Drupal Chaos Tool Suite Module Multiple Remote Vulnerabilities

Bugtraq ID:	40285
Class:	Unknown
CVE:	CVE-2010-1546 CVE-2010-1547 CVE-2010-1548 CVE-2010-2010
Remote:	Yes
Local:	No
Published:	May 19 2010 12:00AM
Updated:	Apr 13 2015 09:05PM
Credit:	Martin Barbella, Justin Klein Keane
Vulnerable:	Drupal Chaos tool suite 6.x-1.3
Not Vulnerable:	Drupal Chaos tool suite 6.x-1.4

Drupal Chaos Tool Suite Module Multiple Remote Vulnerabilities

The Chaos tool suite module for Drupal is prone to multiple remote vulnerabilities. These issues include multiple html-injection vulnerabilities, a cross-site request-forgery vulnerability, a security-bypass vulnerability, and an arbitrary PHP code-execution vulnerability.

An attacker can exploit these issues to steal cookie-based authentication credentials, perform unauthorized actions, or bypass certain security restrictions. Other attacks are also possible.

Versions prior to Chaos tool suite 6.x-1.4 are vulnerable.

Drupal Chaos Tool Suite Module Multiple Remote Vulnerabilities

An attacker can use a browser to exploit these issues. For a cross-site request-forgery attack, the attacker must entice an unsuspecting user to follow a malicious URI.

Drupal Chaos Tool Suite Module Multiple Remote Vulnerabilities

Solution:
Updates are available; please see the references for more information.


Drupal Chaos tool suite 6.x-1.3

• Drupal ctools-6.x-1.4.tar.gz
  http://ftp.drupal.org/files/projects/ctools-6.x-1.4.tar.gz

Drupal Chaos Tool Suite Module Multiple Remote Vulnerabilities

References:

• Chaos tool suite Homepage (Drupal)
  
• Drupal Chaos Tools Suite (Ctools) Module Multiple Vulns ("Justin C. Klein Keane" )
  
• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2010-058: Chaos tool suite - Multiple vulnerabilities (Drupal)