Debian Bug report logs - #592716
drupal6: SA-CORE-2010-002 - Drupal core - Multiple vulnerabilities

version graph

Package: drupal6; Maintainer for drupal6 is Luigi Gangitano <luigi@debian.org>;

Reported by: Ivan Vilata i Balaguer <ivan@selidor.net>

Date: Thu, 12 Aug 2010 09:48:02 UTC

Severity: grave

Tags: security

Found in version 6.16-1~bpo50+1

Fixed in versions drupal6/6.18-1, drupal6/6.6-3lenny6

Done: Luigi Gangitano <luigi@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Luigi Gangitano <luigi@debian.org>:
Bug#592716; Package drupal6. (Thu, 12 Aug 2010 09:48:05 GMT) Full text and rfc822 format available.

Acknowledgement sent to Ivan Vilata i Balaguer <ivan@selidor.net>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Luigi Gangitano <luigi@debian.org>. (Thu, 12 Aug 2010 09:48:05 GMT) Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Ivan Vilata i Balaguer <ivan@selidor.net>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: drupal6: SA-CORE-2010-002 - Drupal core - Multiple vulnerabilities
Date: Thu, 12 Aug 2010 09:37:06 +0000
Package: drupal6
Version: 6.16-1~bpo50+1
Severity: grave
Tags: security
Justification: user security hole


DRUPAL-SA-CORE-2010-002 from 2010-08-12 includes several vulnerabilities, some
of them allowing malicious site identifying as existing users and gaining
administrative access.

The problems got fixed in 6.18, so it looks like all versions currently in
Debian are affected.

Thanks,

-- System Information:
Debian Release: 5.0.5
  APT prefers stable
  APT policy: (990, 'stable'), (190, 'testing')
Architecture: i386 (i686)

Kernel: Linux 2.6.18.8-linode22 (SMP w/4 CPU cores)
Locale: LANG=ca_ES.UTF-8, LC_CTYPE=ca_ES.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages drupal6 depends on:
ii  curl               7.18.2-8lenny4        Get a file from an HTTP, HTTPS or 
ii  dbconfig-common    1.8.39                common framework for packaging dat
ii  debconf [debconf-2 1.5.24                Debian configuration management sy
ii  mysql-client       5.0.51a-24+lenny4     MySQL database client (metapackage
ii  mysql-client-5.0 [ 5.0.51a-24+lenny4     MySQL database client binaries
ii  nginx [httpd]      0.7.67-3              small, but very powerful and effic
ii  php5               5.2.6.dfsg.1-1+lenny9 server-side, HTML-embedded scripti
ii  php5-gd            5.2.6.dfsg.1-1+lenny9 GD module for php5
ii  php5-mysql         5.2.6.dfsg.1-1+lenny9 MySQL module for php5
ii  postfix [mail-tran 2.5.5-1.1             High-performance mail transport ag
ii  wwwconfig-common   0.1.2                 Debian web auto configuration

Versions of packages drupal6 recommends:
ii  mysql-server           5.0.51a-24+lenny4 MySQL database server (metapackage
ii  mysql-server-5.0 [mysq 5.0.51a-24+lenny4 MySQL database server binaries

drupal6 suggests no packages.

-- debconf information excluded




Information forwarded to debian-bugs-dist@lists.debian.org, Luigi Gangitano <luigi@debian.org>:
Bug#592716; Package drupal6. (Thu, 12 Aug 2010 19:36:03 GMT) Full text and rfc822 format available.

Acknowledgement sent to Richard van den Berg <richard@vdberg.org>:
Extra info received and forwarded to list. Copy sent to Luigi Gangitano <luigi@debian.org>. (Thu, 12 Aug 2010 19:36:03 GMT) Full text and rfc822 format available.

Message #10 received at 592716@bugs.debian.org (full text, mbox):

From: Richard van den Berg <richard@vdberg.org>
To: 592716@bugs.debian.org
Subject: Re: Bug#592716: drupal6: SA-CORE-2010-002 - Drupal core - Multiple vulnerabilities
Date: Thu, 12 Aug 2010 21:24:55 +0200
On 12-8-10 11:37 , Ivan Vilata i Balaguer wrote:
> DRUPAL-SA-CORE-2010-002 from 2010-08-12 includes several vulnerabilities, some
> of them allowing malicious site identifying as existing users and gaining
> administrative access.
>    

This seems to be a bug in the OpenID implementation of Drupal. If a site 
does not have the code module OpenID enabled, I suspect it is not 
vulnerable? AFAIK the OpenID modules is not enabled by default.

