Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security The Internet

Wordpress 2.1.1 Release Compromised by Cracker 48

Posted by Zonk from the not-my-emo-comments-and-angsty-statements dept.
GrumpySimon writes "The recent 2.1.1 release of the popular blog software Wordpress was compromised by a cracker who made it easier for to execute code remotely. This is interesting because the official release was quietly and subtly compromised, and has been in the wild for a few days now. There's no word on if any affected sites have been compromised, but anyone running Wordpress is urged to upgrade to 2.1.2 immediately, and admins can check their logs for access to 'theme.php' or 'feed.php', and query strings with 'ix=' or 'iz=' in them."
This discussion has been archived. No new comments can be posted.

Wordpress 2.1.1 Release Compromised by Cracker More

Wordpress 2.1.1 Release Compromised by Cracker

Comments Filter:

  • Makes me wonder if the PHP VM could do a hash of the application code and compare that with a certificate from the source of the application. I know that the injected code in this case would have been certified, but it would make it easier to identify sites which had not been upgraded.

    • Re: (Score:1)

      by dexomn ( 147950 )
      That's so two hours ago.
    • Have a really simple index.php, which can then verify the source of the rest of the app (include files, etc)?

      But really, I don't think this accomplishes a hell of a lot. It wouldn't help you know which ones haven't been updated, for one thing...

      • NO (Score:2)

        by cortana ( 588495 )
        If it is a job for the app, then everyone will implement it themselves, and no one will do it right.
        • That will happen anyway.

          If you put it in the app, there's at least a chance it'll be done right by some library that everyone ends up using. If you put it in the interpreter, the interpreter gets crufty for everyone, including people who don't care about source code signing, and people who might have a legitimate reason for implementing it a little differently.

          Or, let me make this very simple: If we were talking about C, would you be in favor of including it in the operating system? Or the C compiler?

    • Re: (Score:2)

      by Jessta ( 666101 )
      When should this hash check be done?
      on every page request?
      I can imagine that slowing requests down a bit.

  • Comment removed (Score:3, Insightful)

    by account_deleted ( 4530225 ) on Saturday March 03, 2007 @02:42AM (#18215736)
    Comment removed based on user account deletion
    • It's late at night. Nothing like a bottle of Mountain Dew and a flame war to keep the programmers awake. So, how about that PHP?

    • Re: (Score:1, Flamebait)

      by DavidHOzAu ( 925585 )
      Oh please. Lay off the Zonk bashing. Read the summary and note that it was not written by Zonk.

      Don't like the stories? Then take a drink from the FireHose [slashdot.org] and mod up the contributions that interest you.
      • Yes, my bad. I was moving stuff around & trying to make it coherent. I must have missed that. You may mock me mercilessly.
        • No biggie. I think most of us can tell what word was meant to be in here.

        • Re: (Score:2)

          by Goaway ( 82658 )
          The reason one has editors, normally, is to catch such mistakes and fix them before the thing is published. Of course, Slashdot "editors" do not do any actual "editing".

          It makes Slashdot "more real", according to Taco!

  • Key Details (Score:5, Informative)

    by Kelson ( 129150 ) * on Saturday March 03, 2007 @03:00AM (#18215794) Homepage Journal

    From the article, and from some comparisons I did on the downloads:

    • The attacker only altered the released files on the download server, not the Subversion repository. (TFA)
    • Only the 2.1.1 release was altered. Older versions, such as 2.0, don't seem to have been affected. (TFA)
    • If you downloaded 2.1.1 when it was first released, it's probably okay. If you grabbed it in the last four days, you're probably compromised. Upgrade NOW. (TFA, verified with diff)
    • 2.1.2 also includes a fix for a cross-site scripting vulnerability [wordpress.org] discovered a few days ago, so it's worth updating anyway. (diff)

    I still had the tar archive of 2.1.1 from when I grabbed it the day of the release, so I compared its contents to the 2.1.2 archive. The two files mentioned in the announcement, feed.php and theme.php, aren't any different, confirming that the initial release was unaffected. That's also where I saw the changes for that XSS bug.

    • Re: (Score:3, Insightful)

      by djupedal ( 584558 )
      '...confirming that the initial release was unaffected.'

      No, sorry.

      It only confirms that your copy of the initial release was unaffected. Someone could have come along right after your download and pipped things so that anyone in line right after you received the dirty diaper.

      "If you downloaded 2.1.1 when it was first released, it's probably okay. "

      'if'...? Everyone should update - it's the only safe and practical response, rather than chancing things on an 'if'.

      • Re: (Score:2)

        by Kelson ( 129150 ) *

        It only confirms that your copy of the initial release was unaffected. Someone could have come along right after your download and pipped things so that anyone in line right after you received the dirty diaper.

