Security advisories

SA-CORE-2012-002 - Drupal core multiple vulnerabilities

Drupal Security Team — Wed, 02 May 2012 15:17:48 +0000

Advisory ID: DRUPAL-SA-CORE-2012-002
Project: Drupal core
Version: 7.x
Date: 2012-May-2
Security risk: Critical
Exploitable from: Remote
Vulnerability: Denial of Service, Access bypass, Unvalidated form redirect

Description

Denial of Service

CVE: CVE-2012-1588

Drupal core's text filtering system provides several features including removing inappropriate HTML tags and automatically linking content that appears to be a link. A pattern in Drupal's text matching was found to be inefficient with certain specially crafted strings. This vulnerability is mitigated by the fact that users must have the ability to post content sent to the filter system such as a role with the "post comments" or "Forum topic: Create new content" permission.

Unvalidated form redirect

CVE: CVE-2012-1589

Drupal core's Form API allows users to set a destination, but failed to validate that the URL was internal to the site. This weakness could be abused to redirect the login to a remote site with a malicious script that harvests the login credentials and redirects to the live site. This vulnerability is mitigated only by the end user's ability to recognize a URL with malicious query parameters to avoid the social engineering required to exploit the problem.

Access bypass - forum listing

CVE: CVE-2012-1590

Drupal core's forum lists fail to check user access to nodes when displaying them in the forum overview page. If an unpublished node was the most recently updated in a forum then users who should not have access to unpublished forum posts were still be able to see meta-data about the forum post such as the post title.

Access bypass - private images

CVE: CVE-2012-1591

Drupal core provides the ability to have private files, including images, and Image Styles which create derivative images from an original image that may differ, for example, in size or saturation. Drupal core failed to properly terminate the page request for cached image styles allowing users to access image derivatives for images they should not be able to view. Furthermore, Drupal didn't set the right headers to prevent image styles from being cached in the browser.

Access bypass - content administration

CVE: CVE-2012-2153

Drupal core provides the ability to list nodes on a site at admin/content. Drupal core failed to confirm a user viewing that page had access to each node in the list. This vulnerability only concerns sites running a contributed node access module and is mitigated by the fact that users must have a role with the "Access the content overview page" permission. Unpublished nodes were not displayed to users who only had the "Access the content overview page" permission.

Versions affected

Drupal core 7.x versions prior to 7.13.

Solution

Install the latest version:

If you use Drupal 7.x, upgrade to Drupal core 7.13

Also see the Drupal core project page.

Reported by

The Denial of Service vulnerability was reported by Jay Wineinger and Lin Clark.
The unvalidated form redirect vulnerability was reported by Károly Négyesi of the Drupal Security Team and Katsuhiko Nakanishi.
The access bypass in forum listing vulnerability was reported by Glen W.
The access bypass for private images vulnerability was reported by frega, Andreas Gonell, Jeremy Meier and Xenza.
The access bypass for the content administration vulnerability was reported by Jennifer Hodgdon.

Fixed by

The Denial of Service was fixed by Károly Négyesi of the Drupal Security Team.
The unvalidated form redirect was fixed by Wolfgang Ziegler and Stéphane Corlosquet of the Drupal Security Team.
The access bypass in forum listing was fixed by Michael Hess of the Drupal Security Team, Ben Jeavons of the Drupal Security Team and xjm.
The Access bypass for private images was fixed by Károly Négyesi of the Drupal Security Team, Damien Tournoud of the Drupal Security Team, Greg Knaddison of the Drupal Security Team, Stéphane Corlosquet of the Drupal Security Team, Xenza and frega.
The Access bypass for content administration was fixed by Jennifer Hodgdon.

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

SA-CORE-2012-001 - Drupal core multiple vulnerabilities

Drupal Security Team — Wed, 01 Feb 2012 22:06:54 +0000

Advisory ID: DRUPAL-SA-CORE-2012-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2012-February-01
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Request Forgery, Multiple vulnerabilities

Description

Cross Site Request Forgery vulnerability in Aggregator module

CVE: CVE-2012-0826
An XSRF vulnerability can force an aggregator feed to update. Since some services are rate-limited (e.g. Twitter limits requests to 150 per hour) this could lead to a denial of service.

