SA-CONTRIB-2013-078 - Quick Tabs - Access Bypass

The Quick Tabs module allows you to create blocks of tabbed content, specifically views, blocks, nodes and other quicktabs. You can create a block on your site containing multiple tabs with corresponding content.

The module does not sufficiently check block permissions before rendering a Quick Tab. Before this vulnerability was addressed, if a block had been restricted to only appear for certain roles, that access was not checked before rending it within a Quick Tab - leaving the contents of that block visible to the world.

This vulnerability is mitigated by the fact that node and view permissions are respected, meaning the vulnerability primarily exists for custom blocks created for specific roles.

CVE identifier(s) issued

• CVE-2013-4406

Versions affected

• Quick Tabs 7.x-3.x versions prior to 7.x-3.6.
• Quick Tabs 6.x-3.x versions prior to 6.x-3.2.
• Quick Tabs 6.x-2.x versions prior to 6.x-2.2.

Drupal core is not affected. If you do not use the contributed Quick Tabs module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Quick Tabs 3.x module for Drupal 7.x, upgrade to Quick Tabs 7.x-3.6
• If you use the Quick Tabs 3.x module for Drupal 6.x, upgrade to Quick Tabs 6.x-3.2
• If you use the Quick Tabs 2.x module for Drupal 6.x, upgrade to Quick Tabs 6.x-2.2

Also see the Quick Tabs project page.

Reported by

• Steven Wiliam

Fixed by

• Fengtan
• Matt Tucker (one of) the module maintainers

Coordinated by

• Lee Rowlands of the Drupal Security Team