Not logged in | Login

My Security Planet » BlogSecurity » June 2008

Feeds

13607 items (0 unread) in 75 feeds

WebSecurity

Security

SEO

SEO

Tools

Tools

Opensourcetesting.org News

BlogSecurity

BlogSecurify Service Launched!

Posted: June 23rd, 2008, 9:23am CDT by DK

Tags: News [edit]

Well the time has finally arrived! We are psyched to notify our readers, that the day has finally arrived! The initial version of the BlogSecurify project designed by GNUCITIZEN and BlogSecurity teams is now ready for testing.

This is only the initial release but knock yourselves out! We hope this new framework will allow us to expand the service to new heights, testing multiple blog types and versions. Its modular, its fast and its powerful and supports caching!

>>Launch BlogSecurify Next Generation!

Note: The old wp-scanner project will still remain active until we feel that BlogSecurify has reached a level that we are happy with, but for now, enjoy!
WordPress 2.6 Security Improvements?

Posted: June 23rd, 2008, 6:00am CDT by Philipp

Tags: News [edit]

WordPress 2.6 plans to have a number of security improvements. A number of XMLRPC features will be deactivated by default. I doubt they will remove functions such as pingbacks and trackbacks, however, it is something to keep an eye on.

So will this really help secure WordPress in the future?

WordPress have been becoming more security focused. They surpressed database errors in version 2.3.2 and added salted passwords & cookie security in 2.5. Although some of the initial releases caused more harm then good, we think WordPress are generally trying to do the right thing.

Minimising XMLRPC functions is certainly a good way to mitigate the attack surface. In fact, BlogSec have been thinking about coding a plugin to do this. However, WordPress really need to get a dedicated security team together that will provide quality security standards and procedures around development, infrastrucure and design. Commenting on this, David Kierznowski had this to say:

I don’t believe they have achieved a golden security standard as yet, when considering the security implications in the initial WordPress 2.5 release, but they are certainly on the right track.
Nextgen gallery - XSS flaw

Posted: June 18th, 2008, 4:01am CDT by Philipp

Tags: Advisories [edit]
The Nextgen Gallery Plugin version <= 0.96 have been found vulnerable to a persistent Cross Site Scripting bug..

According to the advisory, the attacker does require authentication and access to the following URL:
```
http://[host]/[directory]/wp-admin/admin.php?page=nggallery-manage-gallery
```
As far as we know, no fix is currently available.
BlogSecurify Demo Video!

Posted: June 9th, 2008, 4:05am CDT by DK

Tags: News [edit]

You guys are going to love our new wp-scanner and blog security testing service! We’ll be adding loads more tests and support multiple blog types not just WordPress.

Hint: Wear your earphones when watching this video to get the full vibe.

← May 2008 (8 items) July 2008 (1 ITEM) →