- Advisory ID: DRUPAL-SA-CORE-2011-001
- Project: Drupal core
- Version: 6.x, 7.x
- Date: 2011-May-25
- Security risk: Critical
- Exploitable from: Remote
- Vulnerability: Access bypass, Cross Site Scripting
Description
CVE: CVE-2011-2687
Multiple vulnerabilities and weaknesses were discovered in Drupal.
Reflected cross site scripting vulnerability in error handler
A reflected cross site scripting vulnerability was discovered in Drupal’s error handler. Drupal displays PHP errors in the messages area, and a specially crafted URL can cause malicious scripts to be injected into the message. The issue can be mitigated by disabling on-screen error display at admin/settings/error-reporting. This is the recommended setting for production sites.
This issue affects Drupal 6.x only.
Cross site scripting vulnerability in Color module
When using re-colorable themes, color inputs are not sanitized. Malicious color values can be used to insert arbitrary CSS and script code. Successful exploitation requires the “Administer themes” permission.
This issue affects Drupal 6.x and 7.x.
Access bypass in File module
When using private files in combination with a node access module, the File module allows unrestricted access to private files.
This issue affects Drupal 7.x only.
Versions affected
- Drupal 7.x before version 7.1.
- Drupal 6.x before version 6.21.
Solution
Install the latest version:
- If you are running Drupal 7.x then upgrade to Drupal 7.1 or 7.2.
- If you are running Drupal 6.x then upgrade to Drupal 6.21 or 6.22.
The Security Team has released both a pure security update without other bug fixes and a security update combined with other bug fixes and improvements. You can choose to either only include the security update for an immediate fix (which might require less quality assurance and testing) or more fixes and improvements alongside the security fixes by choosing between Drupal 7.1 and Drupal 7.2 or Drupal 6.21 and Drupal 6.22.
See the release announcement for more information.
See also the Drupal core project page.
Reported by
- The reflected cross site scripting vulnerability was reported by Heine Deelstra (*).
- The Color module cross site scripting vulnerability was reported by Kasper Lindgaard, Secunia Research.
- The File access bypass was reported by Hubert Lecorche, and Peter Bex.
Fixed by
(*) Member of the Drupal security team.
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a crafted URL, as demonstrated by the file:///etc/passwd and file:///dev/zero URLs. (CVSS:6.4) (Last Update:2014-02-20)
The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419. (CVSS:4.3) (Last Update:2012-10-29)
Apache HTTP Server 2.2.19 Released
The Apache Software Foundation and the Apache HTTP Server Project are
pleased to announce the release of version 2.2.19 of the Apache HTTP
Server ("Apache"). This version of Apache is principally a bug fix
release, correcting regressions in the httpd 2.2.18 package; the use
of that previous 2.2.18 package is discouraged due to these flaws:
* SECURITY: CVE-2011-1928 (cve.mitre.org)
A fix in bundled APR 1.4.4 apr_fnmatch() to address CVE-2011-0419
introduced a new vulnerability. httpd workers enter a hung state
(100% cpu utilization) after updating to APR 1.4.4. Upgrading to
APR 1.4.5 bundled with the httpd 2.2.19 package, or using APR 1.4.3
or prior with the 'IgnoreClient' option of the 'IndexOptions'
directive will circumvent both issues.
* httpd 2.2.18: The ap_unescape_url_keep2f() function signature was
inadvertantly changed. This breaks binary compatibility of a number
of third-party modules. This httpd-2.2.19 package restores the
function signature provided by 2.2.17 and prior.
We consider this release to be the best version of Apache available, and
encourage users of all prior versions to upgrade.
Apache HTTP Server 2.2.19 is available for download from:
http://httpd.apache.org/download.cgi
Please see the CHANGES_2.2 file, linked from the download page, for a
full list of changes. A condensed list, CHANGES_2.2.19 provides the
complete list of changes since 2.2.18. A summary of all of the security
vulnerabilities addressed in this and earlier releases is available:
http://httpd.apache.org/security/vulnerabilities_22.html
This release includes the Apache Portable Runtime (APR) version 1.4.5
and APR Utility Library (APR-util) version 1.3.12, bundled with the tar
and zip distributions. The APR libraries libapr and libaprutil (and
on Win32, libapriconv version 1.2.1) must all be updated to ensure
binary compatibility and address many known security and platform bugs.
