Skip to Content.
Sympa Menu

sm-security - [SM-Security] drupal: several vulnerabilities

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] drupal: several vulnerabilities
  • Date: Wed, 29 Jun 2005 16:57:57 -0700

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Synopsis
========
drupal branch 4.6 earlier than 4.6.2 and 4.55 branch earlier than 4.5.4
suffer security vulnerabilities in input filters (DRUPAL-SA-2005-002)
and the XML-RPC library (DRUPAL-SA-2005-003).

Background
==========
Drupal - Open source content management platform

Description
===========
DRUPAL-SA-2005-002:
Kuba Zygmunt discovered a flaw in the input validation routines of
Drupal's
filter mechanism. An attacker could execute arbitrary PHP code on a
target
site when public comments or postings are allowed.

DRUPAL-SA-2005-003:
A flaw has been discovered in the third-party XML-RPC library included
with
Drupal. An attacker could execute arbitrary PHP code on a target site.

Impact
======
A remote machine could execute arbitrary PHP code on a machine running a
vulnerable instance of Drupal (through XML-RPC in general as well as
public comments or postings).

Affected packages
=================
drupal in all grimoires devel and test is affected.
This is now fixed in all affected grimoires.

Resolution
==========
All drupal users should upgrade to the latest available version:
# scribe update
# cast -c drupal

References
==========
[ 1 ] DRUPAL-SA-2005-002
http://drupal.org/files/sa-2005-002/advisory.txt
[ 2 ] DRUPAL-SA-2005-003
http://drupal.org/files/sa-2005-003/advisory.txt
[ 3 ] Drupal 4.6.2/4.5.4 release
http://drupal.org/drupal-4.6.2

- -sandalle

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric at sandall.us PGP: 0xA8EFDD61 | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @
WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCwzjIHXt9dKjv3WERArGeAKCqQR2gL3NLfi37dnueDehlMV+46gCbBbFU
ZsE3I239pizZl4ntKcT91wI=
=q1EE
-----END PGP SIGNATURE-----

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.



  • [SM-Security] drupal: several vulnerabilities, Eric Sandall, 06/29/2005

Archive powered by MHonArc 2.6.24.

Top of Page