Drupal Monthly Archive by Node Type Module Security Bypass Vulnerability

Bugtraq ID:	38636
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 10 2010 12:00AM
Updated:	Mar 10 2010 12:00AM
Credit:	Prometheus6
Vulnerable:	Drupal Monthly Archive by Node Type 6.x-3.2 Drupal Monthly Archive by Node Type 6.x-2.6 Drupal Monthly Archive by Node Type 6.x-1.3
Not Vulnerable:	Drupal Monthly Archive by Node Type 6.x-3.3 Drupal Monthly Archive by Node Type 6.x-2.7 Drupal Monthly Archive by Node Type 6.x-1.4

Drupal Monthly Archive by Node Type Module Security Bypass Vulnerability

The Monthly Archive by Node Type module for Drupal is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass security restrictions to obtain sensitive information; this may aid in launching further attacks.

Versions prior to Monthly Archive by Node Type 6.x-1.4, 6.x-2.7, and 6.x-3.3 are vulnerable.

Drupal Monthly Archive by Node Type Module Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

Drupal Monthly Archive by Node Type Module Security Bypass Vulnerability

Solution:
The vendor has released fixes and an advisory. Please see the references for details.


Drupal Monthly Archive by Node Type 6.x-3.2

• Drupal montharchive-6.x-3.3.tar.gz
  http://ftp.drupal.org/files/projects/montharchive-6.x-3.3.tar.gz

Drupal Monthly Archive by Node Type 6.x-1.3

• Drupal montharchive-6.x-1.4.tar.gz
  http://ftp.drupal.org/files/projects/montharchive-6.x-1.4.tar.gz

Drupal Monthly Archive by Node Type 6.x-2.6

• Drupal montharchive-6.x-2.7.tar.gz
  http://ftp.drupal.org/files/projects/montharchive-6.x-2.7.tar.gz

Drupal Monthly Archive by Node Type Module Security Bypass Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• Monthly Archive by Node Type Homepage (Drupal)
  
• SA-CONTRIB-2010-026 - Monthly Archive by Node Type - Access Bypass (Drupal)