Feeds

Drupal clarifies security rules after White-House gaper

Incomplete code - you have been warned

Reducing security risks from open source software

Webmasters running unfinished modules for Drupal do so at their own risk after the open-source CMS updated its guidelines on fixing security vulnerabilities.

The project has updated the wording on its security site on how it handles security fixes to clarify it will only work on vulnerabilities in completed code of modules that comprise the CMS. The change clarifies that modules in release-candidate mode will not be supported.

Drupal will work with maintainers of modules that are code complete, with maintainers now given a deadline to fix the problem. If the deadline's missed, the module and the project will be unpublished from Drupal.org. Vulnerabilities in unfinished code will simply be flagged in the module's issue queue.

The clarifications are a response to the discovery of a potentially serious XSS hole in the Drupal Context module three weeks after White House developers proudly released their own plug-in based on the buggy module.

The Context module is used by 10,000 sites while Drupal in general is estimated to run on one billion of the internet's sites, but the White House is by far the highest profile win so far.

The Context module is not a part of Drupal's core but was used to install the core on the White-House site. The module was not finished code - it was a release-candidate so not officially supported by Drupal's security team - but the White House installed it anyway.

The vulnerability affected the administrative console, a fact Drupal says limited its potential exposure to attackers. The hole has since been fixed.

Drupal founder Dries Buytaert said there'd been some confusion and its policies had been clarified as a result of the incident and to make the resolution process transparent.

The Drupal core consists of around half-a-dozen modules but the CMS's functionality is vastly expanded through a universe of more than 7,000 plug-in modules. Buytaert said it's tough for Drupal's 36-person security team - of which he's a member - to take ownership of security for the whole ecosystem.

Buytaert said: "We clarified [that] the security team focuses on stable releases - we can't guarantee security for code under development."

Justin Klein Keane, the senior information security specialist at the University of Pennsylvania who uncovered the Context-module XSS bug, said defining a clear process for handling security vulnerabilities is critical for a software project - especially large projects like Drupal.

"The Drupal security team's process has not always been as straight forward as it could be. This is one of their biggest challenges to becoming a widely used piece of enterprise software."

Klein Keane uses Drupal on three-dozen sites for the University. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.