Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values.

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXBA:2008-316:03 advisory.

  - Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote     attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1)     cached forms and (2) forms with AHAH elements. (CVE-2008-3743)

  - Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4     allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2)     delete user access rules. (CVE-2008-3744)

  - Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to     inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not     properly handled on node preview pages, and (2) unspecified OpenID values. (CVE-2008-3218)

  - Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote     attackers to perform administrative actions via vectors involving deletion of translated strings.
    (CVE-2008-3220)

  - Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to     perform administrative actions via vectors involving deletion of OpenID identities. (CVE-2008-3221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2008-285:02 advisory.

    Drupal is a free CMS (Content Management System) software package that allows an individual or a community     of users to easily publish, manage and organize a wide variety of content on a website.
    This update addresses the following problems:
    CVE-2008-3743     Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote     attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1)     cached forms and (2) forms with AHAH elements.
    CVE-2008-3744     Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4     allow remote attackers to (1) add or (2) delete user access rules as administrators via an unspecified     URL.
    CVE-2008-3218     Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to     inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not     properly handled on node preview pages, and (2) unspecified OpenID values.
    CVE-2008-3220     Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote     attackers to perform administrative actions via vectors involving deletion of translated strings.
    CVE-2008-3221     Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to     perform administrative actions via vectors involving deletion of OpenID identities.
    CVE-2008-3222     Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules     terminate the current request during a login event

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 5.9, security fixes: SA-2008-046 - http://drupal.org/node/286417 CVE-2008-3222 - session fixation issue, that was first reported to be fixed via SA-2008-044 in drupal 5.8, but the patch for it was not included in the 5.8 tarball. Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 6.3, security fixes: SA-2008-044 Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 5.8, security fixes: SA-2008-044 Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Drupal Project reports :

Free tagging taxonomy terms can be used to insert arbitrary script and HTML code (cross site scripting or XSS) on node preview pages. A successful exploit requires that the victim selects a term containing script code and chooses to preview the node. This issue affects Drupal 6.x only. Some values from OpenID providers are output without being properly escaped, allowing malicious providers to insert arbitrary script and HTML code (XSS) into user pages. This issue affects Drupal 6.x only. filter_xss_admin() has been hardened to prevent use of the object HTML tag in administrator input.

Translated strings (5.x, 6.x) and OpenID identities (6.x) are immediately deleted upon accessing a properly formatted URL, making such deletion vulnerable to cross site request forgeries (CSRF). This may lead to unintended deletion of translated strings or OpenID identities when a sufficiently privileged user visits a page or site created by a malicious person.

When contributed modules such as Workflow NG terminate the current request during a login event, user module is not able to regenerate the user's session. This may lead to a session fixation attack, when a malicious user is able to control another users' initial session ID.
As the session is not regenerated, the malicious user may use the 'fixed' session ID after the victim authenticates and will have the same access. This issue affects both Drupal 5 and Drupal 6.

Schema API uses an inappropriate placeholder for 'numeric' fields enabling SQL injection when user-supplied data is used for such fields.This issue affects Drupal 6 only.

ID	Name	Product	Family	Severity
291396	MiracleLinux 3 : drupal-6.4-3AXS3 (AXBA:2008-316:03)	Nessus	Miracle Linux Local Security Checks	medium
284040	MiracleLinux 3 : drupal-6.4-1AXS3 (AXSA:2008-285:02)	Nessus	Miracle Linux Local Security Checks	medium
33778	Fedora 8 : drupal-5.9-1.fc8 (2008-6916)	Nessus	Fedora Local Security Checks	high
33519	Fedora 9 : drupal-6.3-1.fc9 (2008-6415)	Nessus	Fedora Local Security Checks	high
33518	Fedora 8 : drupal-5.8-1.fc8 (2008-6411)	Nessus	Fedora Local Security Checks	high
33493	FreeBSD : drupal -- multiple vulnerabilities (ecedde1c-5128-11dd-a4e1-0030843d3802)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2008-3218

medium

Tenable Plugins

medium

medium

high

high

high

medium