28 Days After Drupal Exploit
hackertarget.com
28 Days After Drupal Exploit
1–10 of 11 posts
Re: 28 Days After Drupal Exploit
#2The method used here to determine whether a site is patched can't detect manual patching, it can only detect a full upgrade to Drupal Core. And even then it can only do that if the CHANGELOG.txt is left in the root folder, which some people explicitly remove.
The patch for the security flaw was just a single line of code, manually patching is rather easy in this case.
Re: 28 Days After Drupal Exploit
#3The method used here to determine whether a site is patched can't detect manual patching, it can only detect a full upgrade to Drupal Core. And even then it can only do that if the CHANGELOG.txt is left in the root folder, which some people explicitly remove. The patch for the security flaw was just a single line of code, manually patching is rather easy in this case.
Exactly the case for my site. I have patched the line 12hour after public disclosure. I have not updated Drupal Core, nor CHANGELOG.txt because there was nothing more than the patched line.
Re: 28 Days After Drupal Exploit
#4[deleted]
Re: 28 Days After Drupal Exploit
#5Yea, if you're just checking based on the 7.32 version I don't think your results would be accurate. There are sites that applied that patch to their 7.X version.
Re: 28 Days After Drupal Exploit
#6The method used here to determine whether a site is patched can't detect manual patching, it can only detect a full upgrade to Drupal Core. And even then it can only do that if the CHANGELOG.txt is left in the root folder, which some people explicitly remove. The patch for the security flaw was just a single line of code, manually patching is rather easy in this case.
This test demonstrates that at least 42.5% of sites have been patched, and probably a lot more manually, which is pretty good going for a piece of software that doesn't automatically update itself or have a license that requires a technical content who can be notified.
I'd guess the percentage of Wordpress sites running a version that needs a critical update is a lot higher.
Re: 28 Days After Drupal Exploit
#7The method used here to determine whether a site is patched can't detect manual patching, it can only detect a full upgrade to Drupal Core. And even then it can only do that if the CHANGELOG.txt is left in the root folder, which some people explicitly remove. The patch for the security flaw was just a single line of code, manually patching is rather easy in this case.
This test demonstrates that at least 42.5% of sites have been patched, and probably a lot more manually, which is pretty good going for a piece of software that doesn't automatically update itself or have a license that requires a technical content who can be notified. I'd guess the percentage of Wordpress sites running a version that needs a critical update is a lot higher.
Considering that a non-negligible percentage of hosts that offer WordPress as a service run out of date versions of WordPress, you're probably right.
Re: 28 Days After Drupal Exploit
#8Yea, if you're just checking based on the 7.32 version I don't think your results would be accurate. There are sites that applied that patch to their 7.X version.
Some of the larger Drupal hosts, including Acquia and Pantheon, have rolled their own platform level patches.
Re: 28 Days After Drupal Exploit
#9Shameless plug: if you're a shared hosting provider you should check out http://www.patchman.co.
Approximately 30% of your hosting accounts run an outdated version of WordPress, Joomla or Drupal with serious security vulnerabilities. These vulnerabilities can be easily exploited to run malicious code. But you already know that, since you're getting sick of all the spam runs and DoS attacks that are continuously being launched this way from your platform. Not to mention the more serious attacks. Aren't you tired of cleaning up after your customers?
Patchman runs on your platform and automatically detects and patches vulnerabilities in WordPress, Joomla and Drupal core (without breaking the application!). It will also automatically remove malware. On top of that, it takes care of all communication with your customers. It integrates with all the popular control panels, such as cPanel, Plesk and DirectAdmin. Saves you a lot of headaches and puts you in control of this mess :)
Re: 28 Days After Drupal Exploit
#10I heard a story of the vulnerability being exploited on several sites, a new backdoor created, and then the hax0r applied the drupal update to close the door behind them. So, don't just check if the site was updated, check if the site maintainer applied the update.