Menu
Drupal to secure its update process with HTTPS

Drupal to secure its update process with HTTPS

The Drupal security team is working to add HTTPS support to updates and to fix other issues with the update mechanism

Developers of the popular Drupal content management system are working to secure the software's update mechanism after a researcher recently found weaknesses in it.

Last week, researcher Fernando Arnaboldi from security firm IOActive disclosed several issues with the update mechanism in Drupal: the failure of the back-end administration panel to report update errors, a cross-site request forgery (CSRF) flaw that could allow attackers to force admins to repeatedly trigger update checks, and the lack of encryption for update downloads.

The last issue was the most significant one, because it could have allowed attackers who could intercept the traffic between a Drupal-based site and the official Drupal servers, to inject back-doored updates. Such an attack could lead to the compromise of the site and its database.

Fortunately, the Drupal security team was notified in advance and is working to fix the update shortcomings. Over the past few days the team has switched the project's infrastructure to support HTTPS so that the update processes for the Drupal core and its modules use secure channels.

For now the team has enabled HTTPS updates in Drush, a popular command-line shell and scripting interface for Drupal. It has also switched all download links from the project's pages to HTTPS.

The core update status module still doesn't use secure transport, but this is being worked on and will be deployed in the next Drupal update, the security team said in a blog post.

For now, website administrators can use a supported version of Drush to deploy updates or can manually download the release archives from their corresponding project pages.

The failed update notification issue and the CSRF flaw have not been addressed yet, but the Drupal security team opened tracking tickets for them and asked developers to contribute patches.


Follow Us

Join the newsletter!

Error: Please check your email address.

Featured

Slideshows

Sizing up the NZ security spectrum - Where's the channel sweet spot?

Sizing up the NZ security spectrum - Where's the channel sweet spot?

From new extortion schemes, outside threats and rising cyber attacks, the art of securing the enterprise has seldom been so complex or challenging. With distance no longer a viable defence, Kiwi businesses are fighting to stay ahead of the security curve. In total, 28 per cent of local businesses faced a cyber attack last year, with the number in New Zealand set to rise in 2017. Yet amidst the sensationalism, media headlines and ongoing high profile breaches, confusion floods the channel, as partners seek strategic methods to combat rising sophistication from attackers. In sizing up the security spectrum, this Reseller News roundtable - in association with F5 Networks, Kaspersky Lab, Tech Data, Sophos and SonicWall - assessed where the channel sweet spot is within the New Zealand channel. Photos by Maria Stefina.

Sizing up the NZ security spectrum - Where's the channel sweet spot?
Show Comments