English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Drupal Image Derivatives Generation Denial of Service Vulnerability


Secunia ID

SA52302

CVE-ID

CVE-2013-0316

Release Date

21 Feb 2013

Criticality

Less Critical

Solution Status

Vendor Patch

Software

Drupal 7.x

Where

From remote

Impact
DoS (Denial of Service)

This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system.

Description

A vulnerability has been reported in Drupal, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error related to on-demand generation of image derivatives and can be exploited to exhaust resources.

The vulnerability is reported in versions prior to 7.20.

Solution

Update to version 7.20.

Reported by

The vendor credits Ber Kessels, aBrookland, and Chad Fennell.

Original Advisory

http://drupal.org/SA-CORE-2013-002
http://drupal.org/drupal-7.20-release-notes