menu) 7.x-2.x versions prior to 7.x-2.3.
  • Organic Groups Menu (OG Menu) 7.x-3.x versions prior to 7.x-3.0

Drupal core is not affected. If you do not use the contributed OG Menu module,
there is nothing you need to do.

Solution

Install the latest version:

  • If you use the OG Menu module for Drupal 6.x, upgrade to OG Menu 6.x-2.5
  • If you use the OG Menu module for Drupal 7.x and the OG module 7.x-1.x, upgrade to OG Menu 7.x-2.3
  • If you use the OG Menu module for Drupal 7.x, and the OG module 7.x-2.x upgrade to OG Menu 7.x-3.0

Also see the OG Menu project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

SA-CONTRIB-2014-124 – Poll Chart – Cross Site Scripting (XSS)

Description

This module enables users to have a block displaying the result of the last poll as a chart.

The module doesn’t sufficiently sanitize poll node titles when displaying the block.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create polls and the poll chart block must be enabled.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • poll_chart 7.x-1.x versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed Poll Chart Block module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Poll Chart Block project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

CVE-2014-7866

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. (dot dot) in the (1) fileName parameter to the MigrateLEEData servlet or (2) zipFileName parameter in a downloadFileFromProbe operation to the MigrateCentralData servlet.

When it comes to dangers on the internet, we are our own worst enemies

Today’s biggest threat to the normal consumer is the consumer themselves.

This bold statement was made by Avast CEO Vincent Steckler in an interview with German technology website Valuetech in Munich last week. That’s a daring position to take after this year’s revelations about NSA spying, the theft of tens of millions of customer passwords from major retailers like Target and Home Depot, the recent Sony Pictures hack, and the normal parade of Trojan horses, worms and viruses, but it’s one that Steckler stands behind.

Watch the interview here (04:00),

Mr. Steckler has good reason for his conclusion. Here’s a few of the main points he made during the interview.

Social engineering preys on human weakness

“A lot of attacks are still using social engineering techniques; phishing emails – ways of convincing the user to give up valuable information,” said Steckler.

An example of phishing emails just occurred after Black Friday, when cybercrooks sent millions of fake purchase confirmation emails to customers of major retailers. You can read about that, as well as what to do if you are a victim,  in our blog, Fake confirmation emails from Walmart, Home Depot, others in circulation.

The Mac misconception

Mac users are well-known for proudly touting that they don’t use antivirus protection because they never have a problem with viruses. But, it’s really a numbers game.

“There is no fundamental difference,” Steckler says of the security of PCs and Macs. “Mac is not inherently any safer, as a technology, than Windows is. What makes a difference there is what is more opportune for a bad guy to attack.”

He explains that malware written for Windows can attack up to 93% of the world’s PCs. Mac malware only reaches 7-8% of the world’s PCs. The safety then lies in the lower numbers of Mac devices rather than a technical safety advantage.

Households networks are as complicated as small business networks

With the interconnectivity of household devices from household computers, mobile phones, TVs and even refrigerators, Steckler compares the typical household network to that of a small business.

“The central weakness in this ‘Internet of Things’ will be that home router – the thing that connects everything together,” says Steckler, “and basically doesn’t have any security on it.”

Avast 2015 seeks to address this lack in security by including the new Home Network Security scanner.

SA-CONTRIB-2014-123 – Postal Code – Cross Site Scripting (XSS)

Description

The Postal Code module enables you to implement postal code validation for several countries.

The module doesn’t sufficiently sanitize certain data in the admin thereby opening a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with a permission that allows adding or editing fields to entity types such as “administer taxonomy terms” or “administer content types”.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • Postal Code 7.x-1.x versions prior to 7.x-1.9.

Drupal core is not affected. If you do not use the contributed Postal Code module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Postal Code project page.

Reported by

  • Matt Vance (provisional member of the Drupal Security Team)

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: