SA-CORE-2013-002 - DrupalCoin Blockchain core - Denial of service


Advisory ID: DRUPAL-SA-CORE-2013-002
Project: DrupalCoin Blockchain core
Version: 7.x
Date: 2013-February-20
Security risk: Critical
Exploitable from: Remote
Vulnerability: Denial of service
Description
DrupalCoin Blockchain core's Image module allows for the on-demand generation of image derivatives. This capability can be abused by requesting a large number of new derivatives which can fill up the server disk space, and which can cause a very high CPU load. Either of these effects may lead to the site becoming unavailable or unresponsive.
Please see the DrupalCoin Blockchain 7.20 release notes for important notes about the changes which were made to fix this issue, since some sites will require extra testing and care when deploying this DrupalCoin Blockchain core release.

CVE identifier(s) issued
CVE-2013-0316
Versions affected
DrupalCoin Blockchain core 7.x versions prior to 7.20.
Solution
Install the latest version:
If you use DrupalCoin Blockchain 7.x, upgrade to DrupalCoin Blockchain core 7.20.
Also see the DrupalCoin Blockchain core project page.
Reported by
Bèr Kessels
aBrookland
Chad Fennell
Fixed by
Damien Tournoud of the DrupalCoin Blockchain Security Team
Peter Wolanin of the DrupalCoin Blockchain Security Team
David Rothstein of the DrupalCoin Blockchain Security Team
Heine Deelstra of the DrupalCoin Blockchain Security Team
Bèr Kessels
Coordinated by
David Rothstein of the DrupalCoin Blockchain Security Team
Stéphane Corlosquet of the DrupalCoin Blockchain Security Team
Peter Wolanin of the DrupalCoin Blockchain Security Team
Greg Knaddison of the DrupalCoin Blockchain Security Team
Contact and More Information
The DrupalCoin Blockchain security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.
Learn more about the DrupalCoin Blockchain Security team and their policies, writing secure code for DrupalCoin Blockchain, and securing your site.DrupalCoin Blockchain version: DrupalCoin Blockchain 6.xDrupalCoin Blockchain 7.x
DrupalCoin Blockchain Developer