Here is updated information on the bug. The problem takes more work to fix than first reported.
------------REVISION TO DRUPAL-SA-2006-006------------ * Advisory ID: DRUPAL-SA-2006-007 * Project: Drupal core and potentially any web application that accepts uploads. * Date: 2006-Jun-01 * Security risk: highly critical * Impact: Drupal core * Exploitable from: remote * Vulnerability: Execution of arbitrary files ------------DESCRIPTION------------ Recently, the Drupal security team was informed of a potential exploit that would allow untrusted code to be executed upon a successful request by a malicious user. If a dynamic script with multiple extensions such as file.php.pps or file.sh.txt is uploaded and then accessed from a web browser under certain common Apache configurations, it will cause the script inside to be executed. We deemed this exploit critical and released Drupal 4.6.7 and 4.7.1 six hours after the report was filed. The fix was to create a .htaccess file to remove /all/ dynamic script handlers, such as PHP, from the "files" directory. After continuous review, however, we've found that the fix will not work in certain Apache configurations, for example those for whom .htaccess FileInfo overrides are disabled. We are thus releasing 4.6.8 and 4.7.2 with a more robust .htaccess fix, as well as a Drupal core solution to the issue which will work under all configurations. The new behavior of Drupal's upload.module is to rename all uploaded files with multiple, non-numeric, and non-whitelisted extensions by any other user than the administrator. For example: file.php.pps this is a long file.name.txt becomes: file.php_.pps this is a long file.name_.txt *Please note that the particular Apache configurations under which this exploit is possible will affect ANY web application on the server which allows uploads to web-accessible directories, not just Drupal.* The Drupal security team has also contacted other projects, such as WordPress, about this issue and new versions of their software have either already been released, or are forthcoming. 4.7.2 also fixes a potential XSS bug with upload.module. ------------VERSIONS AFFECTED------------ - All Drupal versions before 4.6.8 and before Drupal 4.7.2. ------------SOLUTION------------ If you are running Drupal 4.6.x then upgrade to Drupal 4.6.8 [http://ftp.osuosl.org/pub/drupal/files/projects/drupal-4.6.8.tar.gz]. If you are running Drupal 4.7.x then upgrade to Drupal 4.7.2 [http://ftp.osuosl.org/pub/drupal/files/projects/drupal-4.7.2.tar.gz]. To patch Drupal 4.6.7 use the http://drupal.org/files/sa-2006-007/4.6.7.patch [http://drupal.org//files/sa-2006-007/4.6.7.patch]. To patch Drupal 4.7.1 use the http://drupal.org/files/sa-2006-007/4.7.1.patch [http://drupal.org//files/sa-2006-007/4.7.1.patch]. ------------REPORTED BY------------ DRUPAL-SA-2006-06 issue: Lourens Veen XSS vulnerability in upload.module: Karoly Negyesi ------------CONTACT------------ The security contact for Drupal can be reached at security at drupal.org or using the form at [http://drupal.org/contact]. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
