=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2011/VULN133
_____________________________________________________________________

DATE                      : 18/02/2011

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Messaging for DRUPAL versions 6.x.

======================================================================
http://drupal.org/node/1064024
______________________________________________________________________

  * Advisory ID: DRUPAL-SA-CONTRIB-2011-010
  * Project: Messaging (third-party module)
  * Version: 6.x
  * Date: 2011-February-16
  * Security risk: Moderately critical
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting

The Messaging module is a Framework to allow message sending in a channel
independent way. It provides a common API for message composition and sending
while allowing plug-ins for multiple messaging methods. The module does not
sanitize some of the user-supplied data before displaying it, leading to a
Cross Site Scripting (XSS [1]) vulnerability that may lead to a malicious
user gaining full administrative access. This vulnerability is mitigated by
the fact that the attacker must have a role with the 'administer messaging'
permission which should generally only be granted to trusted roles.

- -------- VERSIONS AFFECTED ---------------------------------------------------

  * Messaging module for Drupal 6.x versions prior to 6.x-2.4 and
    6.x-4.0-beta8

Drupal core is not affected. If you do not use the contributed Messaging [2]
module, there is nothing you need to do.

- -------- SOLUTION ------------------------------------------------------------

Install the latest version:
  * If you use the Messaging module version 6.x-2.x upgrade to Messaging
    6.x-2.4 [3]
  * If you use the Messaging module version 6.x-4.x upgrade to Messaging
    6.x-4.0-beta8 [4]

See also the Messaging project page [5].

- -------- REPORTED BY ---------------------------------------------------------

  * Justin Klein Keane [6]

- -------- FIXED BY ------------------------------------------------------------

  * Jose Reyero [7], module maintainer

- -------- CONTACT -------------------------------------------------------------

The Drupal security team [8] can be reached at security at drupal.org [9] or
via the form at http://drupal.org/contact [10].


[1] http://en.wikipedia.org/wiki/Cross-site_scripting
[2] http://drupal.org/project/messaging
[3] http://drupal.org/node/1064014
[4] http://drupal.org/node/1064026
[5] http://drupal.org/project/messaging
[6] http://drupal.org/user/302225
[7] http://drupal.org/user/4299
[8] http://drupal.org/security-team
[9] http://drupal.org
[10] http://drupal.org/contact

======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================