Drupal Update Process Flawed By Multiple Bugs (softpedia.com)

An anonymous reader writes: The Drupal CMS, a favorite with large enterprises, has a few bugs in its update process, affecting both the Drupal core update and its modules. The biggest flaw of the three discovered by IOActive researchers allows an attacker to take over the sites via poisoned updates. What's worse is that Drupal's team had known of this issue since 2012, but only recently reopened discussions on fixing the problem.

Comments

Re:Derpal

[Falc0n]

Must be why the Whitehouse, Weather.com, CARD.com, the New York Stock Exchange, NFL, MLS, and NBA use Drupal. they all certainly don't care for security. *rolls eyes*

Not an issue.

[Falc0n]

One of the core reasons why this issue hasn't really been prioritized is because you really shouldn't be live updating your site. Not just Drupal, but I'd argue the same for Wordpress, Joomla, whatever -- its a bad practice. Why?

Websites are very different from desktop or other normal applications. Most of these apps are tuned to your specific needs, and updates can cause issues. Serious Drupal shops and clients -never- live update their sites. Best practices suggest local or dev updates, which is then tracked by git. Site deployments should go through manual testing at a minimum. Many Drupal hosts don't even allow write access to htdocs -- only the files directory.

For those who aren't involved in the ecosystem, this article can seem alarming. But as someone who works with Drupal, and its large clients, this is a non-issue. This issue was vetted by the security team, whom are pretty risk adverse; even they didn't believe this met the criteria to be a security issue.

Should the Drupal update process be improved? Certainly. Is it a 'sky is falling Drupal sites are going to get hijacked?' nope. And for those who DO live update their drupal site, not maintain a git repo for their code, etc, etc.. Good luck. Like an default Linux install (also known to not be secure), Drupal cannot full-proof poor administrator practices.

Re:Not an issue.

[DNS-and-BIND]

Serious Drupal shops and clients -never- live update their sites.

I'm glad things are so great for you on Mount Olympus. Some of us AREN'T serious Drupal shops. We upgrade when the software says upgrade. When things break, like they shouldn't, we get pissed off.

For those who aren't involved in the ecosystem, this article can seem alarming.

Yaknow, the whole problem with Drupal is people like you who assume everyone is "in the ecosystem". Drupal has a big issue with it being by developers, for developers. I'm glad you work with large clients - really, I am - but when I the lowly user use a product, I expect it to work. I don't have a security team, I don't have a git repository, I don't have anyone to do manual testing. I just click upgrade when the system nags me to do so. And I think people like you forget or don't care about ordinary Drupal installations that get downloaded and serve pages. The fact that your last remark is borderline derogatory towards anyone who just clicks 'upgrade' I think tells a lot.

Re:Not an issue.

[DNS-and-BIND]

Again, I'm glad you're "in the biz". The rest of us aren't. That was the whole entire point of my post. Giving us the finger doesn't help anything.

Re: Not an issue.

[n0creativity]

Christ, the sense of entitlement flows strong through this one. So let me get this straight. You or your company chose to use a FREE and open source tool to fulfill a requirement. Did you bother to do ANY analysis regarding whether the tool was an appropriate solution? The answer is most certainly "derr... No". Because if you had, you would have quickly realized that while Drupal has the ability to stand up a site within minutes, running a production site of ANY TYPE (internal or external) without any knowledge of how to properly configure, update, test, and deploy said site, is pure stupidity. If manually updating drupal core or any modules is beyond the capability of the person charged with maintaining the site, then Drupal isn't the correct solution for your situation. If you honestly believe that upgrading a production website should take no more effort than a single click of your finger, than your ignorance is reaching true "derptitude" levels. I do believe that the Drupal team needs to make the "easy" button more secure. But if you can't do your job without using the "easy" button, you need to GTFO. Just because you don't have to purchase a license doesn't mean there's no cost involved in running it in production.

Re:Not an issue.

[gstoddart]

You've just described good release and change management. It's not unique to Drupal.

And you would be utterly amazed at just how many places don't do such things. And, depending on the shop, if you feel agile works for you and you're not overly risk averse, you almost eschew such things -- because you are manly and if it breaks such is life.

I don't use Drupal, and never have. But I do come from backgrounds where you go through a couple of promotions from a dev through to a prod, and test at each step. I do this because I've worked in regulated industries which are well beyond 'risk averse'. I learned to be paranoid in shops where lots of money and possibly human lives were on the line.

But you would be utterly amazed at just how many people think it's a waste of time, or who will make live updates to a prod system. Far too many in fact. Some days I'm pretty sure Slashdot does it to their detriment.

Those people can either tolerate some risk, or their employers aren't fully informed of the risks being taken on their behalf. Many places risk is unthinkable.

Never underestimate just how widespread poor administrator practices are ... a lot of people are lazy, don't care, or are so over-confident you can't but expect them to drive off a cliff.

I've seen far too many cowboys who always say "it will be fine" or think proper release engineering is a waste of time ... in my experience those people end up red faced and frantic when they finally do hose something beyond easy repair.

It all depends on the industry you're in, and the consequences of failure. The problem is something you get some idiot who came from a place where the consequences would be minor who come along and fuck up at a place where the consequences aren't.

Any system can fail spectacularly if you just wing it, do stuff in your live system, and assume you'll never have any problems. Some systems just help you fail more than others.

Re:Not an issue.

[rosencreuz]

Also if we are not supposed to do live updates, why is there such a feature? Is it ok to provide a feature and create security vulnerabilities and then tell 'you shouldn't use it'?

Are they simply telling Drupal is not for us and we should use something else instead?

Because of the disappointment and frustration from v8, I'm seriously planning to move the wordpress.

Disagree about the actual issues with the article

[bjdevil66]

Did you actually read the article, or did you just have a bad experience with Drupal (or its community)?

I agree with the GP comment about the article's concerns. That's not saying there aren't real problems with Drupal as a whole when it comes to usability for noobs, or documentation, or getting enthuiastic community support anymore (it has died off some since the D7 to D8 community schism.

But come on. It doesn't take a security team to deal with the article issues. And you don't even have to do manual testing after an update. Just use automatic CI testing (Behat, etc.) to ensure the site holds up after an update. travis-ci.org tied to a Github repo for automatic test execution with each new commit is your friend.

Finally, if you aren't using version control (such as Git) for professional web development - Drupal or not - that's irresponsible, unprofessional, and dangerous. It's like driving drunk without insurance in someone else's car. Sooner or later it's gonna catch up with you - and if you're managing a web site that does more than serve a simple brochure site, that car crash is not gonna be pretty.

Seriously - get with the times. Use Git. Learn "git clone", "git init", "git add somefile.php", "git commit", "git push", "git fetch" (and "git pull"), "git diff", "git log" "git stash", "git reset --hard HEAD~1 (or the commit's hash)" (and what --soft and --mixed mean vs. --hard), "git revert", and you're ready to do 99% of anything you'll ever need to do with Git. It's just not that hard or scary. Really. If you want ridiculously hard, try using the superfluous, bullshit Database API in Drupal 7 to anything beyond a SELECT query. Talk about a waste - was db_query() with sanitation really not good enough, Dries? Backdrop got that part right... :)

Drupal rocks :)

[amoeba47]

As someone who has developed with Drupal for several years, I just want to add a positive perspective to balance the expected usual negative comments here. Drupal is a great CMS and web application framework. Extensible and flexible it can be adapted for many applications. Moreover, the Drupal community is knowledgeable and helpful. Growing from strength to strength with each release, I love working with Drupal. That is all.