2

I got this news today about SA-CORE-2014-005 - Drupal core - SQL injection.

We are not using drupal in build authentication. We have a custom authentication, which resides behind SSO and gateway. A user can only get access or even get access page if the user is the in SSO and Gateway servers.

Is this kind of setting also vulnerable to this attack, as access is not handled by drupal?

Improve this question
4

Yes, your site is vulnerable. If your network is stopping people accessing the Drupal site without prior authentication then you're (potentially) safe from those outside the network, but still vulnerable to those inside it.

As with all security issues, upgrade as soon as physically possible.

Improve this answer
2
  • Hi Clive, The site is behind SSO one need to have access on SSO or Ldap to get access. – Pawan Kumar Oct 31 '14 at 8:51
  • Yeah I over-simplified that a bit, just updated it – Clive♦ Oct 31 '14 at 8:51
0

I have gone through this link about the vulnerability Drupal Core - Highly Critical - Public Service announcement - PSA-2014-003 and suggest you to monitor your website for any backdoor attack as advised in the above link.

Consider changing your server location and all important passwords to remain in total safe area.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.