Drupal 'Printer, e-mail and PDF versions' Module Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	36090
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 19 2009 12:00AM
Updated:	Aug 21 2009 03:56PM
Credit:	Justin Klein Keane
Vulnerable:	Drupal Printer, e-mail and PDF versions 6.x-1.7 Drupal Printer, e-mail and PDF versions 6.x-1.6 Drupal Printer, e-mail and PDF versions 6.x-1.5 Drupal Printer, e-mail and PDF versions 6.x-1.4 Drupal Printer, e-mail and PDF versions 6.x-1.3 Drupal Printer, e-mail and PDF versions 5.x-4.7 Drupal Printer, e-mail and PDF versions 5.x-4.6 Drupal Printer, e-mail and PDF versions 5.x-4.5 Drupal Printer, e-mail and PDF versions 5.x-4.4 Drupal Printer, e-mail and PDF versions 5.x-4.3
Not Vulnerable:	Drupal Printer, e-mail and PDF versions 6.x-1.8 Drupal Printer, e-mail and PDF versions 5.x-4.8

Drupal 'Printer, e-mail and PDF versions' Module Multiple Cross Site Scripting Vulnerabilities

The 'Printer, e-mail and PDF versions' module for Drupal is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect the following versions:

6.x prior to 6.x-1.8
5.x prior to 5.x-4.8

Drupal 'Printer, e-mail and PDF versions' Module Multiple Cross Site Scripting Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.

Drupal 'Printer, e-mail and PDF versions' Module Multiple Cross Site Scripting Vulnerabilities

Solution:
The vendor has released updates. Please see the references for details.


Drupal Printer, e-mail and PDF versions 5.x-4.6

• Drupal print-5.x-4.8.tar.gz
  http://ftp.drupal.org/files/projects/print-5.x-4.8.tar.gz

Drupal Printer, e-mail and PDF versions 6.x-1.3

• Drupal print-6.x-1.8.tar.gz
  http://ftp.drupal.org/files/projects/print-6.x-1.8.tar.gz

Drupal Printer, e-mail and PDF versions 6.x-1.5

• Drupal print-6.x-1.8.tar.gz
  http://ftp.drupal.org/files/projects/print-6.x-1.8.tar.gz

Drupal Printer, e-mail and PDF versions 5.x-4.4

• Drupal print-5.x-4.8.tar.gz
  http://ftp.drupal.org/files/projects/print-5.x-4.8.tar.gz

Drupal Printer, e-mail and PDF versions 6.x-1.6

• Drupal print-6.x-1.8.tar.gz
  http://ftp.drupal.org/files/projects/print-6.x-1.8.tar.gz

Drupal Printer, e-mail and PDF versions 5.x-4.3

• Drupal print-5.x-4.8.tar.gz
  http://ftp.drupal.org/files/projects/print-5.x-4.8.tar.gz

Drupal Printer, e-mail and PDF versions 6.x-1.7

• Drupal print-6.x-1.8.tar.gz
  http://ftp.drupal.org/files/projects/print-6.x-1.8.tar.gz

Drupal Printer, e-mail and PDF versions 5.x-4.7

• Drupal print-5.x-4.8.tar.gz
  http://ftp.drupal.org/files/projects/print-5.x-4.8.tar.gz

Drupal Printer, e-mail and PDF versions 6.x-1.4

• Drupal print-6.x-1.8.tar.gz
  http://ftp.drupal.org/files/projects/print-6.x-1.8.tar.gz

Drupal Printer, e-mail and PDF versions 5.x-4.5

• Drupal print-5.x-4.8.tar.gz
  http://ftp.drupal.org/files/projects/print-5.x-4.8.tar.gz

Drupal 'Printer, e-mail and PDF versions' Module Multiple Cross Site Scripting Vulnerabilities

References:

• Printer, e-mail and PDF versions Homepage (Drupal)
  
• SA-CONTRIB-2009-052 - Printer, e-mail and PDF versions - Cross site scripting (Drupal)