By Drupal Security Team on
  • Advisory ID: DRUPAL-SA-CONTRIB-2012-086
  • Project: Amadou (third-party theme)
  • Version: 6.x
  • Date: 2012-May-30
  • Security risk: Moderately critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

Description

The Amadou theme outputs additional first and last classes to the list of links to help out themers. This was being done in a way that was not secure.

A Cross Site Scripting (XSS) vulnerability was identified in Amadou theme's themes_links() function in the template.php file, which was fixed in the theme_links() function in Drupal 6.3 as noted in (SA-2008-044 http://drupal.org/node/280571).

CVE: CVE-2012-2715

Versions affected

  • Amadou 6.x-1.x versions prior to 6.x-1.3.

Drupal core is not affected. If you do not use the contributed Amadou theme, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the Amadou theme for Drupal 6.x, upgrade to Amadou 6.x-1.3.

If you have created a custom theme with Amadou or are using Amadou as a base theme, please see below for a manual fix:

The offending code on line 77 in the original template.php file:
$output .= '<span class="'. $extra_class . $class .'">';

Should be replaced with the following code:
$output .= '<li class='. $extra_class . drupal_attributes(array('class' => $class)) .'>';

Also see the Amadou project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

⋅ Categories: Drupal 6.x