Bug 1050802 - (CVE-2014-1398, CVE-2014-1399, CVE-2014-1400) CVE-2014-1398 CVE-2014-1399 CVE-2014-1400 drupal7-entity: multiple access bypass vulnerabilities
CVE-2014-1398 CVE-2014-1399 CVE-2014-1400 drupal7-entity: multiple access byp...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20140108,repor...
: Security
Depends On: 1050803 1050804
Blocks:
  Show dependency treegraph
 
Reported: 2014-01-09 01:14 EST by Ratul Gupta
Modified: 2014-11-24 11:04 EST (History)
5 users (show)

See Also:
Fixed In Version: drupal7-entity-1.3
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-11-24 11:00:02 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Ratul Gupta 2014-01-09 01:14:05 EST
The entity module for Drupal was recently reported to be affected by multiple access bypass vulnerabilites, which could be exploited by an attacker to gain unauthorized access to the data.

1) Comment, User and Node Statistics property access bypass

The module's entity wrapper access API doesn't sufficiently protect comment, user and node statistics properties from unprivileged user access.
This vulnerability is mitigated by the fact that a module must be enabled that relies on the Entity property access API and it must be configured to expose either comment, user or node statistics properties. One example would be the RESTful Web Services module (RESTWS) with the permission configured to access the comment, user or node resource for untrusted web service consumers.

2) Entity list property access bypass

The module's entity wrapper access API doesn't sufficiently check entity access on referenced entities such as taxonomy terms.
This vulnerability is mitigated by the fact that a module must be enabled that uses the access() method of entity metadata wrappers to determine access to a property which references multiple entities to which access is not granted. One example would be the RESTful Web Services module (RESTWS) with respectively configured permissions on an entity property or (entity reference) field, for example a list of (unaccessible) referenced user entities on a node entity.

3) Unpublished comments access bypass

The module's entity_access() API doesn't protect unpublished comments from being viewed by unprivileged users.
This vulnerability is mitigated by the fact a module must be enabled which uses the provided entity access API on comments and the comment module must be enabled.

The issues are said to be fixed in drupal7-entity-1.3.

References:
https://drupal.org/node/2169595
http://packetstormsecurity.com/files/124728/DRUPAL-SA-CONTRIB-2014-001.txt
Comment 1 Ratul Gupta 2014-01-09 01:15:00 EST
Created drupal7-entity tracking bugs for this issue:

Affects: fedora-all [bug 1050803]
Affects: epel-all [bug 1050804]
Comment 2 Ratul Gupta 2014-01-09 03:39:33 EST
CVE Request:
http://seclists.org/oss-sec/2014/q1/55
Comment 3 Fedora Update System 2014-01-18 23:05:21 EST
drupal7-entity-1.3-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2014-01-18 23:06:47 EST
drupal7-entity-1.3-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2014-01-27 04:23:53 EST
drupal7-entity-1.3-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2014-01-27 04:24:33 EST
drupal7-entity-1.3-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Peter Borsa 2014-03-09 06:03:58 EDT
All entity packages are in stable repositories. Can we close this issue?
Comment 9 Shawn Iwinski 2014-11-22 11:30:35 EST
All entity packages are in stable repositories. Can we close this bug?

Note You need to log in before you can comment on or make changes to this bug.