Apache 2.2 offers numerous enhancements, improvements, and performance
boosts over the 2.0 codebase. For an overview of new features
introduced since 2.0 please see:
http://httpd.apache.org/docs/2.2/new_features_2_2.html
This release builds on and extends the Apache 2.0 API. Modules written
for Apache 2.0 will need to be recompiled in order to run with Apache
2.2, and require minimal or no source code changes.
http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/VERSIONING
When upgrading or installing this version of Apache, please bear in mind
that if you intend to use Apache with one of the threaded MPMs (other
than the Prefork MPM), you must ensure that any modules you will be
using (and the libraries they depend on) are thread-safe.
New releases are in progress for each of these projects and are
expected to be available in the coming days. The upcoming httpd
2.2.19 will bundle new releases of apr and apr-util which correct
the regressions described below. An announcement of these releases
will be broadcast.
Note: httpd 2.2.18 bundles apr 1.4.4 and apr-util 1.3.11.
Summary of regressions:
httpd 2.2.18: The ap_unescape_url_keep2f() function signature was changed.
This breaks binary compatibility of a number of third-party modules. In
addition, a regression in apr 1.4.4 (see below) could cause httpd to hang.
apr 1.4.4: A fix in apr 1.4.4 apr_fnmatch() to address CVE-2011-0419
introduced a new vulnerability. A patch is attached and should be used
if httpd workers enter a hung state (100% cpu utilization) after updating
to httpd 2.2.18 or apr-util 1.4.4, or if hangs are seen in other apr
applications which use apr_fnmatch().
apr-util 1.3.11: A fix to LDAP support in apr-util 1.3.11 could cause
crashes with httpd's mod_authnz_ldap in some situations.
Perl 5.10.x allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an ability to inject arguments into a (1) getpeername, (2) readdir, (3) closedir, (4) getsockname, (5) rewinddir, (6) tell, or (7) telldir function call. (CVSS:5.0) (Last Update:2011-09-21)
Apache HTTP Server 2.2.18 Released
The Apache Software Foundation and the Apache HTTP Server Project are
pleased to announce the release of version 2.2.18 of the Apache HTTP
Server ("Apache"). This version of Apache is principally a bug fix
release, and a security fix release of the APR 1.4.4 dependency;
* SECURITY: CVE-2011-0419 (cve.mitre.org)
apr_fnmatch flaw leads to mod_autoindex remote DoS
Where mod_autoindex is enabled, and a directory indexed by
mod_autoindex contained files with sufficiently long names,
a carefully crafted request may cause excessive CPU usage
Upgrading to APR 1.4.4, or setting the 'IgnoreClient' option
of the 'IndexOptions' directive circumvents this risk.
We consider this release to be the best version of Apache available, and
encourage users of all prior versions to upgrade.
Apache HTTP Server 2.2.18 is available for download from:
http://httpd.apache.org/download.cgi
Please see the CHANGES_2.2 file, linked from the download page, for a
full list of changes. A condensed list, CHANGES_2.2.18 provides the
complete list of changes since 2.2.17. A summary of all of the security
vulnerabilities addressed in this and earlier releases is available:
http://httpd.apache.org/security/vulnerabilities_22.html
This release includes the Apache Portable Runtime (APR) version 1.4.4
and APR Utility Library (APR-util) version 1.3.11, bundled with the tar
and zip distributions. The APR libraries libapr and libaprutil (and
on Win32, libapriconv version 1.2.1) must all be updated to ensure
binary compatibility and address many known security and platform bugs.
Apache 2.2 offers numerous enhancements, improvements, and performance
boosts over the 2.0 codebase. For an overview of new features
introduced since 2.0 please see:
http://httpd.apache.org/docs/2.2/new_features_2_2.html
This release builds on and extends the Apache 2.0 API. Modules written
for Apache 2.0 will need to be recompiled in order to run with Apache
2.2, and require minimal or no source code changes.
http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/VERSIONING
When upgrading or installing this version of Apache, please bear in mind
that if you intend to use Apache with one of the threaded MPMs (other
than the Prefork MPM), you must ensure that any modules you will be
using (and the libraries they depend on) are thread-safe.
WatchGuard XTM 2050 Designed Specifically for Large Corporate Customers and Managed Security Service Providers; Enhances LiveSecurity Service with 4-Hour Hardware Replacement
The is_cgi method in CGIHTTPServer.py in the CGIHTTPServer module in Python 2.5, 2.6, and 3.0 allows remote attackers to read script source code via an HTTP GET request that lacks a / (slash) character at the beginning of the URI. (CVSS:5.0) (Last Update:2013-05-14)
Cross-site scripting (XSS) vulnerability in statusmap.c in statusmap.cgi in Nagios 3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the layer parameter. (CVSS:4.3) (Last Update:2011-09-21)
Software and Security Information