This issue affects Drupal 6.x and 7.x.

OpenID not verifying signed attributes in SREG and AX

CVE: CVE-2012-0825
A group of security researchers identified a flaw in how some OpenID relying parties implement Attribute Exchange (AX). Not verifying that attributes being passed through AX have been signed could allow an attacker to modify users' information.

This issue affects Drupal 6.x and 7.x.

Access bypass in File module

CVE: CVE-2012-0827
When using private files in combination with certain field access modules, the File module will allow users to download the file even if they do not have access to view the field it was attached to.

This issue affects Drupal 7.x only.

Versions affected

Drupal 6.x core prior to 6.23.
Drupal 7.x core prior to 7.11.

Solution

Install the latest version:

If you use Drupal 6.x upgrade to 6.23
If you use Drupal 7.x upgrade to 7.11

See also the Drupal core project page.

Reported by

The Aggregator module CSRF vulnerability was reported by Dylan Tack of the Drupal Security Team.
The OpenID vulnerability was reported by Rui Wang, Shuo Chen and Xiao Feng Wang.
The File module access bypass issue was reported by David Rothstein of the Drupal Security Team, and by Sascha Grossenbacher.

Fixed by

Aggregator CSRF issue fixed by Dave Reid of the Drupal Security Team
OpenID issue fixed by Vojtech Kusy and Christian Schmidt
The File module access bypass issue was fixed by David Rothstein of the Drupal Security Team, Sascha Grossenbacher, and Derek Wright of the Drupal Security Team.

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

SA-CORE-2011-003 - Drupal core - Access bypass

Drupal Security Team — Wed, 27 Jul 2011 19:32:17 +0000

Advisory ID: DRUPAL-SA-CORE-2011-003
Project: Drupal core
Version: 7.x
Date: 2011-July-27
Security risk: Less critical
Exploitable from: Remote
Vulnerability: Access bypass

Description

CVE: CVE-2011-2726

Access bypass in private file fields on comments.

Drupal 7 contains two new features: the ability to attach File upload fields to any entity type in the system and the ability to point individual File upload fields to the private file directory.

If a Drupal site is using these features on comments, and the parent node is denied access (either by a node access module or by being unpublished), the file attached to the comment can still be downloaded by non-privileged users if they know or guess its direct URL.

This issue affects Drupal 7.x only.

Versions affected

Drupal 7.x before version 7.5.

Solution

Install the latest version:

If you are running Drupal 7.x then upgrade to Drupal 7.5 or ~~7.6~~ 7.7.

The Security Team has released both a pure security update without other bug fixes and a security update combined with other bug fixes and improvements. You can choose to either only include the security update for an immediate fix (which might require less quality assurance and testing) or more fixes and improvements alongside the security fixes by choosing between Drupal 7.5 and Drupal ~~7.6~~ 7.7. Read the announcement for more information.

See also the Drupal core project page.

Reported by

The File access bypass was reported by Florian Weber.

Fixed by

The File access bypass was fixed by Stéphane Corlosquet and Károly Négyesi, both members of the Drupal security team.

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

SA-CORE-2011-002 - Drupal core - Access bypass

Drupal Security Team — Thu, 30 Jun 2011 00:13:40 +0000

Advisory ID: DRUPAL-SA-CORE-2011-002
Project: Drupal core
Version: 7.x
Date: 2011-JUNE-29
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Access bypass

Description

CVE: CVE-2011-2687

Access bypass in node listings

Listings showing nodes but not JOINing the node table show all nodes regardless of restrictions imposed by the node_access system. In core, this affects the taxonomy and the forum subsystem.

This issue only affects sites using a node access module such as content access or forum access. If you do not use any node access system then your site is not affected by this vulnerability. It is still considered a best practice to run the latest release and all site owners are encouraged to upgrade when they can regardless of whether or not they are affected.

Note that fixing this issue in contributed modules requires a backwards-compatible API change for modules listing nodes. See http://drupal.org/node/1204572 for more details.

This issue affects Drupal 7.x only.

Versions affected

Drupal 7.0, 7.1 and 7.2.

Solution

Install the latest version:

If you are running Drupal 7.x then upgrade to Drupal 7.3 or 7.4.

