SA-CONTRIB-2015-048 - Avatar Uploader - Arbitrary PHP code execution

Avatar Uploader module provides an alternative way to upload user pictures.

The module doesn’t sufficiently enforce file extensions when an avatar is uploaded, allowing users to bypass Drupal’s normal file upload protections to install malicious HTML or executable code to the server.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “upload avatar file”, and that the fix for SA-2006-006 - Drupal Core - Execution of arbitrary files in certain Apache configurations should prevent code execution in typical Apache configurations.

CVE identifier(s) issued

• CVE-2015-2087

Versions affected

• Avatar Uploader 6.x-1.x versions prior to 6.x-1.3.

Drupal core is not affected. If you do not use the contributed Avatar Uploader module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Avatar Uploader module for Drupal 6.x, upgrade to Avatar Uploader 6.x-1.3

Also see the Avatar Uploader project page.

Reported by

• Liran Tal

Fixed by

• Robbin Gaoxin Zhao, the module maintainer

Coordinated by

• Pere Orga of the Drupal Security Team