[Security-news] SA-CONTRIB-2010-015 - Signwriter - Arbitrary code execution

0 views

Skip to first unread message

securi...@drupal.org

unread,

Feb 3, 2010, 3:09:15 PM2/3/10

to securi...@drupal.org

* Advisory ID: DRUPAL-SA-CONTRIB-2010-015
* Project: Signwriter (third-party module)
* Version: 5.x, 6.x
* Date: 2010-February-3
* Security risk: Critical
* Exploitable from: Remote
* Vulnerability: Arbitrary code execution

-------- DESCRIPTION
---------------------------------------------------------

The Signwriter module allows the use of TrueType fonts to replace text in
headings, blocks, menus and filtered text. This vulnerability allows a remote
attacker with the ability to create content using an input filter created
with a Signwriter profile to execute arbitrary PHP code on an affected
system. The vulnerability exists due to unsafe use of PHP's preg_replace
function with the e option, causing the replacement to be executed as PHP
code.
-------- VERSIONS AFFECTED
---------------------------------------------------

* Signwriter for Drupal 5.x prior to 5.x-1.6
* Signwriter for Drupal 6.x prior to 6.x-2.0-beta2

Drupal core is not affected. If you do not use the Signwriter, there is
nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

Upgrade to the latest version:

* If you use Signwriter for Drupal 5.x upgrade to Signwriter 5.x-1.6 [1]
* If you use Signwriter for Drupal 6.x upgrade to Signwriter 6.x-2.0-beta2
[2]