Heute morgen bekam ich folgende Email:
TITLE:
WordPress PHP Code Injection Vulnerability
SECUNIA ADVISORY ID:
SA20271
VERIFY ADVISORY:
http://secunia.com/advisories/20271/
CRITICAL:
Moderately critical
IMPACT:
System access
WHERE:
>From remote
SOFTWARE:
WordPress 2.x
http://secunia.com/product/6745/
DESCRIPTION:
rgod has discovered a vulnerability in WordPress, which can be exploited by malicious users to compromise a vulnerable system.
Input passed to various fields when registering or updating the user profile isn't properly sanitised before being stored in PHP scripts in the wp-content/cache/userlogins/ and wp-content/cache/users/ directories inside the web root. This can be exploited to inject and execute arbitrary PHP code via the newline character.
It is also possible to supply a spoofed IP address when registering by setting the "PC_REMOTE_ADDR" HTTP header.
The vulnerability has been confirmed in version 2.0.2. Other versions may also be affected.
SOLUTION:
Restrict web access to the wp-content/cache/userlogins/ and wp-content/cache/users/ directories (e.g. with a .htaccess file).
PROVIDED AND/OR DISCOVERED BY:
rgod
ORIGINAL ADVISORY:
http://retrogod.altervista.org/wordpress_202_xpl.html
