View online: https://drupal.org/node/2023585
* Advisory ID: DRUPAL-SA-CONTRIB-2013-053 * Project: Login Security [1] (third-party module) * Version: 6.x, 7.x * Date: 2013-June-19 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities
-------- DESCRIPTION ---------------------------------------------------------
Login Security module adds additional access controls to the login form of Drupal.
When Login Security is configured to use the delay feature, frequent or concurrent failed attempts to login can consume all the web serving processes, causing a denial of service.
It is possible to bypass Login Security features when soft blocking is disabled. This is due to the incorrect use of string filtering in the module which can cause the module to skip all checks.
-------- CVE IDENTIFIER(S) ISSUED --------------------------------------------
* /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./
-------- VERSIONS AFFECTED ---------------------------------------------------
* Login Security 6.x-1.x versions prior to 6.x-1.2. * Login Security 7.x-1.x versions prior to 7.x-1.2.
Drupal core is not affected. If you do not use the contributed Login Security [4] module, there is nothing you need to do.
-------- SOLUTION ------------------------------------------------------------
Install the latest version:
* If you use the Login Security module for Drupal 6.x, upgrade to Login Security 6.x-1.3 [5] * If you use the Login Security module for Drupal 7.x, upgrade to Login Security 7.x-1.3 [6]
Also see the Login Security [7] project page.
-------- REPORTED BY ---------------------------------------------------------
* David Stoline [8] and Heine Deelstra [9] of the Drupal Security Team
-------- FIXED BY ------------------------------------------------------------
* David Norman [10] the module maintainer * Chris Yu [11]
-------- COORDINATED BY ------------------------------------------------------
* David Stoline [12] of the Drupal Security Team
-------- CONTACT AND MORE INFORMATION ----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [13].
Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16].
[1] http://drupal.org/project/login_security [2] http://drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] http://drupal.org/project/login_security [5] https://drupal.org/node/2023503 [6] https://drupal.org/node/2023507 [7] http://drupal.org/project/login_security [8] http://drupal.org/user/329570 [9] http://drupal.org/user/17943 [10] http://drupal.org/user/972 [11] http://drupal.org/user/202205 [12] http://drupal.org/user/329570 [13] http://drupal.org/contact [14] http://drupal.org/security-team [15] http://drupal.org/writing-secure-code [16] http://drupal.org/security/secure-configuration