Drupal任意文件上传和会话固定漏洞

Drupal任意文件上传和会话固定漏洞 影响版本:
Drupal Drupal 6.9
Drupal Drupal 6.7
Drupal Drupal 6.6
Drupal Drupal 6.5
Drupal Drupal 6.4
Drupal Drupal 6.3
Drupal Drupal 6.2
Drupal Drupal 6.13
Drupal Drupal 6.12
Drupal Drupal 6.11
Drupal Drupal 6.10
Drupal Drupal 6.1
Drupal Drupal 6.0
Drupal Drupal 5.9
Drupal Drupal 5.8
Drupal Drupal 5.7
Drupal Drupal 5.6
Drupal Drupal 5.5
Drupal Drupal 5.4
Drupal Drupal 5.3
Drupal Drupal 5.2
Drupal Drupal 5.19
Drupal Drupal 5.18
Drupal Drupal 5.17
Drupal Drupal 5.16
Drupal Drupal 5.15
Drupal Drupal 5.13
Drupal Drupal 5.12
Drupal Drupal 5.11
Drupal Drupal 5.10
Drupal Drupal 5.1 revision 1.1
Drupal Drupal 5.1
Drupal Drupal 5.0漏洞描述:
Bugraq ID: 36431

Drupal是一款开放源码的内容管理平台。
Drupal存在多个安全漏洞，安全者可以利用漏洞上传任意文件到服务器，劫持任意会话，未授权访问受影响应用程序。
文件API不正确处理使用部分扩展的文件上传，可导致上传的文件被Apache执行。.htaccess保存在Drupal文件目录中可防止上传被执行。只有当服务器配置忽略.htaccess文件中的指令时这些文件才会被执行。
当匿名用户使用单次登录链接用于确认EMAIL地址和重设忘记的密码时Drupal没有重生成会话ID，在部分条件下恶意用户可以修复和重用目标用户的会话ID。<*参考 
http://drupal.org/node/579482/
*>
SEBUG安全建议:
用户可联系供应商升级到最新版本：
Drupal Drupal 5.18
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.19
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.13
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.10
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 6.13
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 5.12
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.2
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.3
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 6.0
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 6.9
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 6.12
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 6.11
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 5.9
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.1
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.0
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.6
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 6.1
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 5.16
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.8
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.15
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.1 revision 1.1
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.11
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 6.10
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 5.5
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 6.5
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 5.7
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 6.7
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 6.3
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 6.2
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 6.6
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 6.4
Drupal drupal-6.14.tar.gz
http://ftp.drupal.org/files/projects/drupal-6.14.tar.gz
Drupal Drupal 5.4
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz
Drupal Drupal 5.17
Drupal drupal-5.20.tar.gz
http://ftp.drupal.org/files/projects/drupal-5.20.tar.gz