SektionEins Blog

Why does Drupal use string manipulation to generate SQL statements instead of bind parameters? It is 2014, hasn't this been best practice since at least the late 1990s? Wouldn't all security audits, including automated ones, pick this up?

And before someone makes a "joke" about PHP, they're using the PDO framework which supports bindParam(). Seems like woful incompetence in the Drupal codebase to me.

Exploit in detail:
https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html

It's a good contender, but in 10.2, you could hold down a key in the screen saver lock screen and overflow a buffer, crashing the screensaver and logging you in. Seriously. Not a root exploit but embarrassing.

http://www.cvedetails.com/cve/CVE-2003-0518/

btw, discoverer claims to have written a kext fixing the hole

http://www.sektioneins.de/blog/15-07-07-dyld_print_to_file_lpe.html

Is there a test to determine if the patch is successful?

Edit: as noted in Esser's blog [1]:
$ EDITOR=/usr/bin/true DYLD_PRINT_TO_FILE=/this_system_is_vulnerable crontab -e

I found this test failed in both a patched (10.10.4) and un-patched system (10.10.1) so not sure what these results mean.

[1] https://www.sektioneins.de/en/blog/15-07-07-dyld_print_to_file_lpe.html