WebKit before r41741, as used in Apple iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Safari, and other software, allows remote attackers to cause a denial of service (memory consumption or device reset) via a web page containing an HTMLSelectElement object with a large length attribute, related to the length property of a Select object. (CVSS:7.1) (Last Update:2012-03-30)
All posts by 007admin
CVE-2009-1699
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an “XXE attack.” (CVSS:7.1) (Last Update:2012-03-30)
CVE-2009-0950
Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an itms: URL with a long URL component after a colon. (CVSS:9.3) (Last Update:2013-11-02)
SA-CORE-2009-006 – Drupal core – Cross site scripting
- Advisory ID: DRUPAL-SA-CORE-2009-006
- Project: Drupal core
- Version: 5.x, 6.x
- Date: 2009-May-13
- Security risk: Moderately critical
- Exploitable from: Remote
- Vulnerability: Cross site scripting
Description
When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input.
Certain byte sequences that are valid in the UTF-8 specification are potentially dangerous when interpreted as UTF-7. Internet Explorer 6 and 7 may decode these characters as UTF-7 if they appear before the <meta http-equiv=”Content-Type” /> tag that specifies the page content as UTF-8, despite the fact that Drupal also sends a real HTTP header specifying the content as UTF-8. This enables attackers to execute cross site scripting attacks with UTF-7. SA-CORE-2009-005 – Drupal core – Cross site scripting contained an incomplete fix for the issue. HTML exports of books are still vulnerable, which means that anyone with edit permissions for pages in outlines is able to insert arbitrary HTML and script code in these exports.
Additionally, the taxonomy module allows users with the ‘administer taxonomy’ permission to inject arbitrary HTML and script code in the help text of any vocabulary.
Wikipedia has more information about cross site scripting (XSS).
Versions affected
- Drupal 5.x before version 5.18.
- Drupal 6.x before version 6.12.
Solution
Install the latest version:
- If you are running Drupal 6.x then upgrade to Drupal 6.12.
- If you are running Drupal 5.x then upgrade to Drupal 5.18.
If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. Theses patches fix the security vulnerability, but does not contain other fixes which were released in Drupal 5.18 or Drupal 6.12.
- To patch Drupal 6.11 use SA-CORE-2009-006-6.11.patch.
- To patch Drupal 5.17 use SA-CORE-2009-006-5.17.patch.
Reported by
The UTF-7 XSS issue in book-export-html.tpl.php was reported by Markus Petrux.
The XSS issue in taxonomy module was publicly disclosed.
Fixed by
Both issues were fixed by Heine Deelstra, Peter Wolanin and Derek Wright of the Drupal Security Team.
Contact
The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.
Drupal version:
CVE-2009-0010
Integer underflow in QuickDraw Manager in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7, and Apple QuickTime before 7.6.2, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PICT image with a crafted 0x77 Poly tag and a crafted length field, which triggers a heap-based buffer overflow. (CVSS:9.3) (Last Update:2009-06-04)
SA-CORE-2009-005 – Drupal core – Cross site scripting
- Advisory ID: DRUPAL-SA-CORE-2009-005
- Project: Drupal core
- Version: 5.x, 6.x
- Date: 2009-April-29
- Security risk: Moderately critical
- Exploitable from: Remote
- Vulnerability: Cross site scripting
Description
When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input.
Certain byte sequences that are valid in the UTF-8 specification are potentially dangerous when interpreted as UTF-7. Internet Explorer 6 and 7 may decode these characters as UTF-7 if they appear before the <meta http-equiv=”Content-Type” /> tag that specifies the page content as UTF-8, despite the fact that Drupal also sends a real HTTP header specifying the content as UTF-8. This behaviour enables malicious users to insert and execute Javascript in the context of the website if site visitors are allowed to post content.
Wikipedia has more information about cross site scripting (XSS).
In addition, Drupal core also has a very limited information disclosure vulnerability under very specific conditions. If a user is tricked into visiting the site via a specially crafted URL and then submits a form (such as the search box) from that page, the information in their form submission may be directed to a third-party site determined by the URL and thus disclosed to the third party. The third party site may then execute a CSRF attack against the submitted form.
This vulnerability is limited to forms present on the frontpage. The user login form is not vulnerable.
Versions affected
- Drupal 5.x before version 5.17.
- Drupal 6.x before version 6.11.
Solution
Install the latest version:
- If you are running Drupal 6.x then upgrade to Drupal 6.11.
- If you are running Drupal 5.x then upgrade to Drupal 5.17.
If you are unable to upgrade immediately, you can apply a patch to secure your installation until you are able to do a proper upgrade. Theses patches fix the security vulnerability, but does not contain other fixes which were released in Drupal 5.17 or Drupal 6.11.
- To patch Drupal 6.10 use SA-CORE-2009-005-6.10.patch.
- To patch Drupal 5.16 use SA-CORE-2009-005-5.16.patch.
As an alternate solution if you are unable to upgrade immediately, you can alter your page template following the pattern in the core changes. Open your theme’s main page.tpl.php file as well as any other page templates like page-node.tpl.php or page-front.tpl.php and move the line that is printing $head (<?php print $head ?>) above line with the <title> tag, so that it is the first item after the <head>.
Reported by
The UTF-7 XSS issue was reported by pod.Edge.
The information disclosure vulnerability was reported by Moritz Naumann.
Fixed by
The Drupal security team
Contact
The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.
Drupal version:
Critical Patch Update – January 2009
Critical Patch Update – April 2009
CVE-2009-1233
Apple Safari 3.2.2 and 4 Beta on Windows allows remote attackers to cause a denial of service (application crash) via an XML document containing many nested A elements. (CVSS:4.3) (Last Update:2010-08-21)
CVE-2009-1235
XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL handler, which allows local users to overwrite kernel memory and gain privileges by attaching an HFS+ disk image and performing certain steps involving HFS_GET_BOOT_INFO fcntl calls. (CVSS:7.2) (Last Update:2009-08-13)