lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed,  5 Dec 2012 23:05:59 +0000 (UTC)
Subject: [Security-news] SA-CONTRIB-2012-173 - Nodewords:
	Information	disclosure

View online:

  * Advisory ID: DRUPAL-SA-CONTRIB-2012-173
  * Project: Nodewords: D6 Meta Tags [1] (third-party module)
  * Version: 6.x
  * Date: 2012-December-05
  * Security risk: Not critical [2]
  * Exploitable from: Remote
  * Vulnerability: Information Disclosure

-------- DESCRIPTION  

This module enables you to assign meta tags on Drupal 6 sites to aid with 3rd
party search indexing and sharing on social networks.

The module doesn't correctly filter node content when configured to
automatically generate descriptions meta tags from the node text. This lack
of filtering could allow some code, e.g. BBCode, to pass through unprocessed
and potentially display private or otherwise secret information, links, file
paths or other potentially sensitive details. The problem affects the normal
'description' meta tag along with the 'dc.description' and 'og:description'
meta tags, all of which used the same logic.

This vulnerability is mitigated by the fact that it is unlikely that
sensitive content would be within the extracted portion.


  * /A CVE identifier [3] will be requested, and added upon issuance, in
    accordance with Drupal Security Team processes./


  * Nodewords 6.x-1.x versions prior to 6.x-1.14.

Drupal core is not affected. If you do not use the contributed Nodewords: D6
Meta Tags [4] module, there is nothing you need to do.

-------- SOLUTION  

Install the latest version:

  * If you use the Nodewords module for Drupal 6.x, upgrade to Nodewords
    6.x-1.14 [5].

Also see the Nodewords: D6 Meta Tags [6] project page.

-------- REPORTED BY  

  * Andrey Tretyakov [7]
  * asb [8]

-------- FIXED BY  

  * Damien McKenna [9] the module maintainer.


  * Chris Hales [10] of the Drupal Security Team
  * Greg Knaddison [11] of the Drupal Security Team


The Drupal security team can be reached at security at or via the
contact form at [12].

Learn more about the Drupal Security team and their policies [13], writing
secure code for Drupal [14], and securing your site [15].


Security-news mailing list
Unsubscribe at

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists