Drupal Image Derivatives Generation Denial of Service Vulnerability

Secunia ID	SA52302
CVE-ID	CVE-2013-0316
Release Date	21 Feb 2013
Criticality	Less Critical
Solution Status	Vendor Patch
Software	Drupal 7.x
Where	From remote
Impact	DoS (Denial of Service) This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system.
Description	A vulnerability has been reported in Drupal, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error related to on-demand generation of image derivatives and can be exploited to exhaust resources. The vulnerability is reported in versions prior to 7.20.
Solution	Update to version 7.20.
Reported by	The vendor credits Ber Kessels, aBrookland, and Chad Fennell.
Original Advisory	http://drupal.org/SA-CORE-2013-002 http://drupal.org/drupal-7.20-release-notes

© 1997-2013 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.
The authors' opinions do not necessarily reflect the official positions of Kaspersky Lab.