maintainers, please update to 4.6.7 or 4.7.1 Description: Two vulnerabilities have been reported in Drupal, which can be exploited by malicious people to conduct SQL injection attacks and by malicious users to potentially compromise a vulnerable system. 1) Input passed to unspecified parameters is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The vulnerability has been reported in version 4.6.6 and prior, and in version 4.7.0 and prior. 2) Missing access restrictions to the "files" directories in certain configurations can be exploited to execute arbitrary files within the directory. Successful exploitation requires that a " .htaccess" file has not been used to restrict access to the directory. The vulnerability has been reported in all versions prior to 4.6.7, and in version 4.7.0. Solution: Update to version 4.6.7 or 4.7.1. http://drupal.org/project Provided and/or discovered by: 1) Ayman Hourieh 2) milw0rm Original Advisory: http://drupal.org/node/65357 http://drupal.org/node/65409
Setting to trivial because there's no stable version and there will be no GLSA.
We'll fix this by updating to drupal-4.7.1. I'll update again when we have a suitable package in the tree. Best regards, Stu
If possible, please bump directly 4.7.2 due to a remote execution of arbitrary code vuln in 4.7.1 : see http://drupal.org/security and particularly : http://drupal.org/node/66763 Revision to DRUPAL-SA-2006-006 Security announcements webchick - June 1, 2006 - 18:49 * Advisory ID: DRUPAL-SA-2006-007 * Project: Drupal core and potentially any web application that accepts uploads. * Date: 2006-Jun-01 * Security risk: highly critical * Impact: Drupal core * Exploitable from: remote * Vulnerability: Execution of arbitrary files Description Recently, the Drupal security team was informed of a potential exploit that would allow untrusted code to be executed upon a successful request by a malicious user. If a dynamic script with multiple extensions such as file.php.pps or file.sh.txt is uploaded and then accessed from a web browser under certain common Apache configurations, it will cause the script inside to be executed. We deemed this exploit critical and released Drupal 4.6.7 and 4.7.1 six hours after the report was filed. The fix was to create a .htaccess file to remove all dynamic script handlers, such as PHP, from the "files" directory. After continuous review, however, we've found that the fix will not work in certain Apache configurations, for example those for whom .htaccess FileInfo overrides are disabled. We are thus releasing 4.6.8 and 4.7.2 with a more robust .htaccess fix, as well as a Drupal core solution to the issue which will work under all configurations. The new behavior of Drupal's upload.module is to rename all uploaded files with multiple, non-numeric, and non-whitelisted extensions by any other user than the administrator. For example: file.php.pps this is a long file.name.txt becomes: file.php_.pps this is a long file.name_.txt Please note that the particular Apache configurations under which this exploit is possible will affect ANY web application on the server which allows uploads to web-accessible directories, not just Drupal. The Drupal security team has also contacted other projects, such as WordPress, about this issue and new versions of their software have either already been released, or are forthcoming. 4.7.2 also fixes a potential XSS bug with upload.module. Versions affected - All Drupal versions before 4.6.8 and before Drupal 4.7.2. Solution If you are running Drupal 4.6.x then upgrade to Drupal 4.6.8. If you are running Drupal 4.7.x then upgrade to Drupal 4.7.2. To patch Drupal 4.6.7 use the http://drupal.org/files/sa-2006-007/4.6.7.patch. To patch Drupal 4.7.1 use the http://drupal.org/files/sa-2006-007/4.7.1.patch. Reported by DRUPAL-SA-2006-06 issue: Lourens Veen XSS vulnerability in upload.module: Karoly Negyesi Contact The security contact for Drupal can be reached at security at drupal.org or using the form at http://drupal.org/contact.
web-apps, please advise
Fixing severity and rating as I can't find a stable version.
There is an error in the CVE-2006-2833 text (as for the other sources, 4.6.8 and 4.7.2 are not vulnerable) two fixes are possible. SA20412 : Solution: Update to the fixed version 4.6.8 or 4.7.2, or apply patch. http://drupal.org/project Patch for Drupal 4.6.7: http://drupal.org/files/sa-2006-008/4.6.7.patch Patch for Drupal 4.7.1: http://drupal.org/files/sa-2006-008/4.7.1.patch
Hi, Drupal 4.7.2 is in the tree. My apologies, it seems that it was bumped, but the maintainer didn't update this bug. Best regards, Stu
Thx for the info stu. Closing with NO GLSA.
