<div dir="ltr"><div><div><div><div><div><div><div>Your application, if written inhouse, is different. <br></div><br>It's source is not in public revision control repositories where a malicious person can scan it for vulnerability.<br><br></div>Yes, security by obscurity is not security. But that only applies if obscurity is your one and ONLY defense line. <br><br></div>Tell me how this Drupal vulnerability is different from any open source project that had issues discovered and patched in public?<br><br></div>Here are examples:<br><br>vBulletin: a popular forum application<br><a href="https://thehackernews.com/2017/12/vbulletin-forum-hacking.html">https://thehackernews.com/2017/12/vbulletin-forum-hacking.html</a><br><br></div><div>WordPress (far more popular than Drupal)<br><a href="https://its.ny.gov/security-advisory/multiple-vulnerabilities-wordpress-content-management-system-could-allow-arbitrary">https://its.ny.gov/security-advisory/multiple-vulnerabilities-wordpress-content-management-system-could-allow-arbitrary</a><br><br></div>Apache Commons Java library<br><a href="https://www.pcworld.com/article/3004633/business-security/thousands-of-java-applications-vulnerable-to-nine-month-old-remote-code-execution-exploit.html">https://www.pcworld.com/article/3004633/business-security/thousands-of-java-applications-vulnerable-to-nine-month-old-remote-code-execution-exploit.html</a><br><br></div><div>Even the bash shell <br><a href="http://seclists.org/oss-sec/2014/q3/650">http://seclists.org/oss-sec/2014/q3/650</a><br><br></div>And it is not only open source, it is proprietary products too<br><a href="https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1">https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1</a><br><br></div>Such vulnerabilities cannot be totally prevented. The right solution is to apply security fixes in a timely matter, and be always in sync with your upstream (e.g. if you installed the thing from your distro's repositories, they will push a fix. If you installed it directly from the project's repositories [as often Drupal is installed], then subscribe to their security update channel).<br><br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Mar 28, 2018 at 8:07 PM, Chris Craig <span dir="ltr"><<a href="mailto:kwlug.org@ciotog.net" target="_blank">kwlug.org@ciotog.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">As a software developer that has to maintain a legacy PHP code base, I<br>
stand by my comment.<br>
<div class="HOEnZb"><div class="h5"><br>
On 28 March 2018 at 17:39, Khalid Baheyeldin <<a href="mailto:kb@2bits.com">kb@2bits.com</a>> wrote:<br>
> Not really.<br>
><br>
> By the same logic one should stop using AMD and Intel. The CPU<br>
> vulnerabilities are bad, and cannot be patched since they are in the<br>
> silicon.<br>
><br>
> The issue here is that this was a vulnerability that is theoretical (i.e. it<br>
> was not used by a malicious party before the disclosure) yet remotely<br>
> exploitable.<br>
><br>
> Now that it is out in the open, exploits will definitely be developed.<br>
><br>
> This is unavoidable in a full disclosure environment like all open source<br>
> projects do, where anyone can do a diff between 7.57 and 7.58 and infer what<br>
> the vulnerability is, and write exploit code.<br>
><br>
><br>
> On Wed, Mar 28, 2018 at 4:49 PM, Chris Craig <<a href="mailto:kwlug.org@ciotog.net">kwlug.org@ciotog.net</a>> wrote:<br>
>><br>
>> Sounds like a reason to stop using drupal...<br>
>><br>
>> On 28 March 2018 at 16:41, Paul Nijjar via kwlug-disc<br>
>> <<a href="mailto:kwlug-disc@kwlug.org">kwlug-disc@kwlug.org</a>> wrote:<br>
>> ><br>
>> > What is the vulnerability, exactly? The patch indicates that users can<br>
>> > input "dangerous keys". What are dangerous keys? Are these query<br>
>> > parameters in the URL? The FAQ is being irritating -- it is telling me<br>
>> > this is a VERY BIG PROBLEM, but it is not telling me what the problem<br>
>> > is.<br>
>> ><br>
>> > How busy is this security mailing list?<br>
>> ><br>
>> > - Paul<br>
>> ><br>
>> ><br>
>> > On Wed, Mar 28, 2018 at 04:24:33PM -0400, Khalid Baheyeldin wrote:<br>
>> >> Thanks Paul,<br>
>> >><br>
>> >> If anyone has Drupal sites, please update them NOW, before you read<br>
>> >> further.<br>
>> >> If you have a Drupal 6 site, there is a patch for it.<br>
>> >><br>
>> >> OK, did that?<br>
>> >><br>
>> >> Now go read this:<br>
>> >><br>
>> >> <a href="https://groups.drupal.org/security/faq-2018-002" rel="noreferrer" target="_blank">https://groups.drupal.org/<wbr>security/faq-2018-002</a><br>
>> >><br>
>> >> Over the next few hours, we will see automated exploits that will own<br>
>> >> sites<br>
>> >> that have been not patched. This is a remote exploit that requires no<br>
>> >> privileges at all.<br>
>> >><br>
>> >> And please subscribe to the security mailing list.<br>
>> >><br>
>> >> On Wed, Mar 28, 2018 at 4:14 PM, Paul Nijjar via kwlug-disc <<br>
>> >> <a href="mailto:kwlug-disc@kwlug.org">kwlug-disc@kwlug.org</a>> wrote:<br>
>> >><br>
>> >> ><br>
>> >> > Khalid forwarded this to Charles and me, but it seems relevant to<br>
>> >> > other people as well if you are running Drupal.<br>
>> >> ><br>
>> >> > - Paul<br>
>> >> ><br>
>> >> > ----- Forwarded message from Khalid Baheyeldin <<a href="mailto:kb@2bits.com">kb@2bits.com</a>> -----<br>
>> >> ><br>
>> >> > Date: Wed, 28 Mar 2018 15:33:52 -0400<br>
>> >> > From: Khalid Baheyeldin <<a href="mailto:kb@2bits.com">kb@2bits.com</a>><br>
>> >> > To: Paul Nijjar <<a href="mailto:paul_nijjar@yahoo.ca">paul_nijjar@yahoo.ca</a>>, Charles McColm <<br>
>> >> > <a href="mailto:chaslinux@gmail.com">chaslinux@gmail.com</a>><br>
>> >> > Subject: Fwd: [Security-news] Drupal core - Highly critical - Remote<br>
>> >> > Code<br>
>> >> > Execution - SA-CORE-2018-002<br>
>> >> ><br>
>> >> > Guys,<br>
>> >> ><br>
>> >> > You have Drupal sites, whether personal or otherwise.<br>
>> >> ><br>
>> >> > Please update your sites now, as automated remote cracking scripts<br>
>> >> > will be<br>
>> >> > developed within a few hours from now.<br>
>> >> ><br>
>> >> ><br>
>> >> > ---------- Forwarded message ----------<br>
>> >> > From: <<a href="mailto:security-news@drupal.org">security-news@drupal.org</a>><br>
>> >> > Date: Wed, Mar 28, 2018 at 3:21 PM<br>
>> >> > Subject: [Security-news] Drupal core - Highly critical - Remote Code<br>
>> >> > Execution - SA-CORE-2018-002<br>
>> >> > To: <a href="mailto:security-news@drupal.org">security-news@drupal.org</a><br>
>> >> ><br>
>> >> ><br>
>> >> > View online: <a href="https://www.drupal.org/sa-core-2018-002" rel="noreferrer" target="_blank">https://www.drupal.org/sa-<wbr>core-2018-002</a><br>
>> >> ><br>
>> >> > Project: Drupal core [1]<br>
>> >> > Date: 2018-March-28<br>
>> >> > Security risk: *Highly critical* 21∕25<br>
>> >> > AC:None/A:None/CI:All/II:All/<wbr>E:Theoretical/TD:Default [2]<br>
>> >> > Vulnerability: Remote Code Execution<br>
>> >> ><br>
>> >> > Description:<br>
>> >> > CVE: CVE-2018-7600<br>
>> >> ><br>
>> >> > A remote code execution vulnerability exists within multiple<br>
>> >> > subsystems of<br>
>> >> > Drupal 7.x and 8.x. This potentially allows attackers to exploit<br>
>> >> > multiple<br>
>> >> > attack vectors on a Drupal site, which could result in the site being<br>
>> >> > completely compromised.<br>
>> >> ><br>
>> >> > The security team has written an FAQ [3] about this issue.<br>
>> >> ><br>
>> >> > Solution:<br>
>> >> > Upgrade to the most recent version of Drupal 7 or 8 core.<br>
>> >> ><br>
>> >> > * *If you are running 7.x, upgrade to Drupal 7.58 [4].* (If you are<br>
