full-disclosure - [Security-news] SA-CONTRIB-2012-065 - Sitedoc

Open Source and information security mailing list archives

Date: Wed, 25 Apr 2012 19:54:11 +0000 (UTC)
From: security-news@...pal.org
To: security-news@...pal.org
Subject: [Security-news] SA-CONTRIB-2012-065 - Sitedoc -
	Information	disclosure

View online: http://drupal.org/node/1547686

  * Advisory ID: DRUPAL-SA-CONTRIB-2012-065
  * Project: Site Documentation [1] (third-party module)
  * Version: 6.x
  * Date: 2012-April-25
  * Security risk: Moderately critical [2]
  * Exploitable from: Remote
  * Vulnerability: Information Disclosure

-------- DESCRIPTION  
---------------------------------------------------------

This module enables you to display a plethora of information about your
site's structure. Optionally, the information may be saved into a file for
later comparison.

The module doesn't sufficiently verify that the saved file is protected by
the Private File System.

This vulnerability is mitigated by the fact that the administrator must have
configured the module to save the HTML report file to disk.

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Sitedoc 6.x-1.x versions prior to 6.x-1.4.

Drupal core is not affected. If you do not use the contributed Site
Documentation [3] module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use the Sitedoc module for Drupal 6.x, upgrade to Sitedoc 6.x-1.4
    [4], and
  * Enable the private file system if you want to save the output file.

Also see the Site Documentation [5] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * Jakub Suchý [6] of the Drupal Security Team

-------- FIXED BY  
------------------------------------------------------------

  * Nancy Wichmann [7], the module maintainer

-------- COORDINATED BY  
------------------------------------------------------

  * Forest Monsen [8] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [9].

Learn more about the Drupal Security team and their policies [10], writing
secure code for Drupal [11], and securing your site [12].

[1] http://drupal.org/project/sitedoc
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/project/sitedoc
[4] http://drupal.org/node/1546224
[5] http://drupal.org/project/sitedoc
[6] http://drupal.org/user/31977
[7] http://drupal.org/user/101412
[8] http://drupal.org/user/181798
[9] http://drupal.org/contact
[10] http://drupal.org/security-team
[11] http://drupal.org/writing-secure-code
[12] http://drupal.org/security/secure-configuration

_______________________________________________
Security-news mailing list
Security-news@...pal.org
http://lists.drupal.org/mailman/listinfo/security-news
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives