PT-2005-4713 · Microsoft+1 · Internet Explorer+1

Paul Laudanski · Publicado 2005-12-03 · Atualizado 2018-10-19 · CVE-2005-3975

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 4.5.0 through 4.5.5 Drupal versions 4.6.0 through 4.6.3

Description The issue is related to an interpretation conflict in the file.inc file, allowing remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPEG file extension. This causes the HTML to be executed by a victim who views the file in Internet Explorer.

Recommendations For versions 4.5.0 through 4.5.5, update to a version outside of this range to mitigate the risk. For versions 4.6.0 through 4.6.3, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to files with GIF or JPEG extensions to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2005-3975

DSA-958-1

Produtos afetados

Drupal

Internet Explorer

Referências · 11

• http://securityfocus.com/archive/1/418291/100/0/threaded · Nota
• http://vupen.com/english/advisories/2005/2684 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-3975 · Nota de Segurança
• http://drupal.org/files/sa-2005-008/4.6.3.patch · Nota
• http://drupal.org/files/sa-2005-008/advisory.txt · Aviso do Fabricante
• http://securityreason.com/securityalert/220 · Nota
• http://securityfocus.com/bid/15663 · Correção
• http://secunia.com/advisories/18630 · Nota
• http://debian.org/security/2006/dsa-958 · Aviso do Fabricante
• http://secunia.com/advisories/17824 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3975 · Nota