[Sysadmin] [Security announcements] XSS and HTTP header injection vulnerability with uploaded files

[Drupal Security Team]

------------XSS AND HTTP HEADER INJECTION VULNERABILITY WITH UPLOADED
FILES------------

  * Advisory ID: DRUPAL-SA-2005-008

  * Project: Drupal core

  * Date: 2005-11-30

  * Security risk: less critical

  * Impact: normal

  * Where: from remote

  * Vulnerability: XSS, HTTP header injection

------------DESCRIPTION------------

Paul Laudanski informed us that it's possible to attach files that are able to
run Javascript under Internet Explorer.

Further investigation of the problem revealed that the same method can be used
to inject arbitrary HTTP headers.

------------VERSIONS AFFECTED------------

Drupal 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5
Drupal 4.6.0, 4.6.1, 4.6.2, 4.6.3

------------SOLUTION------------

  * If you are running Drupal 4.5.x, then upgrade to Drupal 4.5.6.

  * If you are running Drupal 4.6.x, then upgrade to Drupal 4.6.4.

  * Upgrade to at least PHP 4.3.0 because the fix uses some PHP functionality
which is available only since this version.

------------CONTACT------------

The security contact for Drupal can be reached at security at drupal.org or
using the form at http://drupal.org/contact.
More information is available from http://drupal.org/security or from our
security RSS feed http://drupal.org/security/rss.xml.



--
Unsubscribe from this newsletter: http://drupal.org/newsletter/confirm/remove/9c03cd30a33509t44