Not logged in | Login

My Security Planet » BlogSecurity » December 10, 2007

Feeds

13607 items (0 unread) in 75 feeds

WebSecurity

Security

SEO

SEO

Tools

Tools

Opensourcetesting.org News

BlogSecurity

WordPress 2.3.1 SQL Injection Vulnerability

Posted: December 10th, 2007, 9:31am CST by DK

Tags: Advisories [edit]

Update: 10/12/07 This vulnerability has been downgraded to an information disclosure vulnerability ONLY as no proof of concept exploit has been possible. This is contrary to the original advisory. More info here.

A new SQL Injection vulnerability may have been discovered in WordPress 2.3.1. This is a critical security risk that may allow an attacker to remotely compromise your blog.

Test your blog (proof of concept):
POC = http://localhost/path_to_wordpress/?feed=rss2&p=1

Currently, the BlogSec team are unaware of a patch. Please keep an eye on this post for updates.

The original advisory can be found here.

Beenu Arora has been credited for finding the vulnerability.

Thanks to Mustlive for bringing it to our attention.
Failing to prepare

Posted: December 10th, 2007, 3:45am CST by DK

Tags: Reflections [edit]
It seems that security tips for our software often extend to keep up to date with your software. This strategy alone, means two things:
- You can trust everyone everywhere to responsibly disclose vulnerabilities to your vendor;
- When a new release is made public, the race is on… will you upgrade before the attacker diff’s the packages and codes an exploit.
What you really want is defense in depth

Benjamic Franklin’s famous quote seems relavent: By failing to prepare, you are preparing to fail.

For most of us, I think we can manage a few downtime days. BlogSec suffered from a DNS problem recently, which really threw a spanner in the works. We were able to recover, but I can’t help but think that we would have done well to heed Shakesphere’s words:

If you have tears, prepare to shed them now.

Creating a defense in depth strategy involves putting up a number of cyber-barriers or -checkpoints and making certain assumptions. A wise strategy will expect certain if not all areas to be breached.

In time of peace prepare for war.

← December 1 (1 item) December 11 (2 items) →