----------------------------------------------------------------------

Want a new job?

http://secunia.com/secunia_security_specialist/
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

International Partner Manager - Project Sales in the IT-Security
Industry:
http://corporate.secunia.com/about_secunia/64/

----------------------------------------------------------------------

TITLE:
Drupal Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA31462

VERIFY ADVISORY:
http://secunia.com/advisories/31462/

CRITICAL:
Moderately critical

IMPACT:
Cross Site Scripting, Manipulation of data, System access

WHERE:
>From remote

SOFTWARE:
Drupal 5.x
http://secunia.com/product/13378/
Drupal 6.x
http://secunia.com/product/17839/

DESCRIPTION:
Some vulnerabilities have been reported in Drupal, which can be
exploited by malicious users to conduct script insertion attacks and
compromise a vulnerable system, and by malicious people to conduct
cross-site scripting and cross-site request forgery attacks.

1) Input passed to an unspecified parameter is not properly sanitised
before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context
of an affected site.

2) A vulnerability is caused by the fact that the private filesystem
uses the MIME media type it receives from the web browser when
handling uploads. This can be exploited for script insertion
attacks.

Successful exploitation of this vulnerability requires valid user
credentials with the right to upload files.

3) A vulnerability is caused due to missing restrictions on what file
types that users are allowed to upload in the BlogAPI module. This can
be exploited to e.g. execute arbitrary PHP code.

Successful exploitation of this vulnerability requires valid user
credentials with the "administer content with blog api" permission.

4) A vulnerability is caused due to the application allowing users to
perform certain actions via HTTP requests without performing any
validity checks to verify the request. This can be exploited to add
or delete user access rules, by enticing a logged-in user to visit a
malicious web page.

The vulnerabilities are reported in all 5.x versions prior to 5.10
and all 6.x versions prior to 6.4.

SOLUTION:
Update to version 5.10 or 6.4.

PROVIDED AND/OR DISCOVERED BY:
1) Bart Jansens, Drupal security team
2) The vendor credits Mark Burdett.
3) Gábor Hojtsy, Drupal security team and Mark Burdett
4) Barry Jaspan, Drupal security team

ORIGINAL ADVISORY:
DRUPAL-SA-2008-047:
http://drupal.org/node/295053

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------