Drupal Printer, e-mail and PDF versions Module Flood Control API Open Email Relay Vulnerability

Bugtraq ID:	34173
Class:	Design Error
CVE:	CVE-2009-1047
Remote:	Yes
Local:	No
Published:	Mar 18 2009 12:00AM
Updated:	Mar 30 2009 07:56PM
Credit:	João Ventura
Vulnerable:	Drupal Printer, e-mail and PDF versions 6.x-1.3 Drupal Printer, e-mail and PDF versions 5.x-4.3
Not Vulnerable:	Drupal Printer, e-mail and PDF versions 6.x-1.4 Drupal Printer, e-mail and PDF versions 5.x-4.4

Drupal Printer, e-mail and PDF versions Module Flood Control API Open Email Relay Vulnerability

The 'Printer, e-mail and PDF versions' module for Drupal is prone to an open-email-relay vulnerability.

An attacker could exploit this issue by constructing a script that would send unsolicited spam to an unrestricted amount of email addresses from a forged email address.

Versions prior to 'Printer, e-mail and PDF versions' 5.x-4.4 and 6.x-1.4 are vulnerable.

Drupal Printer, e-mail and PDF versions Module Flood Control API Open Email Relay Vulnerability

Attackers may exploit this issue by using readily available network utilities.

Drupal Printer, e-mail and PDF versions Module Flood Control API Open Email Relay Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.


Drupal Printer, e-mail and PDF versions 5.x-4.3

• Drupal print-5.x-4.4.tar.gz
  http://ftp.drupal.org/files/projects/print-5.x-4.4.tar.gz

Drupal Printer, e-mail and PDF versions 6.x-1.3

• Drupal print-6.x-1.4.tar.gz
  http://ftp.drupal.org/files/projects/print-6.x-1.4.tar.gz

Drupal Printer, e-mail and PDF versions Module Flood Control API Open Email Relay Vulnerability

References:

• print 5.x-4.4 (Drupal)
  
• print 6.x-1.4 (Drupal)
  
• Printer, e-mail and PDF versions Homepage (Drupal)
  
• SA-CONTRIB-2009-012 - Printer, e-mail and PDF versions - Unrestricted e-mailing (Drupal)