copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2016.0512 - [Debian] drupal7: Execute arbitrary code/commands - Remote/unauthenticated

Date: 29 February 2016
References: ESB-2016.0486  

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.0512
                         drupal7 security advisory
                             29 February 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           drupal7
Publisher:         Debian
Operating System:  Debian GNU/Linux 7
                   Debian GNU/Linux 8
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated      
                   Modify Arbitrary Files          -- Remote/Unauthenticated      
                   Denial of Service               -- Remote/Unauthenticated      
                   Provide Misleading Information  -- Remote with User Interaction
                   Reduced Security                -- Remote/Unauthenticated      
Resolution:        Patch/Upgrade

Reference:         ESB-2016.0486

Original Bulletin: 
   http://www.debian.org/security/2016/dsa-3498

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3498-1                   security@debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
February 28, 2016                     https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : drupal7
CVE ID         : not yet available

Multiple security vulnerabilities have been found in the Drupal content
management framework. For additional information, please refer to the
upstream advisory at https://www.drupal.org/SA-CORE-2016-001

For the oldstable distribution (wheezy), this problem has been fixed
in version 7.14-2+deb7u12.

For the stable distribution (jessie), this problem has been fixed in
version 7.32-1+deb8u6.

For the unstable distribution (sid), this problem has been fixed in
version 7.43-1.

We recommend that you upgrade your drupal7 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJW03CcAAoJEBDCk7bDfE42K2oQAIQIak1oL8n92xt3mnwQlQV5
wJGhg+xT6yml8eeCsU8TO/SyNCp+3nl39g0XIJuyVABvPZDQ2JAPMxy+8ZGCiNKi
2/2YEnf5uPIYtV0qXAGwaDKVYWyVaronMEHAFQwHqbpOFFt+PohjP8q7rd97upHv
0LeYTmHXLFCFSpjB4rCKLn0fX3klSaAfFQ9jZ+o4rudJFRx/G22+RL+MwBwHjGvh
EwpXoegSPSsYjsmiLZ7StyA6Ncf6j8WB7F1G3EGMBWrKuU9D/ZmQ5k2959TY4+9J
OVVNYPVobZ2Xr0/ldzONcJ7LiLH8IM77/Z1kpshWOZMxPXTaF6G0881WdobVmxoD
SOyo9mQzGY/zI//S1SRbsVUL9xCYuOWY/rq/QdbdHoZobwIKj81wctopVXni/F85
ipen9vjkUkGu9Lvfompa1iThC2SytO1nosZX/XAdBQA27mDdjdM1wQUViF2fd1lh
V3deYY8Ctw9hv0oCUoDFVmUiHlZhkUEstD5D4WMKpwFIhpwkacqEk0gMq90pTmvI
FJKS2Y7axItWwgoxUqJ+ndfp86AKsH/WFMDaf8E4qHLP+yB0HmOAYIyxBhIwftMv
EJQ1NMjyi2oeQZgE28JzIXe6JUwDrgGyw1tQgmdu9CxHKOGzMDARgWU7YWpMjfY4
+nky4R0YG1LJMJFLdb/T
=qetR
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVtOPmn6ZAP0PgtI9AQLC/A//TZGmVZAOknifCa7QKkwAWj2IakIMgER0
t6S27qHIP5Z4jRY9bPxsQ000Qo5/3OVzJ16nTJLnDHNuOYLIOI5kdgGIAFV8vqHR
QjZjvG8gA1NbclcZU7cxqLNNg7Mvl73gj2E5zNkOvuCeBaGkH2uiS4Hah79wDx5f
V1Vz/Z8SuvLvBwtdPZTqYd6aSrCYbm/2OjzfLImvR9jKvMsUFh8/fzwn5yXrIKsf
kDaNpGUwXxyncJ9sTE/dHEAfkHoOCLw7Uu4TTUEBehaWWOfyBd8WM9/npc8IE+o7
gizzt2evQGb/wb58HyEZuD8DEaI0cfcBxj5K7cQjhX0a63vSzFdfq7huZnSrowOw
alhJ1L9oNKILlBgwMlHmrg/Q5fsU5b//N8K60a0KrWFhPsRorUSuvOD3nBn46VsS
fjIucSfCPRJ+Kxt3Y5Vqoim+tPHNpTuEULyFCoxlsuk+SbFZwLkSDqeV4lWW/iZ7
HfIj5lXmMNSKmF1uSFnBTjyWnz0U/CoUZ4hseHy4MBiBiFSYeYfcghilQLbguHTl
5Jy0QMKtRWFcK1G4aEHdvyLspnk0vWgmG73CZ/HADfvs17xj1Qv6WZOnL6LGplYm
jJkP+cAq7wkbeqHPK05J7FuQs/GawCqaOBh7muHJoStGTbI7xQsX7B/P0sh90Rnd
l6w9Q+kKqvA=
=5jcp
-----END PGP SIGNATURE-----