--sXc4Kmr5FA7axrvy
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

----------------------------------------------------------------------------
Drupal security advisory DRUPAL-SA-2006-024
----------------------------------------------------------------------------
Project: Drupal core
Date: 2006-Oct-18
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Cross site scripting
----------------------------------------------------------------------------
=20
Description
-----------
Multiple XSS (cross site scripting) vulnerabilities have been discovered.

A bug in input validation and lack of output validation allows HTML and scr=
ipt=20
insertion on several pages.

Drupal's XML parser passes unescaped data to watchdog under certain=20
circumstances. A malicious user may execute an XSS attack via a specially=
=20
crafted RSS feed. This vulnerability exists on systems that do not use PHP'=
s=20
mb_string extension (to check if mb_string is being used, navigate to=20
admin/settings and look under "String handling"). Disabling the aggregator=
=20
module provides an immediate workaround.

The aggregator module, profile module, and forum module do not properly esc=
ape=20
output of certain fields.

Note: XSS attacks may lead to administrator access if certain conditions ar=
e=20
met.
=20
=20
Versions affected
-----------------
- Drupal 4.6.x versions before Drupal 4.6.10
- Drupal 4.7.x versions before Drupal 4.7.4

Solution
--------
- If you are running Drupal 4.6.x then upgrade to Drupal 4.6.10.
http://ftp.osuosl.org/pub/drupal/fil...-4.6.10.tar.gz
- If you are running Drupal 4.7.x then upgrade to Drupal 4.7.4.
http://ftp.osuosl.org/pub/drupal/fil...l-4.7.4.tar.gz

- To patch Drupal 4.6.9 use http://drupal.org/files/sa-2006-024/4.6.9.patch.
- To patch Drupal 4.7.3 use http://drupal.org/files/sa-2006-024/4.7.3.patch.

Please note that the patches only contain changes related to this advisory,=
and=20
do not fix bugs that were solved in 4.6.10 or 4.7.4.

Reported by
-----------
- The XML parser vulnerability was reported by Erdem K=F6se.
- The forum module vulnerability was reported by Jim Phlew.
- The other vulnerabilities were found by members of the Drupal security te=
am.

Contact
-------
The security contact for Drupal can be reached at security at drupal.org or=
=20
using the form at http://drupal.org/contact.


// Uwe Hermann, on behalf of the Drupal Security Team.
--=20
Uwe Hermann=20
http://www.hermann-uwe.de
http://www.it-services-uh.de | http://www.crazy-hacks.org=20
http://www.holsham-traders.de | http://www.unmaintained-free-software.org

--sXc4Kmr5FA7axrvy
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFN7DxXdVoV3jWIbQRAm5IAJ0UmC80/DpS0I2WM8q9nPmxZdjtHQCeMiVP
jFhf+0xpVQz/7pXwh71hOAo=
=5y6Z
-----END PGP SIGNATURE-----

--sXc4Kmr5FA7axrvy--