[IT-SecNots] [Security-news] SA-CONTRIB-2010-112 - oEmbed - Access Bypass

[security-news AT drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2010-112
  * Project: oEmbed (third-party module)
  * Version: 6.x
  * Date: 2010-December-22
  * Security risk: Moderately Critical
  * Exploitable from: Remote
  * Vulnerability: Access Bypass

-------- DESCRIPTION  
---------------------------------------------------------

The oEmbed module allows a Drupal site to embed content from oEmbed-providers
as well as for a site to become an oEmbed-provider itself so that other
oEmbed-enabled websites can embed its content.

If an external site requested to embed a node, the oEmbed provider did not
check node access, resulting in content not otherwise accessable by a user to
be embeddable.

This only affects sites that are using the oEmbed Provider sub-module.
-------- VERSIONS AFFECTED  
---------------------------------------------------

  * oEmbed module for Drupal 6.x versions prior to 6.x-0.8

Drupal core is not affected. If you do not use the contributed oEmbed [1]
module, together with its oEmbed provider module, there is nothing you need
to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use the oEmbed module for Drupal 6.x upgrade to oEmbed 6.x-0.8 [2].

See also the oEmbed project page [3].

-------- REPORTED BY  
---------------------------------------------------------

  * Benjamin Doherty [4]

-------- FIXED BY  
------------------------------------------------------------

  * Pelle Wessman [5], module co-maintainer

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
form at http://drupal.org/contact. Learn more about the team and their
policies [6], writing secure code for Drupal [7], and secure configuration
[8] of your site.

[1] http://drupal.org/project/oembed
[2] http://drupal.org/node/998376
[3] http://drupal.org/project/oembed
[4] http://drupal.org/user/100456
[5] http://drupal.org/user/341713
[6] http://drupal.org/security-team
[7] http://drupal.org/writing-secure-code
[8] http://drupal.org/security/secure-configuration

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
http://lists.drupal.org/mailman/listinfo/security-news