Fedora alert FEDORA-2010-10127 (drupal-cck)
| From: | updates@fedoraproject.org | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 11 Update: drupal-cck-6.x.2.7-1.fc11 | |
| Date: | Mon, 21 Jun 2010 21:27:11 +0000 | |
| Message-ID: | <20100621212711.994DA110C09@bastion02.phx2.fedoraproject.org> | |
| Archive‑link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2010-10127 2010-06-21 21:01:15 -------------------------------------------------------------------------------- Name : drupal-cck Product : Fedora 11 Version : 6.x.2.7 Release : 1.fc11 URL : http://drupal.org/project/cck Summary : Allows you create and customize fields using a web browser Description : The Content Construction Kit allows you create and customize fields using a web browser. The 4.7x version of CCK creates custom content types and allows you to add custom fields to them. In Drupal 5.x custom content types can be created in core, and CCK allows you to add custom fields to any content type. -------------------------------------------------------------------------------- Update Information: * Advisory ID: DRUPAL-SA-CONTRIB-2010-065 (http://drupal.org/node/829566) * Project: Content Construction Kit (CCK) (third-party module) * Version: 5.x, 6.x * Date: 2010-June-16 * Security risk: Less Critical * Exploitable from: Remote * Vulnerability: Access Bypass -------- DESCRIPTION --------------------------------------------------------- The Content Construction Kit (CCK) project is a set of modules that allows you to add custom fields to nodes using a web browser. The CCK "Node Reference" module can be configured to display referenced nodes as hidden, title, teaser or full view. Node access was not checked when displaying these which could expose view access on controlled nodes to unprivileged users. In addition, Node Reference provides a backend URL that is used for asynchronous requests by the "autocomplete" widget to locate nodes the user can reference. This was not checking that the user had field level access to the source field, allowing direct queries to the backend URL to return node titles and IDs which the user would otherwise be unable to access. Note that as Drupal 5 CCK does not have any field access control functionality, this issue only applies to the Drupal 6 version. -------- VERSIONS AFFECTED --------------------------------------------------- * Content Construction Kit (CCK) module for Drupal 5.x versions prior to 5.x-1.11 * Content Construction Kit (CCK) module for Drupal 6.x versions prior to 6.x-2.7 Drupal core is not affected. If you do not use the contributed Content Construction Kit (CCK) [1] module, together with any node or field access module there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Content Construction Kit (CCK) module for Drupal 5.x upgrade to Content Construction Kit (CCK) 5.x-1.11 [2] * If you use the Content Construction Kit (CCK) module for Drupal 6.x upgrade to Content Construction Kit (CCK) 6.x-2.7 [3] See also the Content Construction Kit (CCK) project page [4]. -------- REPORTED BY --------------------------------------------------------- * recrit [5] * Marc Ferran (markus_petrux) [6], module co-maintainer -------- FIXED BY ------------------------------------------------------------ * Yves Chedemois (yched) [7], module co-maintainer * Marc Ferran (markus_petrux) [8], module co-maintainer * Karen Stevenson (KarenS) [9], module co- maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [10] can be reached at security at drupal.org or via the form at http://drupal.org/contact. * [1] http://drupal.org/project/cck * [2] http://drupal.org/node/828986 * [3] http://drupal.org/node/828988 * [4] http://drupal.org/project/cck * [5] http://drupal.org/user/452914 * [6] http://drupal.org/user/39593 * [7] http://drupal.org/user/39567 * [8] http://drupal.org/user/39593 * [9] http://drupal.org/user/45874 * [10] http://drupal.org/security-team -------------------------------------------------------------------------------- ChangeLog: * Fri Jun 18 2010 Jon Ciesla <limb@jcomserv.net> - 6.x.2.7-1 - New upstream, DRUPAL-SA-CONTRIB-2010-065. * Tue Dec 1 2009 Jon Ciesla <limb@jcomserv.net> - 6.x.2.6-1 - New upstream, BZ 541439. * Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 6.x.2.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update drupal-cck' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-...