Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows remote attackers to inject arbitrary web script or HTML via crafted UTF-8 byte sequences before the Content-Type meta tag, which are treated as UTF-7 by Internet Explorer 6 and 7.

Multiple vulnerabilities have been discovered in drupal, a web content management system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1575     pod.Edge discovered a cross-site scripting vulnerability     due that can be triggered when some browsers interpret     UTF-8 strings as UTF-7 if they appear before the     generated HTML document defines its Content-Type. This     allows a malicious user to execute arbitrary JavaScript     in the context of the website if they're allowed to post     content.

  - CVE-2009-1576     Moritz Naumann discovered an information disclosure     vulnerability. If a user is tricked into visiting the     site via a specially crafted URL and then submits a form     (such as the search box) from that page, the information     in their form submission may be directed to a     third-party site determined by the URL and thus     disclosed to the third-party. The third-party site may     then execute a cross-site request forgery attack against     the submitted form.

6.11, Fix for SA-CORE-2009-005. See http://drupal.org/node/449078 for more information. Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Drupal Security Team reports :

When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input.

Certain byte sequences that are valid in the UTF-8 specification are potentially dangerous when interpreted as UTF-7. Internet Explorer 6 and 7 may decode these characters as UTF-7 if they appear before the meta http-equiv='Content-Type' tag that specifies the page content as UTF-8, despite the fact that Drupal also sends a real HTTP header specifying the content as UTF-8. This behaviour enables malicious users to insert and execute JavaScript in the context of the website if site visitors are allowed to post content.

In addition, Drupal core also has a very limited information disclosure vulnerability under very specific conditions. If a user is tricked into visiting the site via a specially crafted URL and then submits a form (such as the search box) from that page, the information in their form submission may be directed to a third-party site determined by the URL and thus disclosed to the third party. The third party site may then execute a CSRF attack against the submitted form.

ID	Name	Product	Family	Severity
38702	Debian DSA-1792-1 : drupal6 - multiple vulnerabilities	Nessus	Debian Local Security Checks	medium
38676	Fedora 9 : drupal-6.11-1.fc9 (2009-4203)	Nessus	Fedora Local Security Checks	medium
38675	Fedora 10 : drupal-6.11-1.fc10 (2009-4175)	Nessus	Fedora Local Security Checks	medium
38657	FreeBSD : drupal -- XSS (7a1ab8d4-35c1-11de-9672-0030843d3802)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2009-1575

medium

Tenable Plugins

medium

medium

medium

medium