----------------------------------------------------------------------

Try a new way to discover vulnerabilities that ALREADY EXIST in your
IT infrastructure.

The Secunia NSI enables you to INSPECT, DISCOVER, and DOCUMENT
vulnerabilities in more than 4,700 different Windows applications.

Request your account, the Secunia Network Software Inspector (NSI):
http://secunia.com/network_software_inspector/

----------------------------------------------------------------------

TITLE:
Drupal Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA27292

VERIFY ADVISORY:
http://secunia.com/advisories/27292/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Cross Site Scripting

WHERE:
>From remote

SOFTWARE:
Drupal 4.x
http://secunia.com/product/342/
Drupal 5.x
http://secunia.com/product/13378/

DESCRIPTION:
Some vulnerabilities have been reported in Drupal, which can be
exploited by malicious people to conduct cross-site scripting attacks
and bypass certain security restrictions, and by malicious users to
conduct HTTP response splitting attacks.

1) Input passed to unspecified parameters is not properly sanitised
before being returned to the user. This can be exploited to insert
arbitrary HTTP headers, which is included in a response sent to the
user. This allows arbitrary HTML and script code to be executed in a
user's browser session in context of an affected site.

Successful exploitation of this vulnerability requires valid user
credentials.

2) The Upload module includes the ".html" file extension in its
default whitelist for file uploads. This can be exploited to upload
arbitrary HTML files and enticing users to visit them, thereby
executing arbitrary HTML and script code in a user's browser session
in context of an affected site.

3) The hook_components API operation does not pass the publication
status. This makes it possible for modules including Organic groups
and Subscriptions to send e-mail messages containing unpublished
comments.

The vulnerabilities are reported in the 4.7.x branch before 4.7.8 and
in the 5.x branch before 5.3.

SOLUTION:
Update to version 4.7.8 or 5.3. Reconfigure the Upload module to
disallow ".html" file uploads.

PROVIDED AND/OR DISCOVERED BY:
Drupal security team

ORIGINAL ADVISORY:
1) http://drupal.org/node/184315
2) http://drupal.org/node/184320
3) http://drupal.org/node/184354

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------