[print] Add D6LTS patch for SA-CONTRIB-2018-063 [#3004166]

See https://www.drupal.org/sa-contrib-2018-063

This vulnerability has a lower risk in Drupal 6 than in Drupal 7! This is because you can't pass shell commands to execute using the HTTP basic auth user/pass - you need to either (1) have an admin permission to put those commands into Drupal variables, or (2) have permission to put <script> in nodes while also using the dompdf generation tool.

Comment	File	Size	Author
#4	interdiff.txt	547 bytes	dsnopek
#4	SA-CONTRIB-2018-063.patch	2.08 KB	dsnopek
#2	SA-CONTRIB-2018-063.patch	2.06 KB	dsnopek

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

3 October 2018 at 21:15

dsnopek created an issue. See original summary.

Comment #2

dsnopek

he/him

English

USA

CreditAttribution: dsnopek at myDropWizard commented 3 October 2018 at 21:19

Issue summary:	View changes
Status:	Active	» Needs review

File	Size
SA-CONTRIB-2018-063.patch	2.06 KB

Updated the issue summary about risk.

And patch is attached for review!

Comment #3

dsnopek

he/him

English

USA

CreditAttribution: dsnopek at myDropWizard commented 3 October 2018 at 21:22

Status:

Needs review

» Fixed

Committed to d6lts repo

Comment #4

dsnopek

he/him

English

USA

CreditAttribution: dsnopek at myDropWizard commented 4 October 2018 at 15:55

Status:

Fixed

» Needs review

File	Size
SA-CONTRIB-2018-063.patch	2.08 KB
interdiff.txt	547 bytes

1 file was hidden/shown/deleted

File	Size
SA-CONTRIB-2018-063.patch	2.06 KB

An error was found in this patch, which actually fails to prevent part of the security issue. Here's an updated patch and interdiff.

FYI, this part of the security issue (and really the D6 variant of the issue in general) is only exploitable by folks who have the 'administer print' permission, which should only be trusted users anyway.