Executive Summary
| Summary | |
|---|---|
| Title | New drupal packages fix execution of arbitrary web script code (revised packages) |
| Informations | |||
|---|---|---|---|
| Name | DSA-1125 | First vendor Publication | 2006-07-26 |
| Vendor | Debian | Last vendor Modification | 2006-07-27 |
| Severity (Vendor) | N/A | Revision | 2 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The Drupal update in DSA 1125 contained a regression. This update corrects this flaw. For completeness, the original advisory text below: Several remote vulnerabilities have been discovered in the Drupal web site platform, which may lead to the execution of arbitrary web script. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2006-2742 A SQL injection vulnerability has been discovered in the "count" and "from" variables of the database interface. CVE-2006-2743 Multiple file extensions were handled incorrectly if Drupal ran on Apache with mod_mime enabled. CVE-2006-2831 A variation of CVE-2006-2743 was adressed as well. CVE-2006-2832 A Cross-Site-Scripting vulnerability in the upload module has been discovered. CVE-2006-2833 A Cross-Site-Scripting vulnerability in the taxonomy module has been discovered. For the stable distribution (sarge) these problems have been fixed in version 4.5.3-6.1sarge2. For the unstable distribution (sid) these problems have been fixed in version 4.5.8-1.1. We recommend that you upgrade your drupal packages. |
Original Source
| Url : http://www.debian.org/security/2006/dsa-1125 |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-04-09 | Name : Mandriva Update for madwifi-source MDKSA-2007:132 (madwifi-source) File : nvt/gb_mandriva_MDKSA_2007_132.nasl |
| 2008-09-04 | Name : FreeBSD Ports: drupal File : nvt/freebsd_drupal2.nasl |
| 2008-09-04 | Name : FreeBSD Ports: drupal File : nvt/freebsd_drupal3.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1125-1 (drupal) File : nvt/deb_1125_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1125-2 (drupal) File : nvt/deb_1125_2.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 27595 | Drupal upload.module Filename XSS |
| 27593 | Drupal database.mysqli.inc Multiple Parameter SQL Injection |
| 27592 | Drupal database.pgsql.inc Multiple Parameter SQL Injection |
| 25911 | Drupal Taxonomy Module Page Title XSS |
| 25910 | Drupal File Upload Multiple Extension Restriction Bypass |
| 25909 | Drupal on Apache files Directory File Upload Arbitrary Code Execution |
| 25908 | Drupal database.mysql.inc Multiple Parameter SQL Injection |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1125.nasl - Type : ACT_GATHER_INFO |
| 2006-07-17 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_6da7344b128a11dbb25f00e00c69a70d.nasl - Type : ACT_GATHER_INFO |
| 2006-06-06 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_40a0185fec3211dabe02000c6ec775d9.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:26:01 |
|
