Drupal Multiple Vulnerabilities

[TCH-Thomas]

From Secunia

 

Description:

Some vulnerabilities have been reported in Drupal, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting and session fixation attacks, and manipulate outgoing mails.

 

1) The problem is that when using "menu.module" to create a menu item then the referenced page will be accessible by everyone (e.g. admin pages).

 

2) Some unspecified input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

 

3) An error in the handling of sessions during login can be exploited to hijack another user's session by tricking the user into logging in after following a specially crafted link.

 

4) Some unspecified input isn't properly sanitised before being used in mail headers. This can be exploited to inject arbitrary headers in outgoing mails.

 

The vulnerabilities have been reported in versions prior to 4.5.8 and 4.6.6.

 

Solution:

Update to version 4.5.8 or 4.6.6, or later.

http://drupal.org/project

[TCH-Bruce]

Thanks Thomas

[TCH-Don]

Thanks Thomas

[TCH-Rob]

Thanks Thomas