what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Drupal Push Notifications 7.x Information Disclosure

Drupal Push Notifications 7.x Information Disclosure
Posted Feb 7, 2014
Authored by Graham Bates | Site drupal.org

Drupal Push Notifications third party module version 7.x suffers from an information disclosure vulnerability.

tags | advisory, info disclosure
SHA-256 | 2ecd72d5edcd2b99df0400d3fcc7d8ba3c4709c9dcc1256c885629033bd2dc41

Drupal Push Notifications 7.x Information Disclosure

Change Mirror Download
View online: https://drupal.org/node/2189643

* Advisory ID: DRUPAL-SA-CONTRIB-2014-011
* Project: Push Notifications [1] (third-party module)
* Version: 7.x
* Date: 2014-February-05
* Security risk: Less critical [2]
* Exploitable from: Remote
* Vulnerability: Information Disclosure

-------- DESCRIPTION
---------------------------------------------------------

This module enables the delivery of push notifications to iOS and Android
devices.

The module doesn't sufficiently randomize the certificate filenames required
for Apple's Push Notification service or protect the files from being
publicly accessible, which could allow an attacker to acquire the
certificates and broadcast push notifications to the target's user base.

This vulnerability primarily affects sites that did not follow the general
security best practice of placing certificates into a directory outside of
the webroot and did not use password-protected certificate files.


-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

* /A CVE identifier [3] will be requested, and added upon issuance, in
accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

* push_notifications 7.x-1.x versions prior to 7.x-1.1

Drupal core is not affected. If you do not use the contributed Push
Notifications [4] module, there is nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

* If you use the push_notifications module for Drupal 7.x and your APNS
certificate files are stored in the default directory, upgrade to
push_notifications 7.x-1.1 [5]
* Navigate to the configuration page for the push_notifications module
(admin/config/services/push_notifications/configure) and click the
"Generate new certificate string" button to generate a random filename.
Then, rename your APNS certificates according to the instructions on the
push notification configuration page.

Also see the Push Notifications [6] project page.

-------- REPORTED BY
---------------------------------------------------------

* Graham Bates [7] of the Drupal Security Team

-------- FIXED BY
------------------------------------------------------------

* Daniel Hanold [8] the module maintainer

-------- COORDINATED BY
------------------------------------------------------

* Laurence Liss [9] provisional member of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [10].

Learn more about the Drupal Security team and their policies [11], writing
secure code for Drupal [12], and securing your site [13].

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [14]


[1] http://drupal.org/project/push_notifications
[2] http://drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] http://drupal.org/project/push_notifications
[5] http://drupal.org/node/2188983
[6] http://drupal.org/project/push_notifications
[7] http://drupal.org/user/16029
[8] http://drupal.org/user/339733
[9] http://drupal.org/user/724750
[10] http://drupal.org/contact
[11] http://drupal.org/security-team
[12] http://drupal.org/writing-secure-code
[13] http://drupal.org/security/secure-configuration
[14] https://twitter.com/drupalsecurity

Login or Register to add favorites

File Archive:

August 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    15 Files
  • 2
    Aug 2nd
    22 Files
  • 3
    Aug 3rd
    0 Files
  • 4
    Aug 4th
    0 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    11 Files
  • 7
    Aug 7th
    43 Files
  • 8
    Aug 8th
    42 Files
  • 9
    Aug 9th
    36 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    27 Files
  • 13
    Aug 13th
    18 Files
  • 14
    Aug 14th
    50 Files
  • 15
    Aug 15th
    33 Files
  • 16
    Aug 16th
    23 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close