|Summary:||CVE-2014-3453 drupal6-flag: code execution flaw in flag importer|
|Product:||[Other] Security Response||Reporter:||Murray McAllister <mmcallis>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED ERRATA||QA Contact:|
|Version:||unspecified||CC:||ccoleman, dmcphers, jialiu, jrusnack, kseifried, lmeyer, mmcallis, mmcgrath, peter, shawn|
|Fixed In Version:||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2015-02-12 17:46:13 UTC||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:||1096607|
Description Murray McAllister 2014-05-12 06:41:41 UTC
The following flaw was reported to the Full Disclosure mailing list: "" Description of Vulnerability: - ----------------------------- The Flag 7.x-3.5 module contains an improper input handling (IH) vulnerability created by it's failure to validate user supplied PHP code, input via it's "flag importer" form, before using PHP's "eval" function to execute the code on the server. Using the flag importer form, a malicious user is able to execute arbitrary code with the permissions of the server on the host machine. Systems Impacted: - ---------------- Drupal 7.26 with Flag 7.x-3.0 and Flag 7.x-3.5 (current recommended release) were tested and found to be vulnerable Impact: - ------- Users with the permission to use the flag importer can inject and execute arbitrary code on the host server with server permissions. This vulnerability can be exploited to upload a malicious payload onto the vulnerable server, mount a Denial of Service (DoS) attack or effect other server-side attacks. Mitigating Factors: - ------------------- This vulnerability is mitigated by the fact that a user must have permission to use the flag importer. The Flag module deactivates this permission by default for users other than site administrators, and cautions adminsitrators against granting this permission to other roles. ... Vendor Response: - --------------------- The Drupal Security team was contacted on May 8, 2014 and responded that because the permissions assignment page carries the warning "Warning: Give to trusted roles only; this permission has security implications." a coordinated security fix and announcement is not warranted. ""  http://seclists.org/fulldisclosure/2014/May/44 A patch is available from . The patch applies to drupal6-flag-2.1-1.fc20 in Fedora 20, but I have not tested whether it is really affected or not. drupal6-flag-1.3-3.fc19 in Fedora 19 does not appear to be affected (no affected file, missing the affected functions, etc)
Comment 1 Murray McAllister 2014-05-12 06:43:14 UTC
Created drupal6-flag tracking bugs for this issue: Affects: fedora-20 [bug 1096607]
Comment 3 Murray McAllister 2014-05-12 07:56:39 UTC
MITRE assigned CVE-2014-3453 to this issue: http://www.openwall.com/lists/oss-security/2014/05/12/2
Comment 5 Fedora Update System 2015-01-14 07:26:15 UTC
drupal6-flag-2.1-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2015-01-14 07:30:37 UTC
drupal6-flag-2.1-3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
Comment 7 Shawn Iwinski 2015-02-09 13:34:31 UTC
All dependent bugs have been closed. Can this bug be closed?