Bug 134326 – www-apps/drupal: 4.6.8/4.7.2 fixes several vuln (CVE-2006-274[23], CVE-2006-283[123])

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Raphael Marichez (Falco) (RETIRED) 2006-05-25 07:17:39 UTC]

maintainers, please update to 4.6.7 or 4.7.1


Description:
Two vulnerabilities have been reported in Drupal, which can be exploited by malicious people to conduct SQL injection attacks and by malicious users to potentially compromise a vulnerable system.

1) Input passed to unspecified parameters is not properly sanitised before being used in an SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability has been reported in version 4.6.6 and prior, and in version 4.7.0 and prior.

2) Missing access restrictions to the "files" directories in certain configurations can be exploited to execute arbitrary files within the directory.

Successful exploitation requires that a " .htaccess" file has not been used to restrict access to the directory.

The vulnerability has been reported in all versions prior to 4.6.7, and in version 4.7.0.

Solution:
Update to version 4.6.7 or 4.7.1.
http://drupal.org/project

Provided and/or discovered by:
1) Ayman Hourieh
2) milw0rm

Original Advisory:
http://drupal.org/node/65357
http://drupal.org/node/65409

[Comment 1 Raphael Marichez (Falco) (RETIRED) 2006-05-25 07:18:21 UTC]

Setting to trivial because there's no stable version and there will be no GLSA.

[Comment 2 Stuart Herbert (RETIRED) 2006-05-31 00:18:49 UTC]

We'll fix this by updating to drupal-4.7.1.  I'll update again when we have a suitable package in the tree.

Best regards,
Stu

[Comment 3 Raphael Marichez (Falco) (RETIRED) 2006-06-05 08:06:17 UTC]

If possible, please bump directly 4.7.2 due to a remote execution of arbitrary code vuln in 4.7.1 :

see http://drupal.org/security and particularly :
http://drupal.org/node/66763
Revision to DRUPAL-SA-2006-006
Security announcements
webchick - June 1, 2006 - 18:49

    * Advisory ID: DRUPAL-SA-2006-007
    * Project: Drupal core and potentially any web application that accepts uploads.
    * Date: 2006-Jun-01
    * Security risk: highly critical
    * Impact: Drupal core
    * Exploitable from: remote
    * Vulnerability: Execution of arbitrary files

Description

Recently, the Drupal security team was informed of a potential exploit that would allow untrusted code to be executed upon a successful request by a malicious user. If a dynamic script with multiple extensions such as file.php.pps or file.sh.txt is uploaded and then accessed from a web browser under certain common Apache configurations, it will cause the script inside to be executed. We deemed this exploit critical and released Drupal 4.6.7 and 4.7.1 six hours after the report was filed. The fix was to create a .htaccess file to remove all dynamic script handlers, such as PHP, from the "files" directory.

After continuous review, however, we've found that the fix will not work in certain Apache configurations, for example those for whom .htaccess FileInfo overrides are disabled. We are thus releasing 4.6.8 and 4.7.2 with a more robust .htaccess fix, as well as a Drupal core solution to the issue which will work under all configurations. The new behavior of Drupal's upload.module is to rename all uploaded files with multiple, non-numeric, and non-whitelisted extensions by any other user than the administrator. For example:

file.php.pps
this is a long file.name.txt

becomes:

file.php_.pps
this is a long file.name_.txt

Please note that the particular Apache configurations under which this exploit is possible will affect ANY web application on the server which allows uploads to web-accessible directories, not just Drupal. The Drupal security team has also contacted other projects, such as WordPress, about this issue and new versions of their software have either already been released, or are forthcoming.

4.7.2 also fixes a potential XSS bug with upload.module.
Versions affected

- All Drupal versions before 4.6.8 and before Drupal 4.7.2.
Solution

If you are running Drupal 4.6.x then upgrade to Drupal 4.6.8.
If you are running Drupal 4.7.x then upgrade to Drupal 4.7.2.
To patch Drupal 4.6.7 use the http://drupal.org/files/sa-2006-007/4.6.7.patch.
To patch Drupal 4.7.1 use the http://drupal.org/files/sa-2006-007/4.7.1.patch.
Reported by

DRUPAL-SA-2006-06 issue: Lourens Veen
XSS vulnerability in upload.module: Karoly Negyesi
Contact

The security contact for Drupal can be reached at security at drupal.org or using the form at http://drupal.org/contact.

[Comment 4 Raphael Marichez (Falco) (RETIRED) 2006-06-11 14:13:56 UTC]

web-apps, please advise

[Comment 5 Sune Kloppenborg Jeppesen (RETIRED) 2006-06-16 11:21:37 UTC]

Fixing severity and rating as I can't find a stable version.

[Comment 6 Raphael Marichez (Falco) (RETIRED) 2006-06-18 02:58:09 UTC]

There is an error in the CVE-2006-2833 text (as for the other sources, 4.6.8 and 4.7.2 are not vulnerable)


two fixes are possible.
SA20412 :
Solution:
Update to the fixed version 4.6.8 or 4.7.2, or apply patch.
http://drupal.org/project

Patch for Drupal 4.6.7:
http://drupal.org/files/sa-2006-008/4.6.7.patch

Patch for Drupal 4.7.1:
http://drupal.org/files/sa-2006-008/4.7.1.patch

[Comment 7 Stuart Herbert (RETIRED) 2006-07-09 13:06:33 UTC]

Hi,

Drupal 4.7.2 is in the tree.  My apologies, it seems that it was bumped, but the maintainer didn't update this bug.

Best regards,
Stu

[Comment 8 Sune Kloppenborg Jeppesen (RETIRED) 2006-07-09 14:03:21 UTC]

Thx for the info stu. Closing with NO GLSA.