SA-CONTRIB-2015-030 - Amazon AWS - Access bypass

Amazon AWS module provides integration with Amazon Web Services (AWS).

A malicious user could potentially guess an access token and trigger the creation of new backups by making a request to a specially-crafted URL. If the number of stored backups was limited, an attacker could exceed the limit by calling the URL multiple times, thereby resulting in the loss of older backup states that would get replaced with the newly generated ones.

This vulnerability is mitigated by the fact that an attacker must know the AWS Access Key Id (these are not secret).

CVE identifier(s) issued

• CVE-2015-3373

Versions affected

• Amazon AWS versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed Amazon AWS module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Amazon AWS module for Drupal 7, upgrade to Amazon AWS 7.x-1.3

Also see the Amazon AWS project page.

Reported by

• Pere Orga provisional member of the Drupal Security Team

Fixed by

• Sudhir Krishna the module maintainer

Coordinated by

• Pere Orga provisional member of the Drupal Security Team