[Security-news] SA-CONTRIB-2010-100 - Ubuntu Drupal Theme - Directory traversal and information disclosure

[security-news at drupal.org]

 * Advisory ID: DRUPAL-SA-CONTRIB-2010-100
 * Projects: Ubuntu Drupal Theme - Brown
 * Version: 5.x, 6.x
 * Date: 2010-October-20
 * Security risk: Moderately critical
 * Exploitable from: Remote
 * Vulnerability: Directory traversal and information disclosure

-------- DESCRIPTION ---------------------------------------------------------

This Ubuntu Drupal Theme - Brown is designed to mimic the old ubuntu.com. The  
theme used a PHP file to generate a gradient image on the fly. User input  
from the URL is not properly validated in this PHP code, leading to a  
directory traversal vulnerability where the contents of any file readable by  
the webserver may be displayed to the remote user, potentially revealing  
sensitive information.
-------- VERSIONS AFFECTED ---------------------------------------------------

 * Ubuntu Drupal Theme - Brown all versions on all branches prior to 6.x-8.1
 * Ubuntu Drupal Theme - Brown for Drupal 5.x

Drupal core is not affected. If you do not use the contributed Ubuntu Drupal  
Theme - Brown [1], there is nothing you need to do.
-------- SOLUTION ------------------------------------------------------------

Install the latest version:
 * If you use the Ubuntu Drupal Theme - Brown for Drupal 6.x (any prior
   version on any branch), upgrade to Ubuntu Drupal Theme - Brown 6.x-8.1 [2]
 * If you use the Ubuntu Drupal Theme - Brown for Drupal 5.x, it is no longer
   supported and should be disabled or the 6.x fix applied

See also the Ubuntu Drupal Theme - Brown project page [3].
-------- REPORTED BY ---------------------------------------------------------

 * Steve Foris

-------- FIXED BY ------------------------------------------------------------

 * MTecknology [4], the Ubuntu Drupal theme maintainer

-------- CONTACT -------------------------------------------------------------

The security team for Drupal [5] can be reached at security at drupal.org or  
via the form at http://drupal.org/contact [6].

Read more about the Security Team and Security Advisories at  
http://drupal.org/security [7].


[1] http://drupal.org/project/udtheme
[2] http://drupal.org/node/947670
[3] http://drupal.org/project/udtheme
[4] http://drupal.org/user/302171
[5] http://drupal.org/security-team
[6] http://drupal.org/contact
[7] http://drupal.org/security