------------------------------------------------------------------------ ---- Drupal security advisory DRUPAL-SA-2006-007 ------------------------------------------------------------------------ ---- Advisory ID: DRUPAL-SA-2006-007 Project: Drupal core and any web app that allows user uploads Date: 2006-06-01 Security risk: highly critical Impact: Drupal core Where: from remote Vulnerability: Execution of arbitrary files ------------------------------------------------------------------------ ---- Description ----------- Recently, the Drupal security team was informed of a potential exploit that would allow untrusted code to be executed upon a successful request by a malicious user. If a dynamic script with multiple extensions such as file.php.pps or file.sh.txt is uploaded and then accessed from a web browser under certain common Apache configurations, it will cause the script inside to be executed. We deemed this exploit critical and released Drupal 4.6.7 and 4.7.1 six hours after the report was filed. The fix was to create a .htaccess file to remove all dynamic script handlers, such as PHP, from the "files" directory. After continuous review, however, we've found that the fix will not work in certain Apache configurations, for example those for whom .htaccess FileInfo overrides are disabled. We are thus releasing 4.6.8 and 4.7.2 with a more robust .htaccess fix, as well as a Drupal core solution to the issue which will work under all configurations. The new behavior of Drupal's upload.module is to rename all uploaded files with multiple, non-numeric, and non-whitelisted extensions by any other user than the administrator. For example: file.php.pps this is a long file.name.txt becomes: file.php_.pps this is a long file.name_.txt Please note that the particular Apache configurations under which this exploit is possible will affect ANY web application on the server which allows uploads to web-accessible directories, not just Drupal. The Drupal security team has also contacted other projects, such as WordPress, about this issue and new versions of their software have either already been released, or are forthcoming. 4.7.2 also fixes a potential XSS bug with upload.module. Versions affected ----------------- All Drupal versions before 4.6.8 and before Drupal 4.7.2. Solution -------- If you are running Drupal 4.6.x then upgrade to Drupal 4.6.8. If you are running Drupal 4.7.x then upgrade to Drupal 4.7.2. To patch Drupal 4.6.7 use the http://drupal.org/files/sa-2006-007/4.6.7.patch. To patch Drupal 4.7.1 use the http://drupal.org/files/sa-2006-007/4.7.1.patch. Reported By ----------- DRUPAL-SA-2006-06 issue: Lourens Veen XSS vulnerability in upload.module: Karoly Negyesi Contact ------- The security contact for Drupal can be reached at security (at) drupal (dot) org [email concealed] or using the form at http://drupal.org/contact. More information is available from http://drupal.org/security or from our security RSS feed http://drupal.org/security/rss.xml. // Uwe Hermann, on behalf of the Drupal Security Team. -- Uwe Hermann http://www.hermann-uwe.de http://www.it-services-uh.de | http://www.crazy-hacks.org http://www.holsham-traders.de | http://www.unmaintained-free-software.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) iD8DBQFEgIQNXdVoV3jWIbQRAstHAJ9PMxtugAAva8Y0bzVsMLwPt2dvMgCgmpNu riE7zOpF43DMBdF+DLssXbc= =p4bh -----END PGP SIGNATURE-----