PT-2014-8787 · Drupal · Secure Password Hashes Module+1

Pwolanin · Published 2014-11-24 · Updated 2021-04-20 · CVE-2014-9016

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.34 Secure Password Hashes module versions prior to 6.x-2.1

Description The password hashing API allows remote attackers to cause a denial of service via a crafted request, resulting in CPU and memory consumption.

Recommendations For Drupal versions prior to 7.34, update to version 7.34 or later. For Secure Password Hashes module versions prior to 6.x-2.1, update to version 6.x-2.1 or later.

Exploit

Fix

Related Identifiers

CVE-2014-9016

DSA-3075-1

MGASA-2014-0492

Affected Products

Drupal

Secure Password Hashes Module

References · 26

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/wordpress_long_password_dos.rb · Exploit
• 🔥 https://github.com/c0r3dump3d/wp_drupal_timing_attack · Exploit
• 🔥 https://exploit-db.com/exploits/35415 · Exploit
• https://debian.org/security/2014/dsa-3075 · Vendor Advisory
• https://drupal.org/SA-CORE-2014-006 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-9016 · Security Note
• http://debian.org/security/2014/dsa-3075 · Vendor Advisory
• https://drupal.org/node/2378375 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9016 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9016 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0492 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0492.html · Security Note
• https://drupal.org/node/2378367 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9016 · Vendor Advisory
• https://drupal.org/drupal-7.33-release-notes · Note