Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
By Dries on
- Advisory ID: DRUPAL-SA-2005-008
- Project: Drupal core
- Date: 2005-11-30
- Security risk: less critical
- Impact: normal
- Where: from remote
- Vulnerability: XSS, HTTP header injection
Description
Paul Laudanski informed us that it's possible to attach files that are able to run Javascript under Internet Explorer.
Further investigation of the problem revealed that the same method can be used to inject arbitrary HTTP headers.
Versions affected
Drupal 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5
Drupal 4.6.0, 4.6.1, 4.6.2, 4.6.3
Solution
- If you are running Drupal 4.5.x, then upgrade to Drupal 4.5.6.
- If you are running Drupal 4.6.x, then upgrade to Drupal 4.6.4.
- Upgrade to at least PHP 4.3.0 because the fix uses some PHP functionality which is available only since this version.
Contact
The security contact for Drupal can be reached at security at drupal.org or using the form at http://drupal.org/contact.
More information is available from http://drupal.org/security or from our security RSS feed http://drupal.org/security/rss.xml.
