Downloads

Download media_audio_flotsam-6.x-1.1.tar.gztar.gz 11.08 KB
MD5: cf204c8db7f8aac6eaac0efb9c0299d0
SHA-1: 190ccfa55e6ee04ca668942d5caea475384ad082
SHA-256: a9a4a3bebc689ba8d8d5f4184f796001f37d7b3a50c98587c86002d3ce2099f6
Download media_audio_flotsam-6.x-1.1.zipzip 15.86 KB
MD5: 5adaf68ff295cd429d588464ed1d64b5
SHA-1: 625fb6ca14360316127fda3c94f048096a4a5fae
SHA-256: 6c90724fa275d9875d728d681e6465c1613294be1cbbcd4e62026ff9d7c3a466

Release notes

  • Advisory ID: DRUPAL-SA-CONTRIB-2010-109
  • Projects: Embedded Media Field, Media: Video Flotsam, Media: Audio Flotsam (third-party module)
  • Version: 5.x and 6.x
  • Date: 2010-December-08
  • Security risk: Moderately Critical
  • Exploitable from: Remote
  • Vulnerability: Multiple vulnerabilities

Description

1 - Arbitrary File Upload/Code Execution Vulnerability

The Embedded Thumbnail module (packaged with the project) allows users who upload videos to upload their own thumbnails to replace The Drupal Embedded Media Field module. Unfortunately, the Embedded Thumbnail Module contains a vulnerability that could allow arbitrary file upload, as well as potentially remote and potentially code execution. Malicious users can upload arbitrary files with extensions other than .php, .pl, .py, .cgi, .asp, or .js. Many web servers support legacy PHP extensions not included in this list (such as .phtml, or .php3) which would allow attackers to upload and execute arbitrary PHP code. Attackers could also upload malicious documents or other material with virus payload and use these to attack other users or exploit flaws in file include vulnerabilities. This exploit is mitigated by the fact that the site must have a content type with an embedded media field that allows users to upload custom thumbnails, and the user must have access to create or edit the content type.

2 - Embed XSS Vulnerability

The 5.x-1.x and 6.x-1.x versions of the Embedded Media Field module comes packaged with "custom provider files" that allow users to add audio and video files to their site by posting a link to the direct url of an audio or video the field emfield provides. Unfortunately the Embedded Media Field module contains an arbitrary HTML injection vulnerability (also known as cross site scripting, or XSS) due to the fact that it fails to sanitize user supplied audio file paths and embed codes before display. Please note, recently these 6.x-2.x branch of the Embedded Media Field module, the custom audio and video provider files were moved to separate modules: Media: Video Flotsam 6.x-1.2 and Media: Audio Flotsam. This exploit is mitigated by the fact that the site must have a content type with an embedded media field that has the custom audio or video provider file enabled, and the user must have access to create or edit the content type.

Versions affected

  • Embedded Media Field module for Drupal 6.x versions prior to 6.x-1.26 and 6.x-2.4, and for Drupal 5.x versions prior to 5.x-1.12.
  • Media: Video Flotsam module for Drupal 6.x versions prior to 6.x-1.2.
  • Media: Audio Flotsam module for Drupal 6.x versions prior to 6.x-1.1.

Drupal core is not affected. If you do not use the contributed Embedded Media Field module, together with the Embedded Thumbnail Field module or the custom audio and video provider files included in emfield as well as in Media: Audio Flotsam and/or Media: Video Flotsam, there is nothing you need to do.

Solution

Install the latest version:

Reported by

Fixed by

Contact

The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact.

Created by: kleinmp
Created on: 8 Dec 2010 at 21:35 UTC
Last updated: 8 Dec 2010 at 22:43 UTC
Security update

Other releases