I read an article about XML Quadratic Blowup Attack.

The Link is http://mashable.com/2014/08/06/wordpress-xml-blowup-dos/.

Is drupal safe from this attack??

How to make sure??

Thanks in advance

Comments

checkthelog’s picture

checkthelog commented
Status: Active » Fixed

Yes, this was fixed in Drupal 7.31+ and Drupal 6.33+. There are also solutions where you can just remove the xmlrpc.php file and disable the OpenID module to get by temporarily without upgrading.

secretsayan’s picture

secretsayan commented

I have Oauth modules enabled. So I need the services module too.

Is there any other solution available where I do not need to update my drupal core version and I am able to keep the Services module intact???

TomGould01’s picture

TomGould01 commented

You could apply the patched code (AKA Hack Core :() your self to the public/modules/openid/openid.inc and public/includes/xmlrpc.inc files, not advisable but may work none the less if you really can't update to the latest version properly.

I am in the process of doing about 40 different sites and haven't had any issues with D6 or D7.

secretsayan’s picture

secretsayan commented
Status: Fixed » Closed (fixed)

Thanks a lot