* Advisory ID: DRUPAL-SA-CONTRIB-2010-027 * Project: Email Input Filter (third-party module) * Version: 5.x, 6.x * Date: 2010-March-17 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Arbitrary code execution -------- DESCRIPTION --------------------------------------------------------- Email Input Filter converts email style markup into web friendly format. Arbitrary code execution vulnerability in this module allows a remote attacker with the ability to create content using an input format with the email input filter enabled to execute arbitrary PHP code on an affected system. In order to exploit this vulnerability, an input format must be created using the e-mail input filter, and an attacker must be able to post some form of content using that input format. -------- VERSIONS AFFECTED --------------------------------------------------- * Email Input Filter 6.x-1.x prior to 6.x-1.1 * Email Input Filter 5.x-1.x all versions Drupal core is not affected. If you do not use the contributed Email Input Filter module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Email Input Filter 6.x-1.x upgrade to Email Input Filter 6.x-1.1 [1] * If you use Email Input Filter 5.x-1.x, disable the module or upgrade to Drupal 6.x. The Drupal 5.x version is now unsupported. See also the Email Input Filter project page [2]. -------- REPORTED BY --------------------------------------------------------- * Martin Barbella [3] -------- FIXED BY ------------------------------------------------------------ * Mark Burton [4], the Email Input Filter module maintainer. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/745318 [2] http://drupal.org/project/emailFilter [3] http://drupal.org/user/633600 [4] http://drupal.org/user/114447