[IT-SecurityNotifies] [Security-news] SA-CONTRIB-2010-020 - Facebook-style Statuses (Microblog) - Access bypass

[security-news AT drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2010-020
  * Project: Facebook-style Statuses (Microblog) (third-party module)
  * Version: 6.x-2.x
  * Date: 2010-February-24
  * Security risk: Not Critical
  * Exploitable from: Remote
  * Vulnerability: Access bypass

-------- DESCRIPTION  
---------------------------------------------------------

The Facebook-style Statuses (Microblog) module enables each user to have a
stream of messages ("statuses") like on Facebook. Users can update their own
status as well as write messages to other users by visiting the other user's
profile. When a user updates his own status and then updates it again within
the next 10 seconds, the module assumes that the first was a mistake, and
overwrites the older status with the newer one. However, a bug allowed one
user's message to overwrite a second user's status if posted within 10
seconds of the second user having updated her status.
-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Facebook-style Statuses (Microblog) 6.x-2.x prior to 6.x-2.1

Drupal core is not affected. If you do not use the contributed Facebook-style
Statuses (Microblog) module, there is nothing you need to do.
-------- SOLUTION  
------------------------------------------------------------

Install the latest version:
  * If you use Facebook-style Statuses (Microblog) for Drupal 6.x upgrade to
    Facebook-style Statuses (Microblog) 6.x-2.1 [1]

See also the Facebook-style Statuses (Microblog) project page [2].
-------- REPORTED BY  
---------------------------------------------------------

  * Hiroaki [3]

-------- FIXED BY  
------------------------------------------------------------

  * Isaac Sukin (IceCreamYou [4]), the module maintainer.

-------- CONTACT  
-------------------------------------------------------------

The security contact for Drupal can be reached at security at drupal.org or
via the form at http://drupal.org/contact.

[1] http://drupal.org/node/724806
[2] http://drupal.org/project/facebook_status
[3] http://drupal.org/user/709086
[4] http://drupal.org/user/201425

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
http://lists.drupal.org/mailman/listinfo/security-news