Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.0897
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002
29 March 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Drupal
Publisher: Drupal
Operating System: UNIX variants (UNIX, Linux, OSX)
Windows
BSD variants
Impact/Access: Administrator Compromise -- Remote/Unauthenticated
Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-7600
Original Bulletin:
https://www.drupal.org/sa-core-2018-002
- --------------------------BEGIN INCLUDED TEXT--------------------
Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002
Project: Drupal core
Date: 2018-March-28
Security risk: Highly critical
21/25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Default
Vulnerability: Remote Code Execution
Description: CVE: CVE-2018-7600
A remote code execution vulnerability exists within multiple subsystems of
Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple
attack vectors on a Drupal site, which could result in the site being
completely compromised.
The security team has written an FAQ about this issue.
Solution:
Upgrade to the most recent version of Drupal 7 or 8 core.
* If you are running 7.x, upgrade to Drupal 7.58. (If you are unable to
update immediately, you can attempt to apply this patch to fix the
vulnerability until such time as you are able to completely update.)
* If you are running 8.5.x, upgrade to Drupal 8.5.1. (If you are unable to
update immediately, you can attempt to apply this patch to fix the
vulnerability until such time as you are able to completely update.)
Drupal 8.3.x and 8.4.x are no longer supported and we don't normally provide
security releases for unsupported minor releases. However, given the potential
severity of this issue, we are providing 8.3.x and 8.4.x releases that includes
the fix for sites which have not yet had a chance to update to 8.5.0.
Your site's update report page will recommend the 8.5.x release even if you are
on 8.3.x or 8.4.x. Please take the time to update to a supported version after
installing this security update.
* If you are running 8.3.x, upgrade to Drupal 8.3.9 or apply this patch.
* If you are running 8.4.x, upgrade to Drupal 8.4.6 or apply this patch.
This issue also affects Drupal 8.2.x and earlier, which are no longer
supported. If you are running any of these versions of Drupal 8, update to a
more recent release and then follow the instructions above.
This issue also affects Drupal 6. Drupal 6 is End of Life. For more information
on Drupal 6 support please contact a D6LTS vendor.
Reported By:
* Jasper Mattsson
Fixed By:
* Jasper Mattsson
* Samuel Mortenson Provisional Drupal Security Team member
* David Rothstein of the Drupal Security Team
* Jess (xjm) of the Drupal Security Team
* Michael Hess of the Drupal Security Team
* Lee Rowlands of the Drupal Security Team
* Peter Wolanin of the Drupal Security Team
* Alex Pott of the Drupal Security Team
* David Snopek of the Drupal Security Team
* Pere Orga of the Drupal Security Team
* Neil Drumm of the Drupal Security Team
* Cash Williams of the Drupal Security Team
* Daniel Wehner
* Tim Plunkett
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWrwcP4x+lLeg9Ub1AQizcw//eLxhs0tk2yGTvsHayo/cmLMqHo+RTOHP
om3mj9Fcz4Nn7Zg9x4kwhkqN/NKrjJeE14yruuIOwKFi1c0Cfl/atyKuvmpx14b+
yc+SGFwtZjT0JJkK2u9KzzdDUFKr/FIzT6F14bCLc4QOf3D3TW3Xqh882x+4NY6p
gCzFMbeIBKozvUHhtgdtzo5EhZyVRdUVKlJpd9t2oXjPLfMQUZYhem5YDEgUBhep
atJjxXfcoSTN4+V11XLknqn4wb177lL5quOyABW4uM8VliYdc6N98JgYdRkJwgYP
eAHpaPDVC6qKQMGLr7L+I2Dc7IgNOWFGeU0LImUeETOJdxXiAB9MRdKDas4mvZsP
RG7ixrsxjoebcQGj+FPaJeKV/5Vqhibo5jXeTeXQMZtDBJXF1iI4eJgll9iXo5FQ
hkNRuzkI7X4p2YU5pULoNfV2+aouXcDYAMso9PBLYEB3iPY72r/ykvCkhczi/w3p
9tFxF78gtfXcTh4+7TWNkmLBT2GAXtMNTHaoDqSOMfIkCthMFtR4KdmiG0HrQkfu
1pMjZo0V7oqDFMKQH2xkEBcOVhx52eVuseoO2zoqDhYdvMt5hGoR2Eb10YQlvP9l
oV0vrH3HDxA7aUpAE74X6gIhamXBcpqrLWR936CAdv/N435c16m/16W3Od2pC2PR
anTjmOrgNBA=
=V2vA
-----END PGP SIGNATURE-----