[Security-news] SA-CONTRIB-2010-015 - Signwriter - Arbitrary code execution

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2010-015
  * Project: Signwriter (third-party module)
  * Version: 5.x, 6.x
  * Date: 2010-February-3
  * Security risk: Critical
  * Exploitable from: Remote
  * Vulnerability: Arbitrary code execution

-------- DESCRIPTION  
---------------------------------------------------------

The Signwriter module allows the use of TrueType fonts to replace text in
headings, blocks, menus and filtered text. This vulnerability allows a remote
attacker with the ability to create content using an input filter created
with a Signwriter profile to execute arbitrary PHP code on an affected
system. The vulnerability exists due to unsafe use of PHP's preg_replace
function with the e option, causing the replacement to be executed as PHP
code.
-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Signwriter for Drupal 5.x prior to 5.x-1.6
  * Signwriter for Drupal 6.x prior to 6.x-2.0-beta2


Drupal core is not affected. If you do not use the Signwriter, there is
nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Upgrade to the latest version:

  * If you use Signwriter for Drupal 5.x upgrade to Signwriter 5.x-1.6 [1]
  * If you use Signwriter for Drupal 6.x upgrade to Signwriter 6.x-2.0-beta2
    [2]

See also the Signwriter page [3].

-------- REPORTED BY  
---------------------------------------------------------

  * Martin Barbella [4]

-------- FIXED BY  
------------------------------------------------------------

  * Agileware [5], the module maintainer

-------- CONTACT  
-------------------------------------------------------------

The security contact for Drupal can be reached at security at drupal.org or
via the form at http://drupal.org/contact [6].


[1] http://drupal.org/node/702978
[2] http://drupal.org/node/702976
[3] http://drupal.org/project/signwriter
[4] http://drupal.org/user/633600
[5] http://drupal.org/user/89106
[6] http://drupal.org/contact