A weakness has been reported in Drupal, which can be exploited by malicious users to conduct spoofing attacks. The weakness is caused due to an unspecified error and can be exploited to change the page cache so existing pages return "page not found" errors. Successful exploitation requires valid user credentials with the ability to post content. It also requires the page cache to be enabled and that MySQL is used. The weakness is reported in the 4.6.x branch before 4.6.11 and in the 4.7.x branch before 4.7.5. Reproducible: Didn't try http://drupal.org/files/sa-2007-002/advisory.txt
dropped uberlord@gentoo.org an email
drupal-4.7.5 is now in portage. Thanks for the heads up :) sec team, we don't have a stable drupal version, so no need to add the arches :)
