Drupal Talk Module Multiple Remote Vulnerabilities

Bugtraq ID:	31236
Class:	Unknown
CVE:	CVE-2008-4153 CVE-2008-4152
Remote:	Yes
Local:	No
Published:	Sep 18 2008 12:00AM
Updated:	Jul 05 2016 10:01PM
Credit:	christefano
Vulnerable:	Drupal Talk 6.x-1.4 Drupal Talk 5.x-1.2
Not Vulnerable:	Drupal Talk 6.x-1.5 Drupal Talk 5.x-1.3

Drupal Talk Module Multiple Remote Vulnerabilities

The Talk module for Drupal is prone to multiple remote vulnerabilities:

1. An HTML-injection vulnerability allows attackers to potentially steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

2. An access-validation vulnerability allows attackers to view arbitrary nodes.

These issues affect versions prior to Talk 5.x-1.3 and Talk 6.x-1.5.
http://drupal.org/node/207891

Drupal Talk Module Multiple Remote Vulnerabilities

Attackers can use a browser to exploit these issues.

Drupal Talk Module Multiple Remote Vulnerabilities

Solution:
The vendor has released an update. Please see the references for more information.


Drupal Talk 6.x-1.4

• Drupal talk-6.x-1.5.tar.gz
  http://ftp.drupal.org/files/projects/talk-6.x-1.5.tar.gz

Drupal Talk 5.x-1.2

• Drupal talk-5.x-1.3.tar.gz
  http://ftp.drupal.org/files/projects/talk-5.x-1.3.tar.gz

Drupal Talk Module Multiple Remote Vulnerabilities

References:

• Drupal Talk Homepage (Drupal)
  
• SA-2008-049 - Talk - Multiple vulnerabilities (Drupal)