The Security Team has released both a pure security update without other bug fixes and a security update combined with other bug fixes and improvements. You can choose to either only include the security update for an immediate fix (which might require less quality assurance and testing) or more fixes and improvements alongside the security fixes by choosing between Drupal 7.3 and Drupal 7.4. Read the announcement for more information.

See also the Drupal core project page.

Reported by

The access bypass was reported independently by numerous people, including Sascha Grossenbacher, Khaled Alhourani, and Ben Ford.

Fixed by

The access bypass was fixed by Károly Négyesi, member of the Drupal security team

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

SA-CORE-2011-001 - Drupal core - Multiple vulnerabilities

Drupal Security Team — Wed, 25 May 2011 18:07:48 +0000

Advisory ID: DRUPAL-SA-CORE-2011-001
Project: Drupal core
Version: 6.x, 7.x
Date: 2011-May-25
Security risk: Critical
Exploitable from: Remote
Vulnerability: Access bypass, Cross Site Scripting

Description

CVE: CVE-2011-2687

Multiple vulnerabilities and weaknesses were discovered in Drupal.

Reflected cross site scripting vulnerability in error handler

A reflected cross site scripting vulnerability was discovered in Drupal's error handler. Drupal displays PHP errors in the messages area, and a specially crafted URL can cause malicious scripts to be injected into the message. The issue can be mitigated by disabling on-screen error display at admin/settings/error-reporting. This is the recommended setting for production sites.

This issue affects Drupal 6.x only.

Cross site scripting vulnerability in Color module

When using re-colorable themes, color inputs are not sanitized. Malicious color values can be used to insert arbitrary CSS and script code. Successful exploitation requires the "Administer themes" permission.

This issue affects Drupal 6.x and 7.x.

Access bypass in File module

When using private files in combination with a node access module, the File module allows unrestricted access to private files.

This issue affects Drupal 7.x only.

Versions affected

Drupal 7.x before version 7.1.
Drupal 6.x before version 6.21.

Solution

Install the latest version:

If you are running Drupal 7.x then upgrade to Drupal 7.1 or 7.2.
If you are running Drupal 6.x then upgrade to Drupal 6.21 or 6.22.

See the release announcement for more information.

See also the Drupal core project page.

Reported by

The reflected cross site scripting vulnerability was reported by Heine Deelstra (*).
The Color module cross site scripting vulnerability was reported by Kasper Lindgaard, Secunia Research.
The File access bypass was reported by Hubert Lecorche, and Peter Bex.

Fixed by

The reflected cross site scripting vulnerability was fixed by Alan Smithee.
The Color module cross site scripting vulnerability was fixed by Stéphane Corlosquet (*), Heine Deelstra (*), and Peter Wolanin (*).
The File access bypass was fixed by Heine Deelstra (*).

(*) Member of the Drupal security team.

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

SA-CORE-2010-002 - Drupal core - Multiple vulnerabilities

Drupal Security Team — Wed, 11 Aug 2010 19:53:18 +0000

Advisory ID: DRUPAL-SA-CORE-2010-002
Project: Drupal core
Version: 5.x, 6.x
Date: 2010-August-11
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

Description

Multiple vulnerabilities and weaknesses were discovered in Drupal.

OpenID authentication bypass

The OpenID module provides users the ability to login to sites using an OpenID account.

The OpenID module doesn't implement all the required verifications from the OpenID 2.0 protocol and is vulnerable to a number of attacks.

Specifically:
- OpenID should verify that a "openid.response_nonce" has not already been used for an assertion by the OpenID provider
- OpenID should verify the value of openid.return_to as obtained from the OpenID provider
- OpenID must verify that all fields that are required to be signed are signed

These specification violations allow malicious sites to harvest positive assertions from OpenID providers and use them on sites using the OpenID module to obtain access to preexisting accounts bound to the harvested OpenIDs. Intercepted assertions from OpenID providers can also be replayed and used to obtain access to user accounts bound to the intercepted OpenIDs.

This issue affects Drupal 6.x only. A separate security announcement and release is published for the contributed OpenID module for Drupal 5.x.

File download access bypass

The upload module allows users to upload files and provides access checking for file downloads.

