Wordpress blogs are at risk

wannabie

wannabie

Elite Member
Joined
Mar 11, 2009
Messages
3,798
Reaction score
2,971
TENS OR HUNDREDS OF THOUSANDS of Wordpress installations are at risk of being compromised because of a critical vulnerability in a popular third-party image manipulation script called timthumb.
The affected image utility is not part of the main Wordpress package, but is incorporated in many popular Wordpress themes. The script consists of a single file called timthumb.php and facilitates on-the-fly image cropping, zooming and resizing.
Timthumb defines a white list of remote domain names from which images can be fetched by default, which include popular image hosting web sites like Flickr.com, Picasa.com, Blogger.com, Wordpress.com, Photobucket.com and others.


Read more: http://www.theinquirer.net/inquirer/news/2099162/wordpress-blogs-risk#ixzz1TyrhkHxK
The Inquirer - Computer hardware news and downloads. Visit the download store today.

Just so you know :)
 
Advertise on BHW
Interesting article. I'm not a php guru but having checked timthumb.php

PHP: 
// external domains that are allowed to be displayed on your website 
$allowedSites = array (     
     'flickr.com',     
     'picasa.com',     
     'img.youtube.com', 
);
Wouldn't it solve the problem by removing the external domains and instead use only your domain? That is if the blog in question doesn't pull images off the domains mentioned in the function..
 
Trophaeum made a post about this:
Code: 
http://www.blackhatworld.com/blackhat-seo/blackhat-lounge/337505-wordpress-zero-day.html

Hope it helps!
 
The thread above features a simple edit that fixes the problem
 
Yep, checked with wordpress.stackexchange as well. Removing those domains does the job.
 
I don't use that plugin, but thanks for the heads up.
 
I found it in the Gazette nulled theme, from here. And in some IGIT related posts plugins(only one related posts plugin that actually works with my sites for some reason). And all my sites were hacked couple of days earlier
 
Here's the fix I posted on another thread:

Replace the timthump.php file in your blog theme with this update to close the vulnerability:

http://code.google.com/p/timthumb/

That said looking at the the Timthumb issue stack I'm not necessarily sure that the developer has completely closed the exploit since the status says started:

212 Defect Started Medium ---- ---- Zero day vulnerability that gives remote attacker shell access
217 Defect Started Medium ---- ---- Timthumb must not use web accessible dir as cach
 
Just remove those allowed domains and feel safe until next 0day
 
Nice! Received a notice from my FatCow host that they have replaced all of the Timthumb files with an updated file automatically! Saved me some time!
 
bertbaby said:
Nice! Received a notice from my FatCow host that they have replaced all of the Timthumb files with an updated file automatically! Saved me some time!
Click to expand...

hostgator did nothing. But manually removed the external src sites from timthumb. friends top tech blog got hacked due to a related post plugin which uses timthumb for thumbnail view. some one uploaded a shell server script to his host using the vulnerability.
 
I really hope it works, most of my sites are built in Wordpress.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top