Re: [Full-disclosure] [Security-news] SA-CORE-2012-003 - Drupal core - Arbitrary PHP code execution and Information disclosure

["Dex" <0x41 () hush ai>]

Hi
I only see this in commit logs that appears to refer to
it,http://drupalcode.org/project/drupal.git/commitdiff/3c0da100087b599667af56fff6db5d44a22b5254
do you have any further commits?
thx
On Wednesday, October 17, 2012 at 10:58 PM, security-news () drupal org
wrote:View online: http://drupal.org/node/1815912

  * Advisory ID: DRUPAL-SA-CORE-2012-003
  * Project: Drupal core [1]
  * Version: 7.x
  * Date: 2012-October-17
  * Security risk: Highly critical [2]
  * Exploitable from: Remote
  * Vulnerability: Information Disclosure, Arbitrary PHP code
execution

-------- DESCRIPTION  
---------------------------------------------------------

Multiple vulnerabilities were discovered in Drupal core.

.... Arbitrary PHP code execution

A bug in the installer code was identified that allows an attacker to
re-install Drupal using an external database server under certain
transient
conditions. This could allow the attacker to execute arbitrary PHP
code on
the original server.

This vulnerability is mitigated by the fact that the re-installation
can only
be successful if the site's settings.php file or sites directories are
writeable by or owned by the webserver user. Configuring the Drupal
installation to be owned by a different user than the webserver user
(and not
to be writeable by the webserver user) is a recommended security best
practice [3]. However, in all cases the transient conditions expose
information to an attacker who accesses install.php, and therefore
this
security update should be applied to all Drupal 7 sites.

.... Information disclosure - OpenID module

For sites using the core OpenID module, an information disclosure
vulnerability was identified that allows an attacker to read files on
the
local filesystem by attempting to log in to the site using a malicious
OpenID
server.

CVE: Requested

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Drupal core 7.x versions prior to 7.16.

Drupal 6 is not affected.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use Drupal 7.x, upgrade to Drupal core 7.16 [4].

If you are unable to deploy the security release immediately, removing
or
blocking access to install.php is a sufficient mitigation step for the
arbitrary PHP code execution vulnerability.

Also see the Drupal core [5] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * The arbitrary PHP code execution vulnerability was reported by
Heine
    Deelstra [6] and Noam Rathaus [7] working with Beyond Security's
    SecuriTeam Secure Disclosure Program. Heine Deelstra is also a
member of
    the Drupal Security Team.
  * The information disclosure vulnerability in the OpenID module was
reported
    by Reginaldo Silva [8].

-------- FIXED BY  
------------------------------------------------------------

  * The arbitrary PHP code execution vulnerability was fixed by Damien
    Tournoud [9], David Rothstein [10], Peter Wolanin [11], and
Károly
    Négyesi [12], all members of the Drupal Security Team.
  * The information disclosure vulnerability in the OpenID module was
fixed by
    Reginaldo Silva [13], Christian Schmidt [14], Vojtěch Kusý [15],
and
    Frédéric Marand [16], and by Peter Wolanin [17], David Rothstein
[18],
    Damien Tournoud [19], and Heine Deelstra [20] of the Drupal
Security Team.

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or
via the
contact form at http://drupal.org/contact [21].

Learn more about the Drupal Security team and their policies [22],
writing
secure code for Drupal [23], and securing your site [24].
[1] http://drupal.org/project/drupal
[2] http://drupal.org/security-team/risk-levels
[3] http://drupal.org/node/244924
[4] http://drupal.org/node/1815904
[5] http://drupal.org/project/drupal
[6] http://drupal.org/user/17943
[7] http://drupal.org/user/2317662
[8] http://drupal.org/user/2305626
[9] http://drupal.org/user/22211
[10] http://drupal.org/user/124982
[11] http://drupal.org/user/49851
[12] http://drupal.org/user/9446
[13] http://drupal.org/user/2305626
[14] http://drupal.org/user/216078
[15] http://drupal.org/user/56154
[16] http://drupal.org/user/27985
[17] http://drupal.org/user/49851
[18] http://drupal.org/user/124982
[19] http://drupal.org/user/22211
[20] http://drupal.org/user/17943
[21] http://drupal.org/contact
[22] http://drupal.org/security-team
[23] http://drupal.org/writing-secure-code
[24] http://drupal.org/security/secure-configuration

_______________________________________________
Security-news mailing list
Security-news () drupal org
Unsubscribe at http://lists.drupal.org/mailman/listinfo/security-news
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/