Bug 160375

Summary:	www-apps/drupal (versions < 4.7.5) Unspecified Page Not Found Spoofing Weakness
Product:	Gentoo Security	Reporter:	Executioner <keith>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	uberlord
Priority:	Highest
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://secunia.com/advisories/23586/
Whiteboard:
Package list:		Runtime testing required:	---

Description Executioner 2007-01-06 08:36:41 UTC

A weakness has been reported in Drupal, which can be exploited by malicious users to conduct spoofing attacks.

The weakness is caused due to an unspecified error and can be exploited to change the page cache so existing pages return "page not found" errors.

Successful exploitation requires valid user credentials with the ability to post content. It also requires the page cache to be enabled and that MySQL is used.

The weakness is reported in the 4.6.x branch before 4.6.11 and in the 4.7.x branch before 4.7.5.


Reproducible: Didn't try




http://drupal.org/files/sa-2007-002/advisory.txt

Comment 1 Executioner 2007-01-06 08:40:32 UTC

dropped uberlord@gentoo.org an email

Comment 2 Roy Marples (RETIRED) gentoo-dev

2007-01-06 09:02:18 UTC

drupal-4.7.5 is now in portage. Thanks for the heads up :)

sec team, we don't have a stable drupal version, so no need to add the arches :)