Test ID:	1.3.6.1.4.1.25623.1.0.63957
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-1792-1)
Summary:	The remote host is missing an update for the Debian 'drupal6' package(s) announced via the DSA-1792-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'drupal6' package(s) announced via the DSA-1792-1 advisory. Vulnerability Insight: Multiple vulnerabilities have been discovered in drupal, a web content management system. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1575 pod.Edge discovered a cross-site scripting vulnerability due that can be triggered when some browsers interpret UTF-8 strings as UTF-7 if they appear before the generated HTML document defines its Content-Type. This allows a malicious user to execute arbitrary javascript in the context of the web site if they're allowed to post content. CVE-2009-1576 Moritz Naumann discovered an information disclosure vulnerability. If a user is tricked into visiting the site via a specially crafted URL and then submits a form (such as the search box) from that page, the information in their form submission may be directed to a third-party site determined by the URL and thus disclosed to the third party. The third party site may then execute a cross-site request forgery attack against the submitted form. The old stable distribution (etch) does not contain drupal and is not affected. For the stable distribution (lenny), these problems have been fixed in version 6.6-3lenny1. For the unstable distribution (sid), these problems have been fixed in version 6.11-1 We recommend that you upgrade your drupal6 package. Affected Software/OS: 'drupal6' package(s) on Debian 5. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-1575 Debian Security Information: DSA-1792 (Google Search) http://www.debian.org/security/2009/dsa-1792 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00108.html https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00133.html http://www.osvdb.org/54152 http://secunia.com/advisories/34948 http://secunia.com/advisories/34950 http://secunia.com/advisories/34980 http://www.vupen.com/english/advisories/2009/1216 XForce ISS Database: drupal-utf7-xss(50250) https://exchange.xforce.ibmcloud.com/vulnerabilities/50250 Common Vulnerability Exposure (CVE) ID: CVE-2009-1576 http://drupal.org/files/sa-core-2009-005/SA-CORE-2009-005-5.16.patch http://www.osvdb.org/54153
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.