To Customer Support To Customer Support

Drupal warns unless you patched within seven hours, you're hacked

  • 29 October 2014
  • 1 reply
  • 642 views
Richard
Userlevel 6
Well, another hit in the Drupal community.
 
Source: http://www.zdnet.com/drupal-warns-unless-you-patched-within-seven-hours-youre-hacked-7000035219/



 
Drupal has issued a highly critical announcement that unless Drupal installs were patched against the latest SQL injection attack within seven hours of its unveiling, that the site should be considered compromised.
 
Drupal's security team has released a "public service announcement" calling upon all users of the Drupal content management framework to consider their sites as compromised, and to start afresh, unless their sites were patched against the SQL injection attack revealed two weeks ago within seven hours of the announcement of the vulnerability.
 
 
"You should proceed under the assumption that every Drupal 7 website was compromised unless updated or patched before Oct 15th, 11pm UTC, that is 7 hours after the announcement," the Drupal security announcement said.
 
 
Read more: http://www.zdnet.com/drupal-warns-unless-you-patched-within-seven-hours-youre-hacked-7000035219/
--Richard Melick-- Marketing Outreach Specialist Webroot ThreatBlog Stay updated with unique security news and follow me on Twitter

1 reply

R
Rank
Userlevel 7
The following article is a update

(Drupal: Attacks Started Within Hours Of Patch Release)

By Brian Prince/ Posted on 10/31/2014
 
If you didn't patch your site quickly, you should assume it was compromised, Drupal says.
 Users of the Drupal content management system platform got a rude awakening this week: According to Drupal, automated attacks began compromising Drupal 7 websites that were not patched or updated to Drupal 7.32 within hours of the announcement of SA-CORE-2014-005 -- Drupal core -- SQL injection. And here's the kicker –- users should proceed with the assumption that every Drupal 7 website was compromised unless it was updated before 11:00 p.m. UTC on Oct. 15.
The vulnerability in question is a bug in a database abstraction API that allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the requests, this can lead to privilege escalation, arbitrary PHP execution, or other attacks as well, according to Drupal.
Not long after a security advisory was posted Oct. 15, multiple attacks were reported in the wild.
 
 
Full Article

Reply


Terms & Conditions

© 2004 - Webroot Inc.

We have recently updated our Privacy Policies. We encourage you to read the full terms here.