* Advisory ID: DRUPAL-SA-CONTRIB-2010-100 * Projects: Ubuntu Drupal Theme - Brown * Version: 5.x, 6.x * Date: 2010-October-20 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Directory traversal and information disclosure
-------- DESCRIPTION ---------------------------------------------------------
This Ubuntu Drupal Theme - Brown is designed to mimic the old ubuntu.com. The theme used a PHP file to generate a gradient image on the fly. User input from the URL is not properly validated in this PHP code, leading to a directory traversal vulnerability where the contents of any file readable by the webserver may be displayed to the remote user, potentially revealing sensitive information. -------- VERSIONS AFFECTED ---------------------------------------------------
* Ubuntu Drupal Theme - Brown all versions on all branches prior to 6.x-8.1 * Ubuntu Drupal Theme - Brown for Drupal 5.x
Drupal core is not affected. If you do not use the contributed Ubuntu Drupal Theme - Brown [1], there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------
Install the latest version: * If you use the Ubuntu Drupal Theme - Brown for Drupal 6.x (any prior version on any branch), upgrade to Ubuntu Drupal Theme - Brown 6.x-8.1 [2] * If you use the Ubuntu Drupal Theme - Brown for Drupal 5.x, it is no longer supported and should be disabled or the 6.x fix applied
See also the Ubuntu Drupal Theme - Brown project page [3]. -------- REPORTED BY ---------------------------------------------------------
* Steve Foris
-------- FIXED BY ------------------------------------------------------------
* MTecknology [4], the Ubuntu Drupal theme maintainer
-------- CONTACT -------------------------------------------------------------
The security team for Drupal [5] can be reached at security at drupal.org or via the form at http://drupal.org/contact [6].
Read more about the Security Team and Security Advisories at http://drupal.org/security [7].
[1] http://drupal.org/project/udtheme [2] http://drupal.org/node/947670 [3] http://drupal.org/project/udtheme [4] http://drupal.org/user/302171 [5] http://drupal.org/security-team [6] http://drupal.org/contact [7] http://drupal.org/security