I just want to get a reality check on the number of Debian Drupal 
installations that might be vulnerable. A Debian package of Drupal 6.19 
is of course very welcome.

Richard




Reply sent to Luigi Gangitano <luigi@debian.org>:
You have taken responsibility. (Tue, 24 Aug 2010 15:06:07 GMT) Full text and rfc822 format available.

Notification sent to Ivan Vilata i Balaguer <ivan@selidor.net>:
Bug acknowledged by developer. (Tue, 24 Aug 2010 15:06:07 GMT) Full text and rfc822 format available.

Message #15 received at 592716-close@bugs.debian.org (full text, mbox):

From: Luigi Gangitano <luigi@debian.org>
To: 592716-close@bugs.debian.org
Subject: Bug#592716: fixed in drupal6 6.18-1
Date: Tue, 24 Aug 2010 15:03:18 +0000
Source: drupal6
Source-Version: 6.18-1

We believe that the bug you reported is fixed in the latest version of
drupal6, which is due to be installed in the Debian FTP archive:

drupal6_6.18-1.diff.gz
  to main/d/drupal6/drupal6_6.18-1.diff.gz
drupal6_6.18-1.dsc
  to main/d/drupal6/drupal6_6.18-1.dsc
drupal6_6.18-1_all.deb
  to main/d/drupal6/drupal6_6.18-1_all.deb
drupal6_6.18.orig.tar.gz
  to main/d/drupal6/drupal6_6.18.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 592716@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Luigi Gangitano <luigi@debian.org> (supplier of updated drupal6 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Tue, 24 Aug 2010 16:17:22 +0200
Source: drupal6
Binary: drupal6
Architecture: source all
Version: 6.18-1
Distribution: unstable
Urgency: high
Maintainer: Luigi Gangitano <luigi@debian.org>
Changed-By: Luigi Gangitano <luigi@debian.org>
Description: 
 drupal6    - a fully-featured content management framework
Closes: 592716
Changes: 
 drupal6 (6.18-1) unstable; urgency=high
 .
   [ Luigi Gangitano ]
   * Urgency high due to security fixes
 .
   * New upstream release
     - Fixes multiple remote vulnerabilities (Closes: #592716)
       (Ref: SA-CORE-2010-002, CVE-TBA)
 .
   * debian/control
     - Bumped Standard-Version to 3.9.1.0, no change needed
Checksums-Sha1: 
 a25cec6208deff6ba4e19cf8f64ffcdbbf0b76fd 1115 drupal6_6.18-1.dsc
 9706ef1c0e1e3ab8606d86da54ec73bae69397b9 1094576 drupal6_6.18.orig.tar.gz
 e4ab8ba3a369f1d204aadf872853618c16799f74 18706 drupal6_6.18-1.diff.gz
 27da0a6b1c0171ec1ca15dab136fc1e23a8053b1 1126170 drupal6_6.18-1_all.deb
Checksums-Sha256: 
 5661516c99539242407f01879152d819cfe227c8c6a0becc720d1dae6f13a08e 1115 drupal6_6.18-1.dsc
 b07815d2922a48ba6630d44345fc53f6e9b1a3cd8a58a510e566854610573c98 1094576 drupal6_6.18.orig.tar.gz
 515e15d69ee26f399d6db2c20437e9e1c3d9e53e32fb71a4bcebb15e19953543 18706 drupal6_6.18-1.diff.gz
 5a0ddd4f2b232d8235f0dca94373fe11143ab1feca345bba0be9e39e3cabc93f 1126170 drupal6_6.18-1_all.deb
Files: 
 8e4b7698ec72a38ac4e898301ca4c9d1 1115 web extra drupal6_6.18-1.dsc
 313b0f1d8a08b74ee6269cee250bd45d 1094576 web extra drupal6_6.18.orig.tar.gz
 ebe7882abc54a7ce54413cbf22aa503e 18706 web extra drupal6_6.18-1.diff.gz
 34a7662ba2c29987d94665243aa79fb7 1126170 web extra drupal6_6.18-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)

iEYEARECAAYFAkxz3UQACgkQ8ZumGJJMDCYraQCfVzSqczc7w7nuX+igZe/+v5WU
OcEAoIND+0bDemvyUbnc3AjsB8IrIw15
=rSXi
-----END PGP SIGNATURE-----





Reply sent to Luigi Gangitano <luigi@debian.org>:
You have taken responsibility. (Mon, 20 Sep 2010 20:06:07 GMT) Full text and rfc822 format available.

