WordPress 1.5.1.3 Security Vulnerability



According to the entry for WordPress 1.x at Secunia.com, there is a “Highly critical” WordPress vulnerability announced August 10th that affects all 1.x versions including 1.5.1.3 The details are in this advisory. There is not yet an updated version of WordPress to address the issue, but there is a possible workaround.



According to the writeup, input passed to the “cache_lastpostdate” parameter via cookies is not “properly sanitized” before being processed. This allows arbitrary php code to be inserted. The advisory notes that in order to be successfuly exploited register_globals needs to be enabled.

If you want a workaround then it sounds like disabling register_globals is the way to go. From what I can see there are a lot of headaches removed with register_globals set to off.

Since I’m on a VPS, I have access to my php.ini file which let’s me fix this. Here’s how I dealt with it.

Edit php.ini, (usually in /etc/php.ini ) look for a line like this…

register_globals = On

Disabling it should be as simple as

register_globals = Off

save the file and I restarted apache (I’m not certain that is required to reload the php.ini, you might do it just in case, I did.)

I haven’t seen any impact (yet) on the scripts here, from what I read it’s good coding practice to not rely on register_globals being on because it can open you up to some nasty code injection vulnerabilities. I think the default distribution of php now has it disabled.

Related Posts

Blog Traffic Exchange Related Posts
  • The check's in the mail Of course, there was a time when delivery of many things relied heavily on the US Postal Service and the blame of a delay could be passed along. I saw an article lately about people using technology to do tricks like that, turning back the clock on their computer before......
  • BBPress 0.9x | Wordpress compatible forum software As you know I've used wordpress as a platform for many of my sites. It makes updating and adding information so quick and easy (as well as great extensions available for it and good theme possibilities.) Anyway, I've wanted forum functionality on a few sites as well and so I......
  • Wordpress 2.0 getting close I see in the dashboard that the third and (last?) release candidate for Wordpress 2.0 is officially out. There is word that the final may come Wednesday or Thursday of this week. I haven't had much time to see what features may be new... but if possible I may try......
Blog Traffic Exchange Related Websites
  • Web Hosting Packages And How To Get More Value For Money From Them It is a real shame but a lot of us fail to get good value for money from our web hosting packages. We can't really blame the web hosts for this either, because they provide us with lots of extra options but we just fail to take advantage of them.......
  • 3 Ideas For Finding The Right Web Host Having a website is really important for your long term online success, which also means that making sure your site runs smoothly without any problems is equally important. You can find loads of information about how to make your site look better or how to optimize it better, but those......
  • The Web Hosting Services Of The Hostgator Review Thousands and thousands of web hosts scattered around the world and their business aim is simple - to get recognized and make profit. With so much noise around the web hosting industry, it is a tough task for us to pick up the right hosting. Nevertheless, it's not too hard......
en.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site