--7CZp05NP8/gJM8Cl
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

----------------------------------------------------------------------------
Drupal security advisory DRUPAL-SA-2006-025
----------------------------------------------------------------------------
Project: Drupal core
Date: 2006-Oct-18
Security risk: Highly critical
Exploitable from: Remote
Vulnerability: Cross site request forgeries
----------------------------------------------------------------------------
=20
Description
-----------
Visiting a specially crafted page, anywhere on the web, may allow that page=
=20
to post forms to a Drupal site in the context of the visitor's session.=20
To illustrate; suppose one has an active user 1 session, the most powerful=
=20
administrator account for a site, to a Drupal site while visiting a website=
=20
created by an attacker. This website will now be able to submit any form to=
=20
the Drupal site with the privileges of user 1, either by enticing the user =
to=20
submit a form or by automated means.

An attacker can exploit this vulnerability by changing passwords, posting P=
HP=20
code or creating new users, for example. The attack is only limited by the=
=20
privileges of the session it executes in.

Versions affected
-----------------
- Drupal 4.6.x versions before Drupal 4.6.10
- Drupal 4.7.x versions before Drupal 4.7.4

Solution
--------
- If you are running Drupal 4.6.x then upgrade to Drupal 4.6.10.
http://ftp.osuosl.org/pub/drupal/fil...-4.6.10.tar.gz
- If you are running Drupal 4.7.x then upgrade to Drupal 4.7.4.
http://ftp.osuosl.org/pub/drupal/fil...l-4.7.4.tar.gz

- To patch Drupal 4.6.9 use http://drupal.org/files/sa-2006-025/4.6.9.patch.
- To patch Drupal 4.7.3 use http://drupal.org/files/sa-2006-025/4.7.3.patch.

Please note that the patches only contain changes related to this advisory,=
and=20
do not fix bugs that were solved in 4.6.10 or 4.7.4.

Important note for Drupal 4.6.10
--------------------------------
Any custom forms that do not use the proper form API functions, such as raw=
HTML=20
forms, will break for authenticated users and need to be updated. The easie=
st=20
way to do so is to add the output of form_token() before the closing form t=
ag.=20
For phptemplate themes, add the following code before the closing form tag:
<?php print form_token() ?>
A number of modules and themes generate raw HTML forms. Check the list of=
=20
modules and themes, to see if that is an issue for your site.
We advise you test modules and themes in use before committing to an upgrad=
e.

Important note for Drupal 4.7.4
-------------------------------
Drupal 4.7.4 adds a new form field to all forms. Contributed modules and th=
emes=20
that assume only specific, known form fields to be present, may break on=20
Drupal 4.7.4.

We advise you test modules and themes in use before committing to an upgrad=
e.

Reported by
-----------
Garvin Hicking.

Contact
-------
The security contact for Drupal can be reached at security at drupal.org or=
=20
using the form at http://drupal.org/contact.


// Uwe Hermann, on behalf of the Drupal Security Team.
--=20
Uwe Hermann=20
http://www.hermann-uwe.de
http://www.it-services-uh.de | http://www.crazy-hacks.org=20
http://www.holsham-traders.de | http://www.unmaintained-free-software.org

--7CZp05NP8/gJM8Cl
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFN7D0XdVoV3jWIbQRAi9gAJ9sGhKLk1dZbc1gPec9r0 AdDk40LQCbBIIW
hESYAmvWkPSRf5THS5F1qz8=
=9D02
-----END PGP SIGNATURE-----

--7CZp05NP8/gJM8Cl--