The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.

The version of Drupal installed on the remote server is 7.x prior to 7.34, and is affected by a flaw in the password hashing API. It is triggered when handling a specially crafted request, which can cause a consumption of CPU and memory resources. This may allow a remote attacker to cause a denial of service.

Updated drupal packages fix security vulnerabilities :

An information disclosure vulnerability was discovered in Drupal before 7.27. When pages are cached for anonymous users, form state may leak between anonymous users. Sensitive or private information recorded for one anonymous user could thus be disclosed to other users interacting with the same form at the same time (CVE-2014-2983).

Multiple security issues in Drupal before 7.29, including a denial of service issue, an access bypass issue in the File module, and multiple cross-site scripting issues (CVE-2014-5019, CVE-2014-5020, CVE-2014-5021, CVE-2014-5022).

A denial of service issue exists in Drupal before 7.31, due to XML entity expansion in a publicly accessible XML-RPC endpoint.

A SQL Injection issue exists in Drupal before 7.32 due to the way the Drupal core handles prepared statements. A malicious user can inject arbitrary SQL queries, and thereby completely control the Drupal site.
This vulnerability can be exploited by remote attackers without any kind of authentication required (CVE-2014-3704).

Aaron Averill discovered that a specially crafted request can give a user access to another user's session, allowing an attacker to hijack a random session (CVE-2014-9015).

Michael Cullum, Javier Nieto and Andres Rojas Guerrero discovered that the password hashing API allows an attacker to send specially crafted requests resulting in CPU and memory exhaustion. This may lead to the site becoming unavailable or unresponsive (denial of service) (CVE-2014-9016). anonymous users (CVE-2014-9016).

Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password (CVE-2015-2559).

Under certain circumstances, malicious users can construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks. In addition, several URL-related API functions in Drupal 6 and 7 can be tricked into passing through external URLs when not intending to, potentially leading to additional open redirect vulnerabilities (CVE-2015-2749, CVE-2015-2750).

The drupal package has been updated to version 7.35 to fix this issue and other bugs. See the upstream advisory and release notes for more details.

Drupal 7.34, 2014-11-19

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote web server is running a version of Drupal that is 6.x prior to 6.34 or 7.x prior to 7.34. It is, therefore, potentially affected by the following vulnerabilities :

  - There exists an unspecified flaw that is triggered when     handling a specially crafted request that may allow a     remote attacker to perform a session hijacking attack.
    (CVE-2014-9015)

  - There exists a flaw in the password hashing API that is     triggered when handling a specially crafted request. An     attacker may use this to consume resources and cause a     denial of service. This issue is only present in     versions of Drupal prior to 7.34. (CVE-2014-9016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2014-9015     Aaron Averill discovered that a specially crafted     request can give a user access to another user's     session, allowing an attacker to hijack a random     session.

  - CVE-2014-9016     Michael Cullum, Javier Nieto and Andres Rojas Guerrero     discovered that the password hashing API allows an     attacker to send specially crafted requests resulting in     CPU and memory exhaustion. This may lead to the site     becoming unavailable or unresponsive (denial of     service).

Custom configured session.inc and password.inc need to be audited as well to verify if they are prone to these vulnerabilities. More information can be found in the upstream advisory at

ID	Name	Product	Family	Severity
9728	Drupal 7.x < 7.34 DoS	Nessus Network Monitor	CGI	medium
82456	Mandriva Linux Security Advisory : drupal (MDVSA-2015:181)	Nessus	Mandriva Local Security Checks	high
79775	Fedora 21 : drupal7-7.34-1.fc21 (2014-15583)	Nessus	Fedora Local Security Checks	medium
79679	Fedora 20 : drupal7-7.34-1.fc20 (2014-15528)	Nessus	Fedora Local Security Checks	medium
79677	Fedora 19 : drupal7-7.34-1.fc19 (2014-15522)	Nessus	Fedora Local Security Checks	medium
79386	Drupal 6.x < 6.34 / 7.x < 7.34 Multiple Vulnerabilities	Nessus	CGI abuses	medium
79362	Debian DSA-3075-1 : drupal7 - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2014-9016

high

Tenable Plugins

medium

high

medium

medium

medium

medium

medium