>> >> > unable<br>
>> >> > to update immediately, you can attempt to apply this patch [5] to<br>
>> >> > fix<br>
>> >> > the<br>
>> >> > vulnerability until such time as you are able to completely<br>
>> >> > update.)<br>
>> >> > * *If you are running 8.5.x, upgrade to Drupal 8.5.1 [6].* (If you<br>
>> >> > are<br>
>> >> > unable to update immediately, you can attempt to apply this patch<br>
>> >> > [7]<br>
>> >> > to<br>
>> >> > fix the vulnerability until such time as you are able to<br>
>> >> > completely<br>
>> >> > update.)<br>
>> >> ><br>
>> >> > Drupal 8.3.x and 8.4.x are no longer supported and we don't normally<br>
>> >> > provide<br>
>> >> > security releases for unsupported minor releases [8]. However, given<br>
>> >> > the<br>
>> >> > potential severity of this issue, we /are/ providing 8.3.x and 8.4.x<br>
>> >> > releases<br>
>> >> > that includes the fix for sites which have not yet had a chance to<br>
>> >> > update<br>
>> >> > to<br>
>> >> > 8.5.0.<br>
>> >> ><br>
>> >> > Your site's update report page will recommend the 8.5.x release even<br>
>> >> > if you<br>
>> >> > are on 8.3.x or 8.4.x. Please take the time to update to a supported<br>
>> >> > version<br>
>> >> > after installing this security update.<br>
>> >> ><br>
>> >> > * If you are running 8.3.x, upgrade to Drupal 8.3.9 [9] or apply<br>
>> >> > this<br>
>> >> > patch<br>
>> >> > [10].<br>
>> >> > * If you are running 8.4.x, upgrade to Drupal 8.4.6 [11] or apply<br>
>> >> > thispatch<br>
>> >> > [12].<br>
>> >> ><br>
>> >> > This issue also affects Drupal 8.2.x and earlier, which are no longer<br>
>> >> > supported. If you are running any of these versions of Drupal 8,<br>
>> >> > update to<br>
>> >> > a<br>
>> >> > more recent release and then follow the instructions above.<br>
>> >> ><br>
>> >> > This issue also affects Drupal 6. Drupal 6 is End of Life. For more<br>
>> >> > information on Drupal 6 support please contact a D6LTS vendor [13].<br>
>> >> ><br>
>> >> > Reported By:<br>
>> >> > * Jasper Mattsson [14]<br>
>> >> ><br>
>> >> > Fixed By:<br>
>> >> > * Jasper Mattsson [15]<br>
>> >> > * Samuel Mortenson [16] Provisional Drupal Security Team member<br>
>> >> > * David Rothstein [17] of the Drupal Security Team<br>
>> >> > * Jess (xjm) [18] of the Drupal Security Team<br>
>> >> > * Michael Hess [19] of the Drupal Security Team<br>
>> >> > * Lee Rowlands [20] of the Drupal Security Team<br>
>> >> > * Peter Wolanin [21] of the Drupal Security Team<br>
>> >> > * Alex Pott [22] of the Drupal Security Team<br>
>> >> > * David Snopek [23] of the Drupal Security Team<br>
>> >> > * Pere Orga [24] of the Drupal Security Team<br>
>> >> > * Neil Drumm [25] of the Drupal Security Team<br>
>> >> > * Cash Williams [26] of the Drupal Security Team<br>
>> >> > * Daniel Wehner [27]<br>
>> >> > * Tim Plunkett [28]<br>
>> >> ><br>
>> >> > -------- CONTACT AND MORE INFORMATION<br>
>> >> > ------------------------------<wbr>----------<br>
>> >> ><br>
>> >> > The Drupal security team can be reached by email at security at<br>
>> >> > <a href="http://drupal.org" rel="noreferrer" target="_blank">drupal.org</a><br>
>> >> > or<br>
>> >> > via the contact form.<br>
>> >> ><br>
>> >> > Learn more about the Drupal Security team and their policies, writing<br>
>> >> > secure<br>
>> >> > code for Drupal, and securing your site.<br>
>> >> ><br>
>> >> ><br>
>> >> > [1] <a href="https://www.drupal.org/project/drupal" rel="noreferrer" target="_blank">https://www.drupal.org/<wbr>project/drupal</a><br>
>> >> > [2] <a href="https://www.drupal.org/security-team/risk-levels" rel="noreferrer" target="_blank">https://www.drupal.org/<wbr>security-team/risk-levels</a><br>
>> >> > [3] <a href="https://groups.drupal.org/security/faq-2018-002" rel="noreferrer" target="_blank">https://groups.drupal.org/<wbr>security/faq-2018-002</a><br>
>> >> > [4] <a href="https://www.drupal.org/project/drupal/releases/7.58" rel="noreferrer" target="_blank">https://www.drupal.org/<wbr>project/drupal/releases/7.58</a><br>
>> >> > [5]<br>
>> >> > <a href="https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=2266d2a" rel="noreferrer" target="_blank">https://cgit.drupalcode.org/<wbr>drupal/rawdiff/?h=7.x&id=<wbr>2266d2a</a><br>
>> >> > 83db50e2f97682d9a0fb8a18e2722c<wbr>ba5<br>
>> >> > [6] <a href="https://www.drupal.org/project/drupal/releases/8.5.1" rel="noreferrer" target="_blank">https://www.drupal.org/<wbr>project/drupal/releases/8.5.1</a><br>
>> >> > [7]<br>
>> >> > <a href="https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac87" rel="noreferrer" target="_blank">https://cgit.drupalcode.org/<wbr>drupal/rawdiff/?h=8.5.x&id=<wbr>5ac87</a><br>
>> >> > 38fa69df34a0635f0907d661b509ff<wbr>9a28f<br>
>> >> > [8] <a href="https://www.drupal.org/core/release-cycle-overview" rel="noreferrer" target="_blank">https://www.drupal.org/core/<wbr>release-cycle-overview</a><br>
>> >> > [9] <a href="https://www.drupal.org/project/drupal/releases/8.3.9" rel="noreferrer" target="_blank">https://www.drupal.org/<wbr>project/drupal/releases/8.3.9</a><br>
>> >> > [10]<br>
>> >> > <a href="https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac87" rel="noreferrer" target="_blank">https://cgit.drupalcode.org/<wbr>drupal/rawdiff/?h=8.5.x&id=<wbr>5ac87</a><br>
>> >> > 38fa69df34a0635f0907d661b509ff<wbr>9a28f<br>
>> >> > [11] <a href="https://www.drupal.org/project/drupal/releases/8.4.6" rel="noreferrer" target="_blank">https://www.drupal.org/<wbr>project/drupal/releases/8.4.6</a><br>
>> >> > [12]<br>
>> >> > <a href="https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=5ac87" rel="noreferrer" target="_blank">https://cgit.drupalcode.org/<wbr>drupal/rawdiff/?h=8.5.x&id=<wbr>5ac87</a><br>
>> >> > 38fa69df34a0635f0907d661b509ff<wbr>9a28f<br>
>> >> > [13] <a href="https://www.drupal.org/project/d6lts" rel="noreferrer" target="_blank">https://www.drupal.org/<wbr>project/d6lts</a><br>
>> >> > [14] <a href="https://www.drupal.org/u/Jasu_M" rel="noreferrer" target="_blank">https://www.drupal.org/u/Jasu_<wbr>M</a><br>
>> >> > [15] <a href="https://www.drupal.org/u/Jasu_M" rel="noreferrer" target="_blank">https://www.drupal.org/u/Jasu_<wbr>M</a><br>
>> >> > [16] <a href="https://www.drupal.org/user/2582268" rel="noreferrer" target="_blank">https://www.drupal.org/user/<wbr>2582268</a><br>
>> >> > [17] <a href="https://www.drupal.org/user/124982" rel="noreferrer" target="_blank">https://www.drupal.org/user/<wbr>124982</a><br>
>> >> > [18] <a href="https://www.drupal.org/user/65776" rel="noreferrer" target="_blank">https://www.drupal.org/user/<wbr>65776</a><br>
>> >> > [19] <a href="https://www.drupal.org/user/102818" rel="noreferrer" target="_blank">https://www.drupal.org/user/<wbr>102818</a><br>
>> >> > [20] <a href="https://www.drupal.org/u/larowlan" rel="noreferrer" target="_blank">https://www.drupal.org/u/<wbr>larowlan</a><br>
>> >> > [21] <a href="https://www.drupal.org/user/49851" rel="noreferrer" target="_blank">https://www.drupal.org/user/<wbr>49851</a><br>
>> >> > [22] <a href="https://www.drupal.org/u/alexpott" rel="noreferrer" target="_blank">https://www.drupal.org/u/<wbr>alexpott</a><br>
>> >> > [23] <a href="https://www.drupal.org/u/dsnopek" rel="noreferrer" target="_blank">https://www.drupal.org/u/<wbr>dsnopek</a><br>
>> >> > [24] <a href="https://www.drupal.org/u/pere-orga" rel="noreferrer" target="_blank">https://www.drupal.org/u/pere-<wbr>orga</a><br>
>> >> > [25] <a href="https://www.drupal.org/u/drumm" rel="noreferrer" target="_blank">https://www.drupal.org/u/drumm</a><br>
>> >> > [26] <a href="https://www.drupal.org/u/cashwilliams" rel="noreferrer" target="_blank">https://www.drupal.org/u/<wbr>cashwilliams</a><br>
>> >> > [27] <a href="https://www.drupal.org/u/dawehner" rel="noreferrer" target="_blank">https://www.drupal.org/u/<wbr>dawehner</a><br>
>> >> > [28] <a href="https://www.drupal.org/u/tim.plunkett" rel="noreferrer" target="_blank">https://www.drupal.org/u/tim.<wbr>plunkett</a><br>
>> >> ><br>
>> >> > ______________________________<wbr>_________________<br>
>> >> > Security-news mailing list<br>
>> >> > <a href="mailto:Security-news@drupal.org">Security-news@drupal.org</a><br>
>> >> > Unsubscribe at<br>
>> >> > <a href="https://lists.drupal.org/mailman/listinfo/security-news" rel="noreferrer" target="_blank">https://lists.drupal.org/<wbr>mailman/listinfo/security-news</a><br>
>> >> ><br>
>> >> ><br>
>> >> ><br>
>> >> > --<br>
>> >> > Khalid M. Baheyeldin<br>
>> >> > <a href="http://2bits.com" rel="noreferrer" target="_blank">2bits.com</a>, Inc.<br>
>> >> > Fast Reliable Drupal<br>
>> >> > Drupal optimization, development, customization and consulting.<br>
>> >> > Simplicity is prerequisite for reliability. -- Edsger W.Dijkstra<br>
>> >> > Simplicity is the ultimate sophistication. -- anonymous<br>
>> >> ><br>
>> >> > ----- End forwarded message -----<br>
>> >> ><br>
>> >> > --<br>
>> >> > <a href="http://pnijjar.freeshell.org" rel="noreferrer" target="_blank">http://pnijjar.freeshell.org</a><br>
>> >> ><br>
>> >> > ______________________________<wbr>_________________<br>
>> >> > kwlug-disc mailing list<br>
>> >> > <a href="mailto:kwlug-disc@kwlug.org">kwlug-disc@kwlug.org</a><br>
>> >> > <a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" rel="noreferrer" target="_blank">http://kwlug.org/mailman/<wbr>listinfo/kwlug-disc_kwlug.org</a><br>
>> >> ><br>
>> >><br>
>> >><br>
>> >><br>
>> >> --<br>
>> >> Khalid M. Baheyeldin<br>
>> >> <a href="http://2bits.com" rel="noreferrer" target="_blank">2bits.com</a>, Inc.<br>
>> >> Fast Reliable Drupal<br>
>> >> Drupal optimization, development, customization and consulting.<br>
>> >> Simplicity is prerequisite for reliability. -- Edsger W.Dijkstra<br>
>> >> Simplicity is the ultimate sophistication. -- anonymous<br>
>> ><br>
>> > --<br>
>> > <a href="http://pnijjar.freeshell.org" rel="noreferrer" target="_blank">http://pnijjar.freeshell.org</a><br>
>> ><br>
>> > ______________________________<wbr>_________________<br>
>> > kwlug-disc mailing list<br>
>> > <a href="mailto:kwlug-disc@kwlug.org">kwlug-disc@kwlug.org</a><br>
>> > <a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" rel="noreferrer" target="_blank">http://kwlug.org/mailman/<wbr>listinfo/kwlug-disc_kwlug.org</a><br>
><br>
><br>
><br>
><br>
> --<br>
> Khalid M. Baheyeldin<br>
> <a href="http://2bits.com" rel="noreferrer" target="_blank">2bits.com</a>, Inc.<br>
> Fast Reliable Drupal<br>
> Drupal optimization, development, customization and consulting.<br>
> Simplicity is prerequisite for reliability. -- Edsger W.Dijkstra<br>
> Simplicity is the ultimate sophistication. -- anonymous<br>
><br>
><br>
> ______________________________<wbr>_________________<br>
> kwlug-disc mailing list<br>
> <a href="mailto:kwlug-disc@kwlug.org">kwlug-disc@kwlug.org</a><br>
> <a href="http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org" rel="noreferrer" target="_blank">http://kwlug.org/mailman/<wbr>listinfo/kwlug-disc_kwlug.org</a><br>
><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Khalid M. Baheyeldin<br><a href="http://2bits.com" target="_blank">2bits.com</a>, Inc.<br>Fast Reliable Drupal<br>Drupal optimization, development, customization and consulting.<br>Simplicity is prerequisite for reliability. -- Edsger W.Dijkstra<br>Simplicity is the ultimate sophistication. -- anonymous<br><br></div></div></div>
</div>