full-disclosure - [Security-news] SA-CONTRIB-2012-118 - Secure Login

Open Source and information security mailing list archives

Date: Wed, 25 Jul 2012 20:16:19 +0000 (UTC)
From: security-news@...pal.org
To: security-news@...pal.org
Subject: [Security-news] SA-CONTRIB-2012-118 - Secure
	Login - Open Redirect

View online: http://drupal.org/node/1700594

  * Advisory ID: DRUPAL-SA-CONTRIB-2012-118
  * Project: Secure Login [1] (third-party module)
  * Version: 7.x
  * Date: 2012-July-25
  * Security risk: Less critical [2]
  * Exploitable from: Remote
  * Vulnerability: Open Redirect

-------- DESCRIPTION  
---------------------------------------------------------

Secure Login module enables the user login and other forms to be submitted
securely via HTTPS, thus preventing passwords and other private user data
from being transmitted in clear text. In addition, Secure Login module by
default redirects non-HTTPS GET requests for pages containing forms that it
secures to the HTTPS site.

The module does not sufficiently validate that a requested path is internal
to the site, allowing an attacker to disguise a malicious destination address
as a GET query parameter passed to a non-HTTPS site URL.

This vulnerability is mitigated by the fact that the target site must render
a form secured by Secure Login module on its 404 page, such as in a block. A
default installation of Drupal 7 renders the user login block on the 404
page, and is thus vulnerable to the open redirect.

CVE: Requested

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Secure Login 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed Secure Login
[3] module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use the Secure Login module for Drupal 7.x, upgrade to Secure Login
    7.x-1.3 [4].

Also see the Secure Login [5] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Albert Martin [6]

-------- FIXED BY  
------------------------------------------------------------

  * Mark Burdett [7], the module maintainer

-------- COORDINATED BY  
------------------------------------------------------

  * Heine Deelstra [8] of the Drupal Security Team
  * Greg Knaddison [9] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [10].

Learn more about the Drupal Security team and their policies [11], writing
secure code for Drupal [12], and securing your site [13].

[1] http://drupal.org/project/securelogin
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/project/securelogin
[4] https://drupal.org/node/1698988
[5] http://drupal.org/project/securelogin
[6] https://drupal.org/user/1888132
[7] https://drupal.org/user/12302
[8] http://drupal.org/user/17943
[9] http://drupal.org/user/36762
[10] http://drupal.org/contact
[11] http://drupal.org/security-team
[12] http://drupal.org/writing-secure-code
[13] http://drupal.org/security/secure-configuration

_______________________________________________
Security-news mailing list
Security-news@...pal.org
Unsubscribe at http://lists.drupal.org/mailman/listinfo/security-news

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives