Bug 1096604 (CVE-2014-3453)

Summary: CVE-2014-3453 drupal6-flag: code execution flaw in flag importer
Product: [Other] Security Response Reporter: Murray McAllister <mmcallis>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: ccoleman, dmcphers, jialiu, jrusnack, kseifried, lmeyer, mmcallis, mmcgrath, peter.borsa, shawn
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-02-12 17:46:13 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1096607    
Bug Blocks:    

Description Murray McAllister 2014-05-12 06:41:41 UTC
The following flaw was reported to the Full Disclosure mailing list[1]:


Description of Vulnerability:
- -----------------------------
The Flag 7.x-3.5 module contains an improper input handling (IH)
vulnerability created by it's failure to validate user
supplied PHP code, input via it's "flag importer" form, before using
PHP's "eval" function to execute the code on the server.
Using the flag importer form, a malicious user is able to execute
arbitrary code with the permissions of the server on the host machine.

Systems Impacted:
- ----------------
Drupal 7.26 with Flag 7.x-3.0 and Flag 7.x-3.5 (current recommended
release) were tested and found to be vulnerable

- -------
Users with the permission to use the flag importer can inject and
execute arbitrary code on the host server with server permissions.
This vulnerability can be exploited to upload a malicious payload onto
the vulnerable server, mount a Denial of Service (DoS) attack
or effect other server-side attacks.

Mitigating Factors:
- -------------------
This vulnerability is mitigated by the fact that a user must have
permission to use the flag importer. The Flag module
deactivates this permission by default for users other than site
administrators, and cautions adminsitrators against granting
this permission to other roles.


Vendor Response:
- ---------------------
The Drupal Security team was contacted on May 8, 2014 and responded
that because the permissions assignment page
carries the warning "Warning: Give to trusted roles only; this
permission has security implications." a coordinated
security fix and announcement is not warranted.


[1] http://seclists.org/fulldisclosure/2014/May/44

A patch is available from [1].

The patch applies to drupal6-flag-2.1-1.fc20 in Fedora 20, but I have not tested whether it is really affected or not.

drupal6-flag-1.3-3.fc19 in Fedora 19 does not appear to be affected (no affected file, missing the affected functions, etc)

Comment 1 Murray McAllister 2014-05-12 06:43:14 UTC
Created drupal6-flag tracking bugs for this issue:

Affects: fedora-20 [bug 1096607]

Comment 3 Murray McAllister 2014-05-12 07:56:39 UTC
MITRE assigned CVE-2014-3453 to this issue:


Comment 5 Fedora Update System 2015-01-14 07:26:15 UTC
drupal6-flag-2.1-3.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-01-14 07:30:37 UTC
drupal6-flag-2.1-3.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Shawn Iwinski 2015-02-09 13:34:31 UTC
All dependent bugs have been closed.  Can this bug be closed?