The module looks up files for download in the database and serves them for download after access checking. However, it does not account for the fact that certain database configurations will not consider case differences in file names. If a malicious user uploads a file which only differs in letter case, access will be granted for the earlier upload regardless of actual file access to that.

This issue affects Drupal 5.x and 6.x.

Comment unpublishing bypass

The comment module allows users to leave comments on content on the site.

The module supports unpublishing comments by privileged users. Users with the "post comments without approval" permission however could craft a URL which allows them to republish previously unpublished comments.

This issue affects Drupal 5.x and 6.x.

Actions cross site scripting

The actions feature combined with Drupal's trigger module allows users to configure certain actions to happen when users register, content is submitted, and so on; through a web based interface.

Users with "administer actions permission" can enter action descriptions and messages which are not properly filtered on output. Users with content and taxonomy tag submission permissions can create nodes and taxonomy terms which are not properly sanitized for inclusion in action messages and inject arbitrary HTML and script code into Drupal pages. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS).

This issue affects Drupal 6.x only.

Versions affected

Drupal 6.x before version 6.18 or 6.19.
Drupal 5.x before version 5.23.

Solution

Install the latest version:

If you are running Drupal 6.x then upgrade to Drupal 6.18 or Drupal 6.19.
If you are running Drupal 5.x then upgrade to Drupal 5.23.

Drupal 5 will no longer be maintained when Drupal 7 is released. Upgrading to Drupal 6 is recommended.

The security team starts a new practice of releasing both a pure security update without other bugfixes and a security update combined with other bug fixes and improvements. You can choose to either only include the security update for an immediate fix (which might require less quality assurance and testing) or more fixes and improvements alongside the security fixes by choosing between Drupal 6.18 and Drupal 6.19. Read the announcement for more information.

Reported by

The OpenID authentication bypass issues were reported by Johnny Bufu, Christian Schmidt and Heine Deelstra (*).
The file download access bypass was reported by Wolfgang Ziegler.
The comment unpublish bypass issue was reported by Heine Deelstra (*).
The actions module cross site scripting was reported by Justin Klein Keane and Heine Deelstra (*).

(*) Member of the Drupal security team.

Fixed by

The OpenID authentication issues were fixed by Christian Schmidt, Heine Deelstra (*) and Damien Tournoud (*).
The file download access bypass was fixed by Dave Reid (*) and Neil Drumm (*).
The comment unpublish bypass issue was fixed by Heine Deelstra (*).
The actions module cross site scripting was fixed by Justin Klein Keane and Heine Deelstra (*).

(*) Member of the Drupal security team.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

SA-CORE-2010-001 - Drupal core - Multiple vulnerabilities

Drupal Security Team — Wed, 03 Mar 2010 19:31:16 +0000

Advisory ID: DRUPAL-SA-CORE-2010-001
Project: Drupal core
Version: 5.x, 6.x
Date: 2010-March-03
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

Description

Multiple vulnerabilities and weaknesses were discovered in Drupal.

Installation cross site scripting

A user-supplied value is directly output during installation allowing a malicious user to craft a URL and perform a cross-site scripting attack. The exploit can only be conducted on sites not yet installed.

This issue affects Drupal 6.x only.

Open redirection

The API function drupal_goto() is susceptible to a phishing attack. An attacker could formulate a redirect in a way that gets the Drupal site to send the user to an arbitrarily provided URL. No user submitted data will be sent to that URL.

This issue affects Drupal 5.x and 6.x.

Locale module cross site scripting

Locale module and dependent contributed modules do not sanitize the display of language codes, native and English language names properly. While these usually come from a preselected list, arbitrary administrator input is allowed. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer languages' permission.

This issue affects Drupal 5.x and 6.x.

Blocked user session regeneration

Under certain circumstances, a user with an open session that is blocked can maintain his/her session on the Drupal site, despite being blocked.

This issue affects Drupal 5.x and 6.x.

Versions affected

Drupal 6.x before version 6.16.
Drupal 5.x before version 5.22.

Solution

Install the latest version:

If you are running Drupal 6.x then upgrade to Drupal 6.16.
If you are running Drupal 5.x then upgrade to Drupal 5.22.

