lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed,  4 Dec 2013 18:48:25 +0000 (UTC)
Subject: [Security-news] SA-CONTRIB-2013-097 - OG Features
	- Access bypass

View online:

   * Advisory ID: DRUPAL-SA-CONTRIB-2013-097
   * Project: OG Features [1] (third-party module)
   * Version: 6.x
   * Date: 2013-December-04
   * Security risk: Not Critical [2]
   * Exploitable from: Remote
   * Vulnerability: Access bypass


This module enables you to enable and disable bundles of functionality for
individual Organic groups [3]. In order to provide this functionality, this
module must override all menu callbacks available in the system, in order to
delegate access based on the current Organic group you are contextually in,
and the settings of the features for that group.

The module doesn't sufficiently override pages that have an access callback
explicitly set to FALSE, which indicates that no user (even admins) are able
to access the page. Since this module does not handle that condition
correctly, users will have access to those pages.

This vulnerability is mitigated by the fact that it's extremely rare that a
page in Drupal has it's access callback explicitly set to FALSE because that
would mean that no single user, including admins, would be able to access the


   * /A CVE identifier [4] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./


   * OG Features 6.x-1.x versions prior to 6.x-1.3.

Drupal core is not affected. If you do not use the contributed OG Features
[5] module, there is nothing you need to do.

-------- SOLUTION

Install the latest version:

   * If you use the OG Features module for Drupal 6.x, upgrade to OG Features
     6.x-1.4 [6]

Also see the OG Features [7] project page.

-------- REPORTED BY

   * Andrey Tretyakov [8]

-------- FIXED BY

   * Mike Stefanello [9] the module maintainer
   * Jess Straatmann [10]


   * Greg Knaddison [11] of the Drupal Security Team


The Drupal security team can be reached at security at or via the
contact form at [12].

Learn more about the Drupal Security team and their policies [13], writing
secure code for Drupal [14], and securing your site [15].


Security-news mailing list
Unsubscribe at

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists