Description
includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header.
References
- http://drupal.org/node/324824
- drupal-unspecified-file-include(46049) vdb-entry
- 32441 third-party-advisory
- 31900 vdb-entry
- http://drupal.org/files/sa-2008-067/SA-2008-067-5.11.patch
- FEDORA-2008-9170 vendor-advisory
- 32389 third-party-advisory
- FEDORA-2008-9213 vendor-advisory
- ADV-2008-2913 vdb-entry