Drupal 5 will no longer be maintained when Drupal 7 is released. Upgrading to Drupal 6 is recommended.

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. These patches fix the security vulnerabilities, but do not contain other fixes which were released in Drupal 6.16 or Drupal 5.22.

To patch Drupal 6.15 use SA-CORE-2010-001-6.15.patch.
To patch Drupal 5.21 use SA-CORE-2010-001-5.21.patch.

Reported by

The installation cross site scripting issue was reported by David Rothstein (*).
The open redirection was reported by Martin Barbella.
The locale module cross site scripting was reported by Justin Klein Keane.
The blocked user session regeneration issue was reported by Craig A. Hancock.

(*) Member of the Drupal security team.

Fixed by

The installation cross site scripting issue was fixed by Heine Deelstra.
The open redirection was fixed by Gerhard Killesreiter and Heine Deelstra.
The locale module cross site scripting was fixed by Stéphane Corlosquet, Peter Wolanin, Heine Deelstra and Neil Drumm.
The blocked user session regeneration issue was fixed by Gerhard Killesreiter.

All the fixes were done by members of the Drupal security team.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

SA-CORE-2009-009 - Drupal Core - Cross site scripting

Drupal Security Team — Wed, 16 Dec 2009 21:17:57 +0000

Advisory ID: DRUPAL-SA-CORE-2009-009
Project: Drupal core
Version: 5.x, 6.x
Date: 2009-December-16
Security risk: Not critical
Exploitable from: Remote
Vulnerability: Cross site scripting

Description

Multiple vulnerabilities were discovered in Drupal.

Contact category name cross-site scripting

The Contact module does not correctly handle certain user input when displaying category information. Users privileged to create contact categories can insert arbitrary HTML and script code into the contact module administration page. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS).

This issue affects Drupal 6.x and Drupal 5.x.

Menu description cross-site scripting

The Menu module does not correctly handle certain user input when displaying the menu administration overview. Users privileged to create new menus can insert arbitrary HTML and script code into the menu module administration page. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS).

This issue affects Drupal 6.x only.

Versions affected

Drupal 5.x before version 5.21.
Drupal 6.x before version 6.15.

Solution

Install the latest version:

If you are running Drupal 6.x then upgrade to Drupal 6.15.
If you are running Drupal 5.x then upgrade to Drupal 5.21.

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. Theses patches fix the security vulnerability, but do not contain other fixes which were released in Drupal 5.21 or Drupal 6.15.

To patch Drupal 6.14 use SA-CORE-2009-009-6.14.patch.
To patch Drupal 5.20 use SA-CORE-2009-009-5.20.patch.

Reported by

The contact category XSS issue was independently reported by mr.baileys and Justin Klein Keane.
The menu description XSS issue was reported by mr.baileys.

Fixed by

The contact category XSS issue was fixed by Justin Klein Keane and Dave Reid.
The menu description XSS issue was fixed by Gábor Hojtsy and Heine Deelstra.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

SA-CORE-2009-008 - Drupal core - Multiple vulnerabilities

Drupal Security Team — Wed, 16 Sep 2009 19:39:42 +0000

Advisory ID: DRUPAL-SA-CORE-2009-008
Project: Drupal core
Version: 5.x, 6.x
Date: 2009-September-16
Security risk: Critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

Description

Multiple vulnerabilities and weaknesses were discovered in Drupal.

OpenID association cross site request forgeries

The OpenID module in Drupal 6 allows users to create an account or log into a Drupal site using one or more OpenID identities.

The core OpenID module does not correctly implement Form API for the form that allows one to link user accounts with OpenID identifiers. A malicious user is therefore able to use cross site request forgeries to add attacker controlled OpenID identities to existing accounts. These OpenID identities can then be used to gain access to the affected accounts.

This issue affects Drupal 6.x only.

OpenID impersonation

The OpenID module is not a compliant implementation of the OpenID Authentication 2.0 specification. An implementation error allows a user to access the account of another user when they share the same OpenID 2.0 provider.

This issue affects Drupal 6.x only.