Notification sent to Ivan Vilata i Balaguer <ivan@selidor.net>:
Bug acknowledged by developer. (Mon, 20 Sep 2010 20:06:07 GMT) Full text and rfc822 format available.

Message #20 received at 592716-close@bugs.debian.org (full text, mbox):

From: Luigi Gangitano <luigi@debian.org>
To: 592716-close@bugs.debian.org
Subject: Bug#592716: fixed in drupal6 6.6-3lenny6
Date: Mon, 20 Sep 2010 20:02:05 +0000
Source: drupal6
Source-Version: 6.6-3lenny6

We believe that the bug you reported is fixed in the latest version of
drupal6, which is due to be installed in the Debian FTP archive:

drupal6_6.6-3lenny6.diff.gz
  to main/d/drupal6/drupal6_6.6-3lenny6.diff.gz
drupal6_6.6-3lenny6.dsc
  to main/d/drupal6/drupal6_6.6-3lenny6.dsc
drupal6_6.6-3lenny6_all.deb
  to main/d/drupal6/drupal6_6.6-3lenny6_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 592716@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Luigi Gangitano <luigi@debian.org> (supplier of updated drupal6 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Thu, 09 Sep 2010 08:40:21 +0200
Source: drupal6
Binary: drupal6
Architecture: source all
Version: 6.6-3lenny6
Distribution: stable-security
Urgency: low
Maintainer: Luigi Gangitano <luigi@debian.org>
Changed-By: Luigi Gangitano <luigi@debian.org>
Description: 
 drupal6    - a fully-featured content management framework
Closes: 592716
Changes: 
 drupal6 (6.6-3lenny6) stable-security; urgency=low
 .
   [ Luigi Gangitano ]
   * debian/patches/20_SA-CORE-2010-002
     - Fixes multiple XSS vulnerabilities (Closes: #592716)
       Fixes: SA-CORE-2010-002, CVE-2010-3091, CVE-2010-3092, CVE-2010-3093, CVE-2010-3094
Checksums-Sha1: 
 0d4af87412e171ba6e8999bbd8220004a544430a 1130 drupal6_6.6-3lenny6.dsc
 0132ff7b79ef560e1f9edc768326aa234be3287e 32605 drupal6_6.6-3lenny6.diff.gz
 1f33c68dec41c214610428e66b31b3bc99e8e593 1093210 drupal6_6.6-3lenny6_all.deb
Checksums-Sha256: 
 e85807bcae27efa72f2986ddb63302efb2cd8ad394e339d280fbb43c687ffcb9 1130 drupal6_6.6-3lenny6.dsc
 dd650711d3eec49ae734ac70f45aa05f294ac673ad0da062a37cb645f8bf50fe 32605 drupal6_6.6-3lenny6.diff.gz
 6d77d73a6948fef25dd4d91e4f3959f7aeaef7054bdc5ffba24bb951497066c0 1093210 drupal6_6.6-3lenny6_all.deb
Files: 
 7a2cb0258096a2076a4c16ee1ba7b74b 1130 web extra drupal6_6.6-3lenny6.dsc
 b6ec50b492dc28d6a3273e6cafdcaf64 32605 web extra drupal6_6.6-3lenny6.diff.gz
 1f8147473dd2a1a7d48247c974892991 1093210 web extra drupal6_6.6-3lenny6_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (Darwin)

iEYEARECAAYFAkyXUJwACgkQ8ZumGJJMDCY9VwCeLO85cdmPPOwycoWcQhkLPYly
7n4An1yYoYAuHEYokHRZ7cHlhHBIkpoQ
=tYHF
-----END PGP SIGNATURE-----





Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Tue, 19 Oct 2010 07:31:48 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sun Apr 20 11:50:30 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.