Drupal Embedded Media Field/Media: Video Flotsam/Media: Audio Flotsam Multiple Vulnerabilities
BID:45276
Info
Drupal Embedded Media Field/Media: Video Flotsam/Media: Audio Flotsam Multiple Vulnerabilities
| Bugtraq ID: | 45276 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 08 2010 12:00AM |
| Updated: | Mar 19 2015 09:16AM |
| Credit: | Justin Klein Keane |
| Vulnerable: |
Drupal Media: Video Flotsam 6.x-1.1.` Drupal Media: Video Flotsam 6.X-1.0 Drupal Media: Audio Flotsam 6.X-1.0 Drupal Embedded Media Field 6.X-2.3 Drupal Embedded Media Field 6.X-2.1 Drupal Embedded Media Field 6.X-1.25 Drupal Embedded Media Field 6.X-1.24 Drupal Embedded Media Field 6.x-1.0 Drupal Embedded Media Field 5.x-1.11 Drupal Embedded Media Field 5.X-1.10 Drupal Content Construction Kit (CCK) 6.x-2.8 |
| Not Vulnerable: |
Drupal Media: Video Flotsam 6.X-1.2 Drupal Media: Audio Flotsam 6.X-1.1 Drupal Embedded Media Field module 6.X-2.4 Drupal Embedded Media Field module 6.x-1.26 |
Discussion
Drupal Embedded Media Field/Media: Video Flotsam/Media: Audio Flotsam Multiple Vulnerabilities
The Embedded Media Field, Media: Video Flotsam, and Media: Audio Flotsam modules for Drupal are prone to multiple remote vulnerabilities, including:
1. An HTML-injection vulnerability
2. An arbitrary-file-upload vulnerability.
An attacker could exploit these vulnerabilities to execute arbitrary script code in a user's browser in the context of the affected site or execute arbitrary code on the server.
The following products and versions are affected:
Embedded Media Field module for Drupal 6.x versions prior to 6.x-1.26 and 6.x-2.4, and for Drupal 5.x versions prior to 5.x-1.12
Media: Video Flotsam module for Drupal 6.x versions prior to 6.x-1.2
Media: Audio Flotsam module for Drupal 6.x versions prior to 6.x-1.1
The Embedded Media Field, Media: Video Flotsam, and Media: Audio Flotsam modules for Drupal are prone to multiple remote vulnerabilities, including:
1. An HTML-injection vulnerability
2. An arbitrary-file-upload vulnerability.
An attacker could exploit these vulnerabilities to execute arbitrary script code in a user's browser in the context of the affected site or execute arbitrary code on the server.
The following products and versions are affected:
Embedded Media Field module for Drupal 6.x versions prior to 6.x-1.26 and 6.x-2.4, and for Drupal 5.x versions prior to 5.x-1.12
Media: Video Flotsam module for Drupal 6.x versions prior to 6.x-1.2
Media: Audio Flotsam module for Drupal 6.x versions prior to 6.x-1.1
Exploit / POC
Drupal Embedded Media Field/Media: Video Flotsam/Media: Audio Flotsam Multiple Vulnerabilities
An attacker can exploit these issues via a browser.
The following proof-of-concept are available:
An attacker can exploit these issues via a browser.
The following proof-of-concept are available:
Solution / Fix
Drupal Embedded Media Field/Media: Video Flotsam/Media: Audio Flotsam Multiple Vulnerabilities
Solution:
The vendor released an update. Please see the references for more information.
Solution:
The vendor released an update. Please see the references for more information.
References
Drupal Embedded Media Field/Media: Video Flotsam/Media: Audio Flotsam Multiple Vulnerabilities
References:
References: