Details on a patched denial of service vulnerability in the open source Drupal content management system have been disclosed. The vulnerability, patched yesterday, could be abused to crash a website running on the CMS. Researchers Michael Cullum, Javier Nieto and Andres Rojas Guerrero reported the bug to Drupal and urge site owners and Drupal admins to upgrade Drupal 6.x to Drupal core 6.34 or 7.x to Drupal core 7.34. The vulnerability exposes user names in addition to threatening the availability of a Drupal site. The researchers said they were able to guess a valid Drupal user name by exploiting the bug by entering an overly long password; they give an example of a million-character password. They explain that Drupal only calculates a password hash for valid user names; by measuring the time it takes to get a response from the system with a long password, they can infer that the user name they tried is valid. “In Drupal, the way of calculating the password hash (SHA512 with a salt) by using phpass results in the CPU and memory resources being affected when really long passwords are provided,” the researchers wrote. “If we perform several log-in attempts by using a valid username at the same time with long passwords, that causes a denial of service in the server.” Depending on the server configuration—in this case Drupal 7.32 running on Apache with a MySQL default installation—the attack crashes the entire server. The researchers said this happens because the RAM and CPU limits are reached. It can also crash the database, they said. “If the Apache configuration is optimized and tuned to the hardware resources, we are able to reach all sessions available quickly and handle them for 30 seconds which performs a DOS without crashing the server or database,” the researchers said, adding that 30 seconds is the longest a script can run before it is terminated by a parser. “This helps prevent poorly written scripts from tying up the server.” The researchers said they will publish a proof of concept attack at a later time. This vulnerability was rated moderately critical by Drupal, unlike a much more serious SQL injection flaw that became public on Oct. 15. The flaw was found in a Drupal module designed to defend against SQL injection attacks. Attackers quickly wrote automated exploits targeting the vulnerability; the attacks worked without the need for a Drupal account and left no trace. Drupal quickly released an advisory urging site admins to proceed as if every Drupal 7 site that was not patched within hours of the announcement were compromised. “Attackers may have created access points for themselves (sometimes called ‘backdoors’) in the database, code, files directory and other locations. Attackers could compromise other services on the server or escalate their access. Removing a compromised website’s backdoors is difficult because it is not possible to be certain all backdoors have been found,” Drupal said in a statement. The patch was made available on Oct. 15; the vulnerability was found in a database abstraction API that sanitized queries to prevent SQL injection. Source: http://threatpost.com/drupal-patches-denial-of-service-vulnerability-details-disclosed/109502

Original post:
Drupal Patches Denial of Service Vulnerability

Update 5:50 a.m. PST: The servers are now down for maintenance, and the attack is over. If further ones happen, we’ll announce accordingly. Update 8:15 p.m. PST The DDoS attacks continue. Blizzard is rolling out updates to the backend services at a breakneck pace right now, some of which are having unintended consequences and further complicating an already messy situation. However, it should be noted that this is to be expected when combating such a large scale attack. In no way is Blizzard responsible for the server outages on this scale — responsibility rests with the script kiddies and bot net controllers. It’s hard to know just how big this attack is, but with the sustained issues it’s causing, and the severity of response from Blizzard, it’s safe to assume that it’s big . Battle.net is a hardened internet service that has withstood onslaughts like this before. For it to fail at such a critical juncture is nothing but catastrophic for the short term, and could have serious long term implications. We have some idea, shown above, of just how global this attack is. We’ll update this post as the night continues, providing you with the latest. In the mean time — we recommend you catch up on your lore, and not concern yourself with logging in. Original Post: WoW Insider received reports earlier today that Blizzard may be the target of a significant DDoS effort — and community manager Bashiok has confirmed it on the World of Warcraft forums. Bashiok goes on to outline additional issues Blizzard is currently attempting to resolve: instance servers timing out, disconnects from the continent servers, and performance and phasing issues with garrisons. Source: http://wow.joystiq.com/2014/11/13/blizzard-confirms-world-of-warcraft-target-of-ddos-attack/

Visit site:
Blizzard confirms World of Warcraft target of DDoS attack