=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2009/VULN180
_____________________________________________________________________

DATE                      : 14/05/2009

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Drupal core version 5.x, 6.x.

======================================================================
http://drupal.org/node/461886
______________________________________________________________________

SA-CORE-2009-006 - Drupal core - Cross site scripting
Drupal Security Team - May 13, 2009 - 19:47

    * Advisory ID: DRUPAL-SA-CORE-2009-006
    * Project: Drupal core
    * Version: 5.x, 6.x
    * Date: 2009-May-13
    * Security risk: Moderately critical
    * Exploitable from: Remote
    * Vulnerability: Cross site scripting

Description

When outputting user-supplied data Drupal strips potentially dangerous HTML
attributes and tags or escapes characters which have a special meaning in
HTML. This output filtering secures the site against cross site scripting
attacks via user input.

Certain byte sequences that are valid in the UTF-8 specification are
potentially dangerous when interpreted as UTF-7. Internet Explorer 6 and 7
may decode these characters as UTF-7 if they appear before the
<meta http-equiv="Content-Type" /> tag that specifies the page content as
UTF-8, despite the fact that Drupal also sends a real HTTP header specifying
the content as UTF-8. This enables attackers to execute cross site scripting
attacks with UTF-7. SA-CORE-2009-005 - Drupal core - Cross site scripting
contained an incomplete fix for the issue. HTML exports of books are still
vulnerable, which means that anyone with edit permissions for pages in outlines
is able to insert arbitrary HTML and script code in these exports.

Additionally, the taxonomy module allows users with the 'administer taxonomy'
permission to inject arbitrary HTML and script code in the help text of any
vocabulary.

Wikipedia has more information about cross site scripting (XSS).


Versions affected

    * Drupal 5.x before version 5.18.
    * Drupal 6.x before version 6.12.

Solution

Install the latest version:

    * If you are running Drupal 6.x then upgrade to Drupal 6.12.
    * If you are running Drupal 5.x then upgrade to Drupal 5.18.

If you are unable to upgrade immediately, you can apply a patch to secure your
installation until you are able to do a proper upgrade. Theses patches fix the
security vulnerability, but does not contain other fixes which were released in
Drupal 5.18 or Drupal 6.12.

    * To patch Drupal 6.11 use SA-CORE-2009-006-6.11.patch.
    * To patch Drupal 5.17 use SA-CORE-2009-006-5.17.patch.

Reported by

The UTF-7 XSS issue in book-export-html.tpl.php was reported by Markus Petrux.

The XSS issue in taxonomy module was publicly disclosed.


Fixed by

Both issues were fixed by Heine Deelstra, Peter Wolanin and Derek Wright of
the Drupal Security Team.


Contact

The security team for Drupal can be reached at security at drupal.org or via
the form at http://drupal.org/contact.


======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================