Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.
Sign up to join this community
I got this news today about SA-CORE-2014-005 - Drupal core - SQL injection.
We are not using drupal in build authentication. We have a custom authentication, which resides behind SSO and gateway. A user can only get access or even get access page if the user is the in SSO and Gateway servers.
Is this kind of setting also vulnerable to this attack, as access is not handled by drupal?
Yes, your site is vulnerable. If your network is stopping people accessing the Drupal site without prior authentication then you're (potentially) safe from those outside the network, but still vulnerable to those inside it.
As with all security issues, upgrade as soon as physically possible.
I have gone through this link about the vulnerability Drupal Core - Highly Critical - Public Service announcement - PSA-2014-003 and suggest you to monitor your website for any backdoor attack as advised in the above link.
Consider changing your server location and all important passwords to remain in total safe area.
