I've been getting hit hard by http://drupal.org/node/731710 on one of the sites I run in my own time. Upgraded to latest core version, bug is still cropping up, realised I'm using memcache-session.inc which doesn't have this fix applied.

Discussed within the security team, and since there's already been a core release and SA with the same fix, we decided this could be fixed in a public issue for memcache. Same bug is also in facebook module.

Patch attached, it's hard to reproduce this - you need a rampaging spammer, but I've been running the patch for a couple of weeks now on a relatively busy site.

CommentFileSizeAuthor
memcache_session.patch2.62 KBcatch

Comments

jeremy’s picture

jeremy commented
Status: Needs review » Fixed

Sorry this got stuck in the queue. Fix applied:
http://drupal.org/cvs?commit=412008

Thanks!

catch’s picture

catch
he/him
Primary language English
commented

Just a note this patch wasn't from the site we're both working on, it was from a personal D6 project, although I should merge it in to the site we're both working on just in case!

jeremy’s picture

jeremy commented

No worries, this code isn't in use there. I'm happy to see that it's stable enough to be in use on a live website however, perhaps we can close this issue:
#656838: [META] Port sessions to D7

catch’s picture

catch
he/him
Primary language English
commented
Status: Fixed » Patch (to be ported)

Sorry I wasn't clear - it's a D6 site, but I did the patch against D7 because it's the same code iirc, so this should be backported to D6 too.

Haven't tested D7 sessions at all (forgot we'd never even tested memcache sessions on that other site when typing that followup).

robertdouglass’s picture

robertdouglass commented
Status: Patch (to be ported) » Fixed

#828664 by catch | Jeremy: Fixed Blocked user session regeneration.
committed to 6.x-2.x. Thanks.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.