Drupal Core '.htaccess' File Security Bypass Weakness

Bugtraq ID:	63845
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 20 2013 12:00AM
Updated:	Nov 20 2013 12:00AM
Credit:	Lee Rowlands, Miguel Jacq, artfulrobot, and Dave Fletcher
Vulnerable:	Drupal Drupal 7.6 Drupal Drupal 7.5 Drupal Drupal 7.4 Drupal Drupal 7.3 Drupal Drupal 7.23 Drupal Drupal 7.20 Drupal Drupal 7.2 Drupal Drupal 7.19 Drupal Drupal 7.18 Drupal Drupal 7.17 Drupal Drupal 7.16 Drupal Drupal 7.15 Drupal Drupal 7.14 Drupal Drupal 7.13 Drupal Drupal 7.12 Drupal Drupal 7.11 Drupal Drupal 7.10 Drupal Drupal 7.1 Drupal Drupal 7.0 Dev Drupal Drupal 7.0 Alpha7 Drupal Drupal 7.0 Alpha6 Drupal Drupal 7.0 Alpha5 Drupal Drupal 7.0 Alpha4 Drupal Drupal 7.0 Alpha3 Drupal Drupal 7.0 Alpha2 Drupal Drupal 7.0 Alpha1 Drupal Drupal 7.0 Drupal Drupal 6.9 Drupal Drupal 6.8 Drupal Drupal 6.7 Drupal Drupal 6.6 Drupal Drupal 6.5 Drupal Drupal 6.4 Drupal Drupal 6.3 Drupal Drupal 6.28 Drupal Drupal 6.27 Drupal Drupal 6.26 Drupal Drupal 6.23 Drupal Drupal 6.22 Drupal Drupal 6.22 Drupal Drupal 6.2 Drupal Drupal 6.18 Drupal Drupal 6.17 Drupal Drupal 6.16 Drupal Drupal 6.15 Drupal Drupal 6.14 Drupal Drupal 6.13 Drupal Drupal 6.12 Drupal Drupal 6.11 Drupal Drupal 6.10 Drupal Drupal 6.1 Drupal Drupal 6.0 Rc4 Drupal Drupal 6.0 Rc3 Drupal Drupal 6.0 Rc2 Drupal Drupal 6.0 Rc1 Drupal Drupal 6.0 Dev Drupal Drupal 6.0 Beta4 Drupal Drupal 6.0 Beta3 Drupal Drupal 6.0 Beta2 Drupal Drupal 6.0 Beta1 Drupal Drupal 6.0
Not Vulnerable:	Drupal Drupal 7.24 Drupal Drupal 6.29

Drupal Core '.htaccess' File Security Bypass Weakness

Drupal is prone to a security-bypass weakness.

Attackers can exploit this issue to bypass intended security restrictions and execute arbitrary code. This may aid in further attacks.

Drupal core 6.x versions prior to 6.29 and 7.x versions prior to 7.24 are vulnerable.

Drupal Core '.htaccess' File Security Bypass Weakness

Solution:
Updates are available. Please see the references or vendor advisory for more information.