CVE-2008-6171: Input Validation

Published Feb 19, 2009

Updated

includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header.

Affected Software

18 affected components

Drupal Drupal=5.0

Drupal Drupal=5.1

Drupal Drupal=5.2

Drupal Drupal=5.3

Drupal Drupal=5.4

Drupal Drupal=5.5

Drupal Drupal=5.6

Drupal Drupal=5.7

Drupal Drupal=5.8

Drupal Drupal=5.9

Drupal Drupal=5.10

Drupal Drupal=5.11

Drupal Drupal=6.0

Drupal Drupal=6.1

Drupal Drupal=6.2

Drupal Drupal=6.3

Drupal Drupal=6.4

Drupal Drupal=6.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Drupal to a version that resolves this vulnerability.
Fixed in 5.12
Upgrade
Upgrade Drupal to a version that resolves this vulnerability.
Fixed in 6.6

Event History

Feb 19, 2009

CVE Published

via MITRE·03:02 PM

Data Sourced

via MITRE·03:02 PM

Description

Data Sourced

via NVD·03:30 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-6171?

CVE-2008-6171 is classified as a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2008-6171?

To fix CVE-2008-6171, upgrade to Drupal version 5.12 or 6.6 or later.

Which versions of Drupal are affected by CVE-2008-6171?

CVE-2008-6171 affects Drupal versions 5.x before 5.12 and 6.x before 6.6.

Can CVE-2008-6171 be exploited remotely?

Yes, CVE-2008-6171 can be exploited remotely by sending crafted HTTP Host headers.

What are the consequences of not patching CVE-2008-6171?

Failing to patch CVE-2008-6171 may allow attackers to include and execute arbitrary files on the server.