From 5a4888499cfdf9134815b5e2b297dd57ebae853a Mon Sep 17 00:00:00 2001 From: miwi Date: Tue, 22 Sep 2009 23:03:35 +0000 Subject: - Document drupal -- Multiple Vulnerabilities Submitted by: Nick Hillard (based on) Feature safe: yes --- security/vuxml/vuln.xml | 53 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 0ef1366f7081..5274d6abaa3b 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -35,6 +35,59 @@ Note: Please add new entries to the beginning of this file. --> + + drupal -- multiple vulnerabilities + + + drupal5 + 5.20 + + + drupal6 + 6.14 + + + + +

Drupal Team reports:

+
The core OpenID module does not correctly implement Form API for + the form that allows one to link user accounts with OpenID + identifiers. A malicious user is therefore able to use cross site + request forgeries to add attacker controlled OpenID identities to + existing accounts. These OpenID identities can then be used to gain + access to the affected accounts.
+
The OpenID module is not a compliant implementation of the OpenID + Authentication 2.0 specification. An implementation error allows a + user to access the account of another user when they share the same + OpenID 2.0 provider.
+
File uploads with certain extensions are not correctly processed by + the File API. This may lead to the creation of files that are + executable by Apache. The .htaccess that is saved into the files + directory by Drupal should normally prevent execution. The files are + only executable when the server is configured to ignore the directives + in the .htaccess file.
+
Drupal doesn't regenerate the session ID when an anonymous user + follows the one time login link used to confirm email addresses and + reset forgotten passwords. This enables a malicious user to fix and + reuse the session id of a victim under certain circumstances.
+

+ + + + http://drupal.org/node/579482 + http://secunia.com/advisories/36787/ + http://secunia.com/advisories/36786/ + http://secunia.com/advisories/36781/ + http://secunia.com/advisories/36776/ + http://secunia.com/advisories/36785/ + + + 2009-09-17 + 2009-09-22 + + + fwbuilder -- security issue in temporary file handling -- cgit