        Good point. In this case, the WP folks seem certain it was compromised within the last four days, but you're right, my data point doesn't confirm anything later than whatever time of day it was on Feb. 21.

        What I was trying to say was that what I've seen is at least consistent with the timeline th

    • Don't they use md5 hashes for integrity check?

      • Re: (Score:2)

        by DrSkwid ( 118965 )
        md5 alone wouldn't be any use, it's been compromised for comparing the identity of two data blocks.

        • Re: (Score:1)

          by maxume ( 22995 )
          Is a locked door that is less than indestructible useless?

          (That is, if the cracker that did this wasn't able to generate an attack on the md5, it would have mitigated the consequences(assuming somebody bothered to check))

      • Re: (Score:2)

        by Kelson ( 129150 ) *
        The "download archive" page (which lists every public release since WordPress branched from B2) provides MD5 hashes, but they're not linked or listed from the main download page for some reason. It's also not made clear on the page whether the MD5 hash is of the ZIP archive or the tar.gz archive.

        So while the hash is there, probably only 1% of downloaders would even see that it exists.
    • Given these details, this raises the (recurring) issue of where it is safe to get software from. I generally assume that I am fairly safe in using only stuff from my distro's repositories, rather than getting the bleeding-edge versions from individual sources. But I guess I am presuming that central repos are better-secured and more carefully monitored than separate ones - well, perhaps not necessarily on average, but at least from a worst-case perspective (lots of different sources means more chances for a
    • Hey, thanks for some actual information!

  • Cracker (Score:1, Redundant)

    by Bo'Bob'O ( 95398 )
    First time I read that headline, I wondered for a second why it was significant it was compromised by a white guy.
    • Script kiddie would be a better term, regardless of technical knowledge, the person had the attitude of a script kiddie.
      I hope they catch the worthless sack of shit that did it, too bad that probably wont happen.

    • Re: (Score:1)

      by undoIT ( 1070894 )
      "I've been crackered!"

      Parse error: syntax error, unexpected $end in /home/myaccount/public_html/weirded/wp-admin/admin -functions.php on line 2327
      ...unless i just forgot my site is installed in a sub-directory while trying to run upgrade.php ;)

  • Also update your.. (Score:2, Informative)

    by blankoboy ( 719577 )
    To stray on the side of caution, as we don't yet know the nature of the code that was changed, it may be wise for Wordpressers to also change your WP db passwords while updating wp-config.php to reflect the change. If your site was vulnerable with 2.1.1 installed who knows what was done and if what was seen. Perhaps it may be good to even update existing WP user passwords.

    • Re: (Score:2)

      by teslar ( 706653 )

      To stray on the side of caution, as we don't yet know the nature of the code that was changed [...] who knows what was done
      Err. diff would tell you exactly what bits - and thus the nature - of the code that was changed. Also, TFA knows what was done:

      They modified two files in WP to include code that would allow for remote PHP execution.
    • To "err" on the side of caution.

  • This is always a major concern for OSS projects (Score:2, Insightful)

    by Anonymous Coward
    Sometimes I'm sure I'm the only person giving source the once-over before I build or install it. There's little chance of finding anything even if the source has been compromised but it helps me sleep better. Auditing install targets in Makefiles (for shell daemons) is a great hobby.

    OSS releases should be GPG signed by now, unless the attacker can compromise the key we're then left with tampering in the repository.
  • There is an efficient way to avoid such tempering, or at least to hope that those tricks will be quickly discovered by somebody: seal (sign) your published works, dammit!
    • have a well-signed and published (on the keyservers) GnuPG (GPG) key
    • do only transfer/store the private key on absolutely sure boxes, and only if it is strictly necessary
    • keep a backup of the private key in an ultra safe place
    • give a copy of the revocation certificate to a few very good friends
    • publish the public key on a good keyserver
  • How does this affect Wordpress mu (multiuser)? http://mu.wordpress.org/ [wordpress.org]
  • As an ex-wordpress user, this just points out one among the many changes and improvements they need to make. Security is important, but if the fundamental framework itself is weak, nothing else is going to matter too much. Wordpress is crippled in that it simply can't take a digg or heavy slashdot hit. Check out any wordpress site that's been dugg to front page, chances are 99% it's going to be dead in minutes.

    • Re: (Score:2)

      by Trillan ( 597339 )
      I don't know if it could handle slashdot or a digg, but one of the major pushes recently has been SQL query optimization. It's made a big difference.

Slashdot Top Deals

"An ounce of prevention is worth a ton of code." -- an anonymous programmer

Close