Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.0920
Drupal module vulnerabilities
21 March 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Drupal modules
Publisher: Drupal
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
Reference: ESB-2019.0541
Original Bulletin:
https://www.drupal.org/sa-contrib-2019-039
https://www.drupal.org/sa-contrib-2019-040
https://www.drupal.org/sa-contrib-2019-041
Comment: This bulletin contains three (3) Drupal security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
Project: AddToAny Share Buttons [1]
Date:Â 2019-March-20
Security risk:Â *Moderately critical* 13/25
AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability:Â Cross Site Scripting
Description:Â
This module enables you to add social media share buttons on your website to
its content and pages.
The module doesn't sufficiently mark its administration permission
restricted, allowing cross site scripting vulnerabilities to users who have
access to its admin settings.
This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "administer addtoany".
Solution:
* If you use the AddToAny Share Buttons module for Drupal 7.x, upgrade to
AddToAny Share Buttons 7.x-4.16 [3]
Reported By:
* Balazs Janos Tatar [4]
Fixed By:
* Balazs Janos Tatar [5]
* micropat [6]
Coordinated By:
* Balazs Janos Tatar [7]
[1] https://www.drupal.org/project/addtoany
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/addtoany/releases/7.x-4.16
[4] https://www.drupal.org/user/649590
[5] https://www.drupal.org/user/649590
[6] https://www.drupal.org/user/260224
[7] https://www.drupal.org/user/649590
===============================================================================
Project:Â Back To Top [1]
Date:Â 2019-March-20
Security risk:Â *Moderately critical* 13/25
AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability:Â Cross Site Scripting
Description:Â
This module enables you to add a button that hovers in the bottom of your
screen and allows users to smoothly scroll up the page using jQuery.
The module doesn't sufficiently sanitize the code that gets printed on pages
leading to a Cross Site Scripting (XSS) issue.
This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "access backtotop settings".
Solution:
Install the latest version:
* If you use the Back To Top module for Drupal 7.x, upgrade to Back To Top
7.x-1.6 [3]
Reported By:Â
* Balazs Janos Tatar [4]
Fixed By:
* Mattias Axelsson [5]
* Balazs Janos Tatar [6]
Coordinated By:
* Balazs Janos Tatar [7]
[1] https://www.drupal.org/project/back_to_top
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/back_to_top/releases/7.x-1.6
[4] https://www.drupal.org/user/649590
[5] https://www.drupal.org/user/765764
[6] https://www.drupal.org/user/649590
[7] https://www.drupal.org/user/649590
===============================================================================
Project:Â RESTful [1]
Date:Â 2019-March-20
Security risk:Â *Critical* 18/25
AC:Complex/A:User/CI:All/II:All/E:Exploit/TD:Uncommon [2]
Vulnerability:Â Remote code execution
Description:
This resolves issues described in SA-CORE-2019-003 [3] for this module.
Solution:
* If you use the RESTful module for Drupal 7.x, upgrade to RESTful 7.x-1.10
[4] or RESTful 7.x-2.17 [5]
[1] https://www.drupal.org/project/restful
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/sa-core-2019-003
[4] https://www.drupal.org/project/restful/releases/7.x-1.10
[5] https://www.drupal.org/project/restful/releases/7.x-2.17
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXJMHSGaOgq3Tt24GAQjXLg//T3agNZFpGwobZmOqqQroqYI+hBK0OJPA
SkdUP3D1Y8YHY2Nz48vVazx1LpONNeeaaeeID8oLADAcmUtlWEcf4ol762UrlgLh
d5pXqzXOzlQ96buaDxGT8fLe83aNXddP5UcHLTxqNto+nRfo2EbzNeoCmwuTetHA
rYmLRE+t6udOC3tAgf7dGBfieK5Ra0q7163KveodOqh+Xxdx353IJXJqIJQ8Zd6h
bqJwLBegD7Dy6KygnDpWWExCinZzvJnFlaZj3qBJO7+H3vCszGYZyRbPp19nvrC3
duhIKNHhyeQ5cbIoJUxokLXRKbbQacoZJNuw0dg7y0sRTAbGCQLzZjyVn14PDlJn
Uyc5QPLf4K1nu28mMl5gHcEG07sOsfqb0GrpxIwXaZrMbsmiho9cdCPszIEDyfZy
UUITRoH8WgIAwbY2URyz02r2S7O3+p38LV8wnvmsznyKGV0Jh3bw7MKotlewJ1MC
drAxfFXBf/XsFWgFeshSZDPVe8Fpq6DYRQK8YxtcDZcX542As0T0OBYow7U9l4yH
LOUgjJdEU534267IfoD3obpVYrlbUVPV34GiUDmjt4Fk+3uOCRHjHI++8XKm4bB2
Toj4OQcQhLTffzb8UeocnuUHXTcy6AHmHdBH6XoXONW11zAzaUS53N8hunqQXwgo
rQm6VPPuK5Q=
=1wev
-----END PGP SIGNATURE-----