Drupal Update Process Flawed By Multiple Bugs (softpedia.com)

An anonymous reader writes: The Drupal CMS, a favorite with large enterprises, has a few bugs in its update process, affecting both the Drupal core update and its modules. The biggest flaw of the three discovered by IOActive researchers allows an attacker to take over the sites via poisoned updates. What's worse is that Drupal's team had known of this issue since 2012, but only recently reopened discussions on fixing the problem.

Comments

Not an issue.

[Falc0n]

One of the core reasons why this issue hasn't really been prioritized is because you really shouldn't be live updating your site. Not just Drupal, but I'd argue the same for Wordpress, Joomla, whatever -- its a bad practice. Why?

Websites are very different from desktop or other normal applications. Most of these apps are tuned to your specific needs, and updates can cause issues. Serious Drupal shops and clients -never- live update their sites. Best practices suggest local or dev updates, which is then tracked by git. Site deployments should go through manual testing at a minimum. Many Drupal hosts don't even allow write access to htdocs -- only the files directory.

For those who aren't involved in the ecosystem, this article can seem alarming. But as someone who works with Drupal, and its large clients, this is a non-issue. This issue was vetted by the security team, whom are pretty risk adverse; even they didn't believe this met the criteria to be a security issue.

Should the Drupal update process be improved? Certainly. Is it a 'sky is falling Drupal sites are going to get hijacked?' nope. And for those who DO live update their drupal site, not maintain a git repo for their code, etc, etc.. Good luck. Like an default Linux install (also known to not be secure), Drupal cannot full-proof poor administrator practices.

Re:Not an issue.

[DNS-and-BIND]

Serious Drupal shops and clients -never- live update their sites.

I'm glad things are so great for you on Mount Olympus. Some of us AREN'T serious Drupal shops. We upgrade when the software says upgrade. When things break, like they shouldn't, we get pissed off.

For those who aren't involved in the ecosystem, this article can seem alarming.

Yaknow, the whole problem with Drupal is people like you who assume everyone is "in the ecosystem". Drupal has a big issue with it being by developers, for developers. I'm glad you work with large clients - really, I am - but when I the lowly user use a product, I expect it to work. I don't have a security team, I don't have a git repository, I don't have anyone to do manual testing. I just click upgrade when the system nags me to do so. And I think people like you forget or don't care about ordinary Drupal installations that get downloaded and serve pages. The fact that your last remark is borderline derogatory towards anyone who just clicks 'upgrade' I think tells a lot.

Re:Not an issue.

[DNS-and-BIND]

Again, I'm glad you're "in the biz". The rest of us aren't. That was the whole entire point of my post. Giving us the finger doesn't help anything.

Re: Not an issue.

[n0creativity]

Christ, the sense of entitlement flows strong through this one. So let me get this straight. You or your company chose to use a FREE and open source tool to fulfill a requirement. Did you bother to do ANY analysis regarding whether the tool was an appropriate solution? The answer is most certainly "derr... No". Because if you had, you would have quickly realized that while Drupal has the ability to stand up a site within minutes, running a production site of ANY TYPE (internal or external) without any knowledge of how to properly configure, update, test, and deploy said site, is pure stupidity. If manually updating drupal core or any modules is beyond the capability of the person charged with maintaining the site, then Drupal isn't the correct solution for your situation. If you honestly believe that upgrading a production website should take no more effort than a single click of your finger, than your ignorance is reaching true "derptitude" levels. I do believe that the Drupal team needs to make the "easy" button more secure. But if you can't do your job without using the "easy" button, you need to GTFO. Just because you don't have to purchase a license doesn't mean there's no cost involved in running it in production.

Re:Not an issue.

[gstoddart]

You've just described good release and change management. It's not unique to Drupal.

And you would be utterly amazed at just how many places don't do such things. And, depending on the shop, if you feel agile works for you and you're not overly risk averse, you almost eschew such things -- because you are manly and if it breaks such is life.

I don't use Drupal, and never have. But I do come from backgrounds where you go through a couple of promotions from a dev through to a prod, and test at each step. I do this because I've worked in regulated industries which are well beyond 'risk averse'. I learned to be paranoid in shops where lots of money and possibly human lives were on the line.

But you would be utterly amazed at just how many people think it's a waste of time, or who will make live updates to a prod system. Far too many in fact. Some days I'm pretty sure Slashdot does it to their detriment.

Those people can either tolerate some risk, or their employers aren't fully informed of the risks being taken on their behalf. Many places risk is unthinkable.

Never underestimate just how widespread poor administrator practices are ... a lot of people are lazy, don't care, or are so over-confident you can't but expect them to drive off a cliff.

I've seen far too many cowboys who always say "it will be fine" or think proper release engineering is a waste of time ... in my experience those people end up red faced and frantic when they finally do hose something beyond easy repair.

It all depends on the industry you're in, and the consequences of failure. The problem is something you get some idiot who came from a place where the consequences would be minor who come along and fuck up at a place where the consequences aren't.

Any system can fail spectacularly if you just wing it, do stuff in your live system, and assume you'll never have any problems. Some systems just help you fail more than others.