View online: https://drupal.org/node/2023585

  * Advisory ID: DRUPAL-SA-CONTRIB-2013-053
  * Project: Login Security [1] (third-party module)
  * Version: 6.x, 7.x
  * Date: 2013-June-19
  * Security risk: Critical [2]
  * Exploitable from: Remote
  * Vulnerability: Multiple vulnerabilities

-------- DESCRIPTION  
---------------------------------------------------------

Login Security module adds additional access controls to the login form of
Drupal.

When Login Security is configured to use the delay feature, frequent or
concurrent failed attempts to login can consume all the web serving
processes, causing a denial of service.

It is possible to bypass Login Security features when soft blocking is
disabled. This is due to the incorrect use of string filtering in the module
which can cause the module to skip all checks.


-------- CVE IDENTIFIER(S) ISSUED  
--------------------------------------------

  * /A CVE identifier [3] will be requested, and added upon issuance, in
    accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Login Security 6.x-1.x versions prior to 6.x-1.2.
  * Login Security 7.x-1.x versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed Login Security
[4] module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use the Login Security module for Drupal 6.x, upgrade to Login
    Security 6.x-1.3 [5]
  * If you use the Login Security module for Drupal 7.x, upgrade to Login
    Security 7.x-1.3 [6]

Also see the Login Security [7] project page.

-------- REPORTED BY  
---------------------------------------------------------

  * David Stoline [8] and Heine Deelstra [9] of the Drupal Security Team

-------- FIXED BY  
------------------------------------------------------------

  * David Norman [10] the module maintainer
  * Chris Yu [11]

-------- COORDINATED BY  
------------------------------------------------------

  * David Stoline [12] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [13].

Learn more about the Drupal Security team and their policies [14], writing
secure code for Drupal [15], and securing your site [16].


[1] http://drupal.org/project/login_security
[2] http://drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] http://drupal.org/project/login_security
[5] https://drupal.org/node/2023503
[6] https://drupal.org/node/2023507
[7] http://drupal.org/project/login_security
[8] http://drupal.org/user/329570
[9] http://drupal.org/user/17943
[10] http://drupal.org/user/972
[11] http://drupal.org/user/202205
[12] http://drupal.org/user/329570
[13] http://drupal.org/contact
[14] http://drupal.org/security-team
[15] http://drupal.org/writing-secure-code
[16] http://drupal.org/security/secure-configuration