Category Archives: Security

Security

Drupal

SA-CONTRIB-2014-098 – CKEditor – Cross Site Scripting (XSS)

Description

The CKEditor module (and its predecessor, FCKeditor module) allows Drupal to replace textarea fields with CKEditor 3.x/4.x (FCKeditor 2.x in case of FCKeditor module) – a visual HTML editor, sometimes called WYSIWYG editor.

Both modules define a function, called via an ajax request, that filters text before passing it into the editor, to prevent certain cross site scripting attacks on content edits (that the JavaScript library might not handle). Because the function did not check a CSRF token for anonymous users, it was possible to perform reflected XSS against anonymous users via CSRF.

The problem existed in CKEditor/FCKeditor modules for Drupal, not in JavaScript libraries with the same names.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • CKEditor 7.x-1.x versions prior to 7.x-1.15.
  • CKEditor 6.x-1.x versions prior to 6.x-1.14.
  • FCKeditor 6.x-2.x versions prior to 6.x-2.3.

Drupal core is not affected. If you do not use the contributed CKEditor – WYSIWYG HTML editor module, there is nothing you need to do.

Solution

Install the latest version:

Also see the CKEditor – WYSIWYG HTML editor project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: 
Drupal 6.x
Drupal 7.x
Full Disclosure

SEC Consult SA-20141015-0 :: Potential Cross-Site Scripting in ADF Faces

Posted by SEC Consult Vulnerability Lab on Oct 15

SEC Consult Vulnerability Lab Security Advisory < 20141015-0 >
=======================================================================
title: Potential Cross-Site Scripting
product: ADF Faces
vulnerable version: 12.1.2.0
fixed version: versions with CPU Oct-2014 patch applied
impact: low
homepage: http://www.oracle.com/adf
found: 2014-05-01
by: W….

US-CERT

Mozilla Releases Security Updates for Firefox and Thunderbird

Original release date: October 15, 2014

The Mozilla Foundation has released security updates to address multiple vulnerabilities in Firefox and Thunderbird. Exploitation of these vulnerabilities may allow an attacker to obtain sensitive information, bypass same-origin policy and key pinning, cause an exploitable crash, conduct a man-in-the-middle attack, or execute arbitrary code.

The following updates are available:

  • Firefox 33
  • Firefox ESR 31.2
  • Thunderbird 31.2

Users and administrators are encouraged to review the Security Advisories for Firefox, Firefox ESR and Thunderbird to determine which updates should be applied to mitigate these risks.

 

This product is provided subject to this Notification and this Privacy & Use policy.

Security

Lynis Auditing Tool 1.6.3

Lynis is an auditing tool for Unix (specialists). It scans the system and available software to detect security issues. Beside security related information it will also scan for general system information, installed packages and configuration mistakes. This software aims in assisting automated auditing, software patch management, vulnerability and malware scanning of Unix based systems.