by David Snopek on March 29, 2018 - 12:02am

Drupal 6 reached End-of-Life over 2 years ago, so you might be forgiven for thinking that Drupal 6 and its Long-Term Support (D6LTS) no longer matter.

However, yesterday (March 28th, 2018), there was a HIGHLY CRITICAL security vulnerability announced that affected Drupal 6, 7 & 8 (and even Backdrop).

This wasn't the first Drupal 6 LTS core release (did anyone notice that one?) and it probably won't be the last. And there are still ~65,000 sites running Drupal 6 according to Drupal.org, which were affected by this issue, and could be affected by future issues.

Luckily, the Drupal 6 LTS program is still going, and we got a patch and release out immediately!

But the D6LTS program won't go on forever... at least without users of Drupal 6 continuing to buy support from the D6LTS vendors.

I think this is a good time to remind everyone what the D6LTS program is and why it's still important to the Drupal community...

Just how critical was yesterday's release?

Yesterday's release fixed a Remote Code Execution (RCE) vulnerability. That means an attacker could execute arbitrary PHP code on a vulnerable site. This includes the ability to execute shell commands or run arbitrary SQL.

While it's not as easy to exploit as Drupalgeddon - that one was listed as TD:All, or "All module configurations are exploitable", where as this vulnerabliity is listed as TD:Default, or "Default or common module configurations are exploitable" - it's likely that many or most sites are vulnerable.

(BTW, see our article on how to understand the risk calculator!)

So, like Drupalgeddon, this is the sort of vulnerability that needs to be patched IMMEDIATELY in order to beat the attackers that are trying to weaponize it, and start crawling the internet for vulnerable Drupal sites.

This is EXACTLY the sort of vulnerability that we were all worried about when the D6LTS program was first concieved of!

What is the D6LTS program?

Back in 2015, the Drupal Security Team announced the D6LTS program and asked vendors to apply to participate.

Participation means getting access to the private Drupal Security Team tracker, in order to watch for security issues that could also affect Drupal 6, and develop patches for them before the security issues are made public.

In exchange, the D6LTS vendors had to agree to:

  • Make all security patches/releases publicly available (ie. we can't keep them only for our customers)
  • Refrain from making security patches/releases public before the related D7 or D8 releases are published (ie. we can't share them with our customers early)

So, this means that we were able to work on getting a fix ready for this big security release BEFORE it was public. This is good because you want to release a fix fast, but you don't want to rush it: it could cause regressions or fail to fully address the vulnerability or even introduce new security isssues.

But it also means the whole Drupal community (not just D6LTS customers) gets to benefit from the patches the D6LTS vendors create!

Why not just wait for the patches, like, for free?

While the D6LTS vendors release the patches to everyone, we're creating them for our customers, who have specifically signed for a D6LTS plan.

So, we'll only release D6LTS patches for modules that our customers use! If you have a Drupal 6 site which uses other modules, you could end up being vulnerable.

To make things easier for our customers AND the community, we created the myDropWizard module, which will tell you if your modules are supported and if there's any D6LTS security releases for them. This available to everyone, even folks who aren't our customers.

So, you can just wait for the patches for free - we even make it easy for you with the myDropWizard module - but...

The D6LTS program won't go on forever!

While we love the Drupal community, and want to make things easier for people who are stuck on Drupal 6, it takes significant resources to provide D6LTS.

We can only do this so long as it is financially viable for us to do it!

There were 3 vendors originally accepted into the D6LTS program: us (myDropWizard), Tag1 and Acquia.

Acquia was already stopped its participation in the Drupal 6 LTS program. And they have many more resources than us, and several of the original Drupal 6 core maintainers on staff. :-)

At our height, we were providing D6LTS for over 400 sites. We're currently only supporting a small fraction of that!

People are quitting every month as they migrate their sites. Once enough people quit, we won't be able to do it anymore, or will need to dramatically increase our prices.

So, if you have a Drupal 6 site that you depend on, and want to continue getting security updates for it, please sign up for a D6LTS plan!

D6LTS until 2020?

We've currently committed to doing Drupal 6 LTS until at least February 24th, 2019.

Usually, around Drupalcon we announce whether or not we're going to continue doing it for another year, and if there's going to be any price changes. We're in the middle of making that decision right now!

Remember: all the patches we make don't just go to our customers, they are shared with the whole Drupal community.

If you want to continue see these Drupal 6 security releases, please consider signing up for a D6LTS plan!

Want to read more articles like this?

myDropWizard.com blog Subscribe to the myDropWizard.com blog and recieve e-mail updates when new articles are published!

Add comment

o