SA-CONTRIB-2014-113 - Secure Password Hashes - Denial of Service

This module enables a more secure password storage for Drupal 6 by back-porting the code used in Drupal 7 core.

A vulnerability in this API allows an attacker to send specially crafted requests resulting in CPU and memory exhaustion. This may lead to the site becoming unavailable or unresponsive (denial of service).

This vulnerability can be exploited by anonymous users

See also: <https://www.drupal.org/SA-CORE-2014-006&gt;

CVE identifier(s) issued

• CVE-2014-9016

Versions affected

• Secure Password Hashes 6.x-2.x versions prior to 6.x-2.1.

Drupal core is not affected. If you do not use the contributed Secure Password Hashes module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Secure Password Hashes module for Drupal 6.x, upgrade to Secure Password Hashes 6.x-2.1

Also see the Secure Password Hashes project page.

Reported by

• Michael Cullum
• Javier Nieto
• Andrés Rojas Guerrero

Fixed by

• Peter Wolanin the module maintainer and Drupal Security Team member