PT-2014-8787 · Drupal · Secure Password Hashes Module+1

Pwolanin · Publicado 2014-11-24 · Atualizado 2021-04-20 · CVE-2014-9016

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.34 Secure Password Hashes module versions prior to 6.x-2.1

Description The password hashing API allows remote attackers to cause a denial of service via a crafted request, resulting in CPU and memory consumption.

Recommendations For Drupal versions prior to 7.34, update to version 7.34 or later. For Secure Password Hashes module versions prior to 6.x-2.1, update to version 6.x-2.1 or later.

Exploit

Correção

Identificadores relacionados

CVE-2014-9016

DSA-3075-1

MGASA-2014-0492

Produtos afetados

Drupal

Secure Password Hashes Module

Referências · 26

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/wordpress_long_password_dos.rb · Exploit
• 🔥 https://github.com/c0r3dump3d/wp_drupal_timing_attack · Exploit
• 🔥 https://exploit-db.com/exploits/35415 · Exploit
• https://drupal.org/drupal-7.33-release-notes · Nota
• http://openwall.com/lists/oss-security/2014/11/20/21 · Nota
• https://debian.org/security/2014/dsa-3075 · Aviso do Fabricante
• https://drupal.org/SA-CORE-2014-006 · Aviso do Fabricante
• http://secunia.com/advisories/59164 · Nota
• http://secunia.com/advisories/59814 · Nota
• https://cve.org/CVERecord?id=CVE-2014-9016 · Nota de Segurança
• http://debian.org/security/2014/dsa-3075 · Aviso do Fabricante
• https://drupal.org/drupal-7.34 · Nota
• https://drupal.org/node/2378375 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9016 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=14614 · Nota