Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) delete user access rules.

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXBA:2008-316:03 advisory.

  - Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote     attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1)     cached forms and (2) forms with AHAH elements. (CVE-2008-3743)

  - Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4     allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2)     delete user access rules. (CVE-2008-3744)

  - Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to     inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not     properly handled on node preview pages, and (2) unspecified OpenID values. (CVE-2008-3218)

  - Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote     attackers to perform administrative actions via vectors involving deletion of translated strings.
    (CVE-2008-3220)

  - Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to     perform administrative actions via vectors involving deletion of OpenID identities. (CVE-2008-3221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2008-285:02 advisory.

    Drupal is a free CMS (Content Management System) software package that allows an individual or a community     of users to easily publish, manage and organize a wide variety of content on a website.
    This update addresses the following problems:
    CVE-2008-3743     Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote     attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1)     cached forms and (2) forms with AHAH elements.
    CVE-2008-3744     Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4     allow remote attackers to (1) add or (2) delete user access rules as administrators via an unspecified     URL.
    CVE-2008-3218     Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to     inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not     properly handled on node preview pages, and (2) unspecified OpenID values.
    CVE-2008-3220     Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote     attackers to perform administrative actions via vectors involving deletion of translated strings.
    CVE-2008-3221     Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to     perform administrative actions via vectors involving deletion of OpenID identities.
    CVE-2008-3222     Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules     terminate the current request during a login event

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 6.4, security fixes: SA-2008-047 (http://drupal.org/node/295053) - multiple XSS issues (CVE-2008-3740, CVE-2008-3741) - unrestricted upload vulnerability (CVE-2008-3742) - multiple CSRF issues (CVE-2008-3743, CVE-2008-3744) - upload module privilege escalation (CVE-2008-3745) Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 5.10, security fixes: SA-2008-047 (http://drupal.org/node/295053)

  - multiple XSS issues (CVE-2008-3740, CVE-2008-3741) -     unrestricted upload vulnerability (CVE-2008-3742) -     multiple CSRF issues (CVE-2008-3744) Remember to log in     to your site as the admin user before upgrading this     package. After upgrading the package, browse to     http://host/drupal/update.php to run the upgrade script.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Drupal Project reports :

A bug in the output filter employed by Drupal makes it possible for malicious users to insert script code into pages (cross site scripting or XSS). A bug in the private filesystem trusts the MIME type sent by the browser, enabling malicious users with the ability to upload files to execute cross site scripting attacks.

The BlogAPI module does not validate the extension of uploaded files, enabling users with the 'administer content with blog api' permission to upload harmful files. This bug affects both Drupal 5.x and 6.x.

Drupal forms contain a token to protect against cross site request forgeries (CSRF). The token may not be validated properly for cached forms and forms containing AHAH elements. This bug affects Drupal 6.x.

User access rules can be added or deleted upon accessing a properly formatted URL, making such modifications vulnerable to cross site request forgeries (CSRF). This may lead to unintended addition or deletion of an access rule when a sufficiently privileged user visits a page or site created by a malicious person. This bug affects both Drupal 5.x and 6.x.

The Upload module in Drupal 6 contains privilege escalation vulnerabilities for users with the 'upload files' permission. This can lead to users being able to edit nodes which they are normally not allowed to, delete any file to which the webserver has sufficient rights, and download attachments of nodes to which they have no access. Harmful files may also be uploaded via cross site request forgeries (CSRF). These bugs affect Drupal 6.x.

ID	Name	Product	Family	Severity
291396	MiracleLinux 3 : drupal-6.4-3AXS3 (AXBA:2008-316:03)	Nessus	Miracle Linux Local Security Checks	medium
284040	MiracleLinux 3 : drupal-6.4-1AXS3 (AXSA:2008-285:02)	Nessus	Miracle Linux Local Security Checks	medium
34138	Fedora 9 : drupal-6.4-1.fc9 (2008-7626)	Nessus	Fedora Local Security Checks	medium
34132	Fedora 8 : drupal-5.10-1.fc8 (2008-7467)	Nessus	Fedora Local Security Checks	medium
33935	FreeBSD : drupal -- multiple vulnerabilities (070b5b22-6d74-11dd-aa18-0030843d3802)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2008-3744

high

Tenable Plugins

medium

medium

medium

medium

medium