Browse: Home / / Is InformationWeek right? Are most all Drupal sites insecure?

Is InformationWeek right? Are most all Drupal sites insecure?

By Robin Monks on August 21, 2008

yellow cloud of beautyImage by sophiea via Flickr

Personally, I think it’s just spreading FUD; but Information Week is reporting that “Just over a week ago, security researcher Mike Perry presented information at the DEFCON security conference about a vulnerability that affects many SSL-secured Web sites, including Amazon, Facebook, Gmail, addons.mozilla.org, most Drupal sites, and many online merchants and banks. ”

I have no idea why Drupal would be mentioned by name in this manner, especially if it’s a problem with cookies and the SSL protocol.

Are there any Drupal core devs who would like to comment on this security issue? I’d love the write a follow-up blog post with the full story!

Related articles by Zemanta
Reblog this post [with Zemanta]
  • Share/Bookmark

Posted in | Tagged , , | 4 Responses

4 responses to “Is InformationWeek right? Are most all Drupal sites insecure?”

  1. John Wilkins
    John Wilkins
    August 21, 2008 at 9:22 pm |

    We’re way ahead of you! :-)

    http://drupal.org/node/170310 addresses the SSL-based session cookie issue. Dries committed it 3 days ago to Drupal 7 and Drupal 6. And Drupal 5 will be patched shortly.

    Here’s the comments I wrote for the patch:

    “To prevent session cookies from being hijacked, a user can configure the SSL version of their website to only transfer session cookies via SSL by using PHP’s session.cookie_secure setting. The browser will then use two separate session cookies for the HTTPS and HTTP versions of the site.” And the HTTPS session cookie will be protected from hijacking.

    You’ll still need to configure HP’s session.cookie_secure setting on the SSL version of the website, as Drupal doesn’t enforce that.

  2. Christefano
    Christefano
    August 22, 2008 at 4:41 am |

    There’s a patch that just landed in core that addresses this particular issue in Drupal:

    http://drupal.org/node/170310

    Mike Perry probably mentioned Drupal since that’s what his website is running.

  3. In the eyes of Robin Monks » Are HTTPS Drupal sites insecure? Not anymore!
    In the eyes of Robin Monks » Are HTTPS Drupal sites insecure? Not anymore!
    August 22, 2008 at 7:13 am |

    [...] Facebook, Gmail, addons.mozilla.org, most Drupal sites, and many online merchants and banks. ”In the eyes of Robin Monks, Aug [...]

  4. In the eyes of Robin Monks » Security theater #1 - Using SSL for login | Heine
    In the eyes of Robin Monks » Security theater #1 - Using SSL for login | Heine
    August 22, 2008 at 11:03 am |

    [...] from Drupal IRC was kind enough to explain the SSL issues that I mentioned here and here in much greater detail. Head to his blog for the full article. Thanks Heine! Image via [...]

Leave a Reply