Drupal 6.10 and 5.16, maintenance releases fixing problems reported using the bug tracking system, as well as a critical security vulnerability, are now available for download.
Drupal 5.16 and 6.10 were released in response to the discovery of a security vulnerability. Details can be found in the official security advisories:
SA-CORE-2009-003
* Advisory ID: DRUPAL-SA-CORE-2009-003
* Project: Drupal core
* Versions: 6.x
* Date: 2009-February-25
* Security risk: Highly Critical
* Exploitable from: Remote
* Vulnerability: Local file inclusion on Windows
Description
This vulnerability exists on Windows, regardless of the type of webserver (Apache, IIS) used.
The Drupal theme system takes URL arguments into account when selecting a template file to use for page rendering. While doing so, it doesn't take into account how Windows arrives at a canonicalized path. This enables malicious users to include files, readable by the webserver and located on the same volume as Drupal, and to execute PHP contained within those files. For example: If a site has uploads enabled, an attacker may upload a file containing PHP code and cause it to be included on a subsequent request by manipulating the URL used to access the site.
Important note: An attacker may also be able to inject PHP code into webserver logs and subsequently include the log file, leading to code execution even if no upload functionality is enabled on the site.
Versions Affected: Drupal 6.x before version 6.10
SA-CORE-2009-004
* Advisory ID: DRUPAL-SA-CORE-2009-004
* Project: Drupal core
* Versions: 5.x
* Date: 2009-February-25
* Security risk: Highly Critical
* Exploitable from: Remote
* Vulnerability: Local file inclusion on Windows
* Reference: SA-CORE-2009-003 (6.x)
Description
This vulnerability exists on Windows, regardless of the type of webserver (Apache, IIS) used.
The Drupal theme system takes URL arguments into account when selecting a template file to use for page rendering. While doing so, it doesn't take into account how Windows arrives at a canonicalized path. This enables malicious users to include files, readable by the webserver and located on the same volume as Drupal, and to execute PHP contained within those files. For example: If a site has uploads enabled, an attacker may upload a file containing PHP code and cause it to be included on a subsequent request by manipulating the URL used to access the site.
Important note: An attacker may also be able to inject PHP code into webserver logs and subsequently include the log file, leading to code execution even if no upload functionality is enabled on the site.
Versions Affected: Drupal 5.x before version 5.16
It is very recommended to upgrade your Drupal installation by doing full upgrade.
No comments
Post new comment