Uwe Hermann
08/01/07, 12:47
--tsOsTdHNUZQcU9Ye
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
----------------------------------------------------------------------------
Drupal security advisory DRUPAL-SA-2007-002
----------------------------------------------------------------------------
Project: Drupal core.
Date: 2007-Jan-05.
Security risk: Less critical.
Exploitable from: Remote.
Vulnerability: Denial of service.
----------------------------------------------------------------------------
=20
Description
-----------
The way page caching was implemented allows a denial of service attack.=20
An attacker has to have the ability to post content on the site. He or she=
=20
would then be able to poison the page cache, so that it returns cached 404=
=20
page not found errors for existing pages.
If the page cache is not enabled, your site is not vulnerable. The=20
vulnerability only affects sites running on top of MySQL.
=20
Versions affected
-----------------
- Drupal 4.6.x versions before Drupal 4.6.11
- Drupal 4.7.x versions before Drupal 4.7.5
Solution
--------
- If you are running Drupal 4.6.x then upgrade to Drupal 4.6.11.
http://ftp.osuosl.org/pub/drupal/files/projects/drupal-4.6.11.tar.gz
- If you are running Drupal 4.7.x then upgrade to Drupal 4.7.5.
http://ftp.osuosl.org/pub/drupal/files/projects/drupal-4.7.5.tar.gz
- To patch Drupal 4.6.10 use http://drupal.org/files/sa-2006-002/4.6.10.pat=
ch.
- To patch Drupal 4.7.4 use http://drupal.org/files/sa-2006-002/4.7.4.patch.
Please note that the patches only contain changes related to this advisory,=
and=20
do not fix bugs that were solved in 4.6.11 or 4.7.5.
Reported by
-----------
Drupal security team.
Contact
-------
The security contact for Drupal can be reached at security at drupal.org or=
=20
using the form at http://drupal.org/contact.
// Uwe Hermann, on behalf of the Drupal Security Team.
--=20
http://www.hermann-uwe.de | http://www.holsham-traders.de
http://www.crazy-hacks.org | http://www.unmaintained-free-software.org
--tsOsTdHNUZQcU9Ye
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFFnjscXdVoV3jWIbQRAlShAKCCgVC5+rlms70ZhTsu+r hWMUNE3wCfct9x
jsxhz9w+pvmS6dKDlasiIy4=
=LHmi
-----END PGP SIGNATURE-----
--tsOsTdHNUZQcU9Ye--
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
----------------------------------------------------------------------------
Drupal security advisory DRUPAL-SA-2007-002
----------------------------------------------------------------------------
Project: Drupal core.
Date: 2007-Jan-05.
Security risk: Less critical.
Exploitable from: Remote.
Vulnerability: Denial of service.
----------------------------------------------------------------------------
=20
Description
-----------
The way page caching was implemented allows a denial of service attack.=20
An attacker has to have the ability to post content on the site. He or she=
=20
would then be able to poison the page cache, so that it returns cached 404=
=20
page not found errors for existing pages.
If the page cache is not enabled, your site is not vulnerable. The=20
vulnerability only affects sites running on top of MySQL.
=20
Versions affected
-----------------
- Drupal 4.6.x versions before Drupal 4.6.11
- Drupal 4.7.x versions before Drupal 4.7.5
Solution
--------
- If you are running Drupal 4.6.x then upgrade to Drupal 4.6.11.
http://ftp.osuosl.org/pub/drupal/files/projects/drupal-4.6.11.tar.gz
- If you are running Drupal 4.7.x then upgrade to Drupal 4.7.5.
http://ftp.osuosl.org/pub/drupal/files/projects/drupal-4.7.5.tar.gz
- To patch Drupal 4.6.10 use http://drupal.org/files/sa-2006-002/4.6.10.pat=
ch.
- To patch Drupal 4.7.4 use http://drupal.org/files/sa-2006-002/4.7.4.patch.
Please note that the patches only contain changes related to this advisory,=
and=20
do not fix bugs that were solved in 4.6.11 or 4.7.5.
Reported by
-----------
Drupal security team.
Contact
-------
The security contact for Drupal can be reached at security at drupal.org or=
=20
using the form at http://drupal.org/contact.
// Uwe Hermann, on behalf of the Drupal Security Team.
--=20
http://www.hermann-uwe.de | http://www.holsham-traders.de
http://www.crazy-hacks.org | http://www.unmaintained-free-software.org
--tsOsTdHNUZQcU9Ye
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFFnjscXdVoV3jWIbQRAlShAKCCgVC5+rlms70ZhTsu+r hWMUNE3wCfct9x
jsxhz9w+pvmS6dKDlasiIy4=
=LHmi
-----END PGP SIGNATURE-----
--tsOsTdHNUZQcU9Ye--