Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors.

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXBA:2008-316:03 advisory.

  - Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote     attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1)     cached forms and (2) forms with AHAH elements. (CVE-2008-3743)

  - Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4     allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2)     delete user access rules. (CVE-2008-3744)

  - Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to     inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not     properly handled on node preview pages, and (2) unspecified OpenID values. (CVE-2008-3218)

  - Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote     attackers to perform administrative actions via vectors involving deletion of translated strings.
    (CVE-2008-3220)

  - Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to     perform administrative actions via vectors involving deletion of OpenID identities. (CVE-2008-3221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2008-285:02 advisory.

    Drupal is a free CMS (Content Management System) software package that allows an individual or a community     of users to easily publish, manage and organize a wide variety of content on a website.
    This update addresses the following problems:
    CVE-2008-3743     Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote     attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1)     cached forms and (2) forms with AHAH elements.
    CVE-2008-3744     Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4     allow remote attackers to (1) add or (2) delete user access rules as administrators via an unspecified     URL.
    CVE-2008-3218     Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to     inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not     properly handled on node preview pages, and (2) unspecified OpenID values.
    CVE-2008-3220     Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote     attackers to perform administrative actions via vectors involving deletion of translated strings.
    CVE-2008-3221     Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to     perform administrative actions via vectors involving deletion of OpenID identities.
    CVE-2008-3222     Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules     terminate the current request during a login event

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 5.9, security fixes: SA-2008-046 - http://drupal.org/node/286417 CVE-2008-3222 - session fixation issue, that was first reported to be fixed via SA-2008-044 in drupal 5.8, but the patch for it was not included in the 5.8 tarball. Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 6.3, security fixes: SA-2008-044 Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 5.8, security fixes: SA-2008-044 Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
291396	MiracleLinux 3 : drupal-6.4-3AXS3 (AXBA:2008-316:03)	Nessus	Miracle Linux Local Security Checks	medium
284040	MiracleLinux 3 : drupal-6.4-1AXS3 (AXSA:2008-285:02)	Nessus	Miracle Linux Local Security Checks	medium
33778	Fedora 8 : drupal-5.9-1.fc8 (2008-6916)	Nessus	Fedora Local Security Checks	high
33519	Fedora 9 : drupal-6.3-1.fc9 (2008-6415)	Nessus	Fedora Local Security Checks	high
33518	Fedora 8 : drupal-5.8-1.fc8 (2008-6411)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2008-3222

critical

Tenable Plugins

medium

medium

high

high

high