File upload

File uploads with certain extensions are not correctly processed by the File API. This may lead to the creation of files that are executable by Apache. The .htaccess that is saved into the files directory by Drupal should normally prevent execution. The files are only executable when the server is configured to ignore the directives in the .htaccess file.

This issue affects Drupal 6.x only.

Session fixation

Drupal doesn't regenerate the session ID when an anonymous user follows the one time login link used to confirm email addresses and reset forgotten passwords. This enables a malicious user to fix and reuse the session id of a victim under certain circumstances.

This issue affects Drupal 5.x only.

Versions affected

Drupal 6.x before version 6.14.
Drupal 5.x before version 5.20.

Solution

Install the latest version:

If you are running Drupal 6.x then upgrade to Drupal 6.14.
If you are running Drupal 5.x then upgrade to Drupal 5.20.

If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. Theses patches fix the security vulnerabilities, but do not contain other fixes which were released in Drupal 6.14 or Drupal 5.20.

To patch Drupal 6.13 use SA-CORE-2009-008-6.13.patch.
To patch Drupal 5.19 use SA-CORE-2009-008-5.19.patch.

Important note: Some users using OpenID might not be able to use the existing OpenID associations to login after the upgrade. These users should use the one time login via password recovery to get access to their user account and re-add desired associations. These users likely had issues with OpenID logins prior to the upgrade.

Reported by

The session fixation issue was reported by Noel Sharpe.
OpenID impersonation was reported by Robert Metcalf.
OpenID association CSRF was reported by Heine Deelstra (*).
The file upload issue was reported by Heine Deelstra (*).

(*) Member of the Drupal security team

Fixed by

The session fixation issue was fixed by Jakub Suchy.
The OpenID and file upload issues were fixed by Heine Deelstra.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

SA-CORE-2009-007 - Drupal core - Multiple vulnerabilities

Drupal Security Team — Wed, 01 Jul 2009 20:56:35 +0000

Advisory ID: DRUPAL-SA-CORE-2009-007
Project: Drupal core
Version: 5.x, 6.x
Date: 2009-July-1
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

Description

Multiple vulnerabilities and weaknesses were discovered in Drupal.

Cross-site scripting

The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages. Such a cross-site scripting attack may lead to the malicious user gaining administrative access. Wikipedia has more information about cross-site scripting (XSS).

This issue affects Drupal 6.x only.

Input format access bypass

User signatures have no separate input format, they use the format of the comment with which they are displayed. A user will no longer be able to edit a comment when an administrator changes the comment's input format to a format that is not accessible to the user. However they will still be able to modify their signature, which will then be processed by the new input format.

If the new format is very permissive, via their signature, the user may be able to insert arbitrary HTML and script code into pages or, when the PHP filter is enabled for the new format, execute PHP code.

This issue affects Drupal 6.x only.

Password leaked in URL

When an anonymous user fails to login due to mistyping his username or password, and the page he is on contains a sortable table, the (incorrect) username and password are included in links on the table. If the user visits these links the password may then be leaked to external sites via the HTTP referer.

In addition, if the anonymous user is enticed to visit the site via a specially crafted URL while the Drupal page cache is enabled, a malicious user might be able to retrieve the (incorrect) username and password from the page cache.

This issue affects both Drupal 5.x and Drupal 6.x

Versions affected

Drupal 5.x before version 5.19.
Drupal 6.x before version 6.13.

Solution

Install the latest version:

If you are running Drupal 6.x then upgrade to Drupal 6.13.
If you are running Drupal 5.x then upgrade to Drupal 5.19.

To patch Drupal 6.12 use SA-CORE-2009-007-6.12.patch.
To patch Drupal 5.18 use SA-CORE-2009-007-5.18.patch.

Reported by

The forum XSS issue was independently reported by Mark Piper of Catalyst IT Ltd, Sven Herrmann and Brandon Knight.
The user signature issue was reported by Gerhard Killesreiter of the Drupal security team.
The password in URL issue was reported by Sumit Datta.

Fixed by

The forum XSS issue was fixed by Heine Deelstra, Peter Wolanin and Charlie Gordon.
The user signature issue was fixed by David Rothstein, Charlie Gordon, Heine Deelstra and Gábor Hojtsy.
The password in URL issue was fixed by Damien Tournoud and Bart Jansens.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.