banane

WordPress Exploits and Patches

I’m a big fan of WordPress, except for tonight when I’ve finally decided to conquer the random blog spam that has been happening to some blogs I administer. “WordPress Cookie Authentication Vulernability.” It’s an invisible kind of CSS appended to the bottom of a post, as a form no less. The realization is that the security in WordPress is not too hot. Something about a stored double MD5 hash, and hackers compromising the cookie of the stored passwords, and not even having to resolve the MD5 hash but simply repost it as a cookie on their system and re-access the administrative site, where they can manage a lot of things.

Anyways, the patch I want to apply is not for the version we have installed- do I go with an unstable beta version (2.4b) or do I stick with 2.3.1 and manually change files line by line instead of applying the patch, or, do I wait until 2.4 is officially released? Oh the conundrums of open source.

Share and Enjoy:

This entry was posted on Friday, December 14th, 2007 at 11:59 pm and is filed under technology. You can follow any responses to this entry through the RSS 2.0 feed. View blog reactions Stumble it! You can leave a response, or trackback from your own site.

Viewing 2 Comments

Matt 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

If there is spammy HTML in the footer.php of a theme, it's unlikely that it has anything to do with the cookie thing, it's more likely file permissions and/or an old XML-RPC problem. The cookie thing only applies to you if they've already read your database directly, which is not possible if you're on a secure version, and changing your password protects you if they have. I wouldn't attempt to apply the phpass patch by hand.

reply edit reblog flag record video comment

http://photomatt.net/

banane 1 year ago 1 point
Please login to rate.

Do you already have an account? Log in and claim this comment.

Oh- thanks Matt! It's not in the footer, but at the end of a post, the individual post content, which users can't see, you can only see if you "view code" in the interface. I will change the db password, seems like the best idea.

reply edit reblog flag record video comment