My Security Planet » Tags

42 items tagged "Advisories"

BlogSecurity

WordPress Plugin DM Albums 1.9.2 vulnerabilities

Posted: July 1st, 2009, 8:33am CDT by DK

Tags: Advisories [edit]

DM Albums™ is an inline photo album/gallery plugin that displays high quality images and thumbnails perfectly sized to your blog. Two vulnerabilities have been made public: 1. Stack released a “remote file disclosure vulnerability” (Low-Medium Risk Level) 2. Septemb0x released a “remote file include vulnerability” (Critical Risk Level) An attacker could use these vulnerabilities to potentially gain full access [...]
WordPress Plugin Related Sites 2.1 Blind SQL Injection Vulnerability

Posted: July 1st, 2009, 8:26am CDT by DK

Tags: Advisories [edit]

A critical vulnerability has been discovered in the WordPress Plugin Related Sites plugin. An exploit is available in the wild and available on Milw0rm, making this attack easier to exploit. Although, the vulnerability says that version 2.1 is vulnerable. You should assume previous versions are vulnerable as well. BlogSec have confirmed that the current version (at the [...]

hackademix.net

Attention Mac Users

Posted: May 20th, 2009, 10:21am CDT by Giorgio

Tags: Advisories [edit]

An old Java vulnerability, already fixed 6 months ago in every Java implementation except Apple’s, allows remote attackers (i.e. malicious web sites) to launch arbitrary code from Safari or Firefox with full user privileges, evading the Java applet sandbox on Mac OS X.

Here’s the Slashdot’s routine Apple+Java bashing with linked source articles.

At this moment, the easiest way to protect your Mac web browser is either turning off Java globally or… you know what ;)
Update Jun 15th
Three weeks later, Apple finally patched..
Firefox Light Speed Update and NoScript XSLT Protection

Posted: March 27th, 2009, 3:51pm CDT by Giorgio

Tags: Advisories [edit]
In a twisted reverse April fool, Mozilla decided to anticipate the release from April the 1^st: it’s today, folks.

As you may already know, it fixes:
1. the mysterious flaw exploited by “Nils” at the CanSecWest Pwn2Own contest, at the speed of light (the IE8 and Safari vulnerabilities revealed the same day are still unpatched);
2. the XLST processing bug which I wrote about yesterday.
Current NoScript stable version (1.9.1.4) prevents the XSLT crash from be exploited for malicious purposes, by defeating heap spray attempts which require JavaScript, Java or Flash. That’s very good, but not enough: a crash is still annoying even if it cannot install malware, notwithstanding session restore.

Since we can (un)safely assume this is not the only potentially exploitable XSLT parser bug hanging around, today I released the NoScript 1.9.1.5 development build, featuring specific XSLT protection: XSL stylesheets won’t be processed unless they’re from a trusted source and their parent document is trusted as well. This countermeasure effectively prevents malicious sites from crashing (or, worse, compromising) your browser through this or any other XSLT bug discovered in future. As NoScript’s motto says, defeating “exploitation of security vulnerabilities, known and even not known yet!” :)
Lock Down Firefox for the Weekend

Posted: March 26th, 2009, 3:45pm CDT by Giorgio

Tags: Advisories [edit]

A Firefox 3.0.8 “high-priority fire drill security update” is on its way, likely to be released by the middle of next week (April the 1^st at most, jokes aside). The reason is an emergency patch for a critical vulnerability irresponsibly disclosed by Guido Landi. I feel a bit guilty about it because Mr. Landi is Italian like me — not that here in Italy we lack reasons for being ashamed…

Beware the PoC: it will crash Firefox on Windows, Linux and Mac OS X even if you’ve got NoScript. However this crashing bug, like the vast majority of them, is not exploitable if you’ve got JavaScript and other active content disabled on the attacker site, because reliable exploitation requires scripting to “spray the heap”, i.e. to inject the malicious payload at the right places of your memory for execution.
Therefore you can easily survive until the automatic update kicks in, if you don’t mind the possibility of an annoying but not dangerous crash (thanks, session restore!) ;)

On a side note, it’s time to update Java as well: yet another bunch of critical vulnerabilities, several of them exploitable in your browser. Business as usual…

Important updates here.

BlogSecurity

WordPress MU < 2.7 Cross Site Scripting Vulnerability

Posted: March 19th, 2009, 3:32am CDT by DK

Tags: Advisories [edit]

Cross Site Scripting Vulnerability Juan Galiana Lara has released details regarding a vulnerability that affects WordPress MU versions < 2.7. Version 2.7 is NOT affected according to the advisory. So if you have upgraded to 2.7 you can ignore this advisory. Vulnerability Details WordPress MU prior to version 2.7 fails to sanitize the Host header correctly in choose_primary_blog function [...]
Old WP-Forum Vulnerability Gets Disclosed

Posted: January 26th, 2009, 6:14pm CST by DK

Tags: Advisories [edit]

An vulnerability for Fredrik Fahlstad’s WP-Forum Plugin has been made public on milw0rm. The exploit appears to affect an older version (1.7.8) of the popular WordPress plugin. The plugins homepage is already on version 2.2. This means this vulnerability was probably discovered shortly after the initial version 1.7.4 vulnerability reported by BlogSecurity in early 2008. As [...]
WordPress

Posted: January 8th, 2009, 8:35am CST by DK

Tags: Advisories [edit]

Jeremias Reith has published the advisory to Bugtraq which includes a proof of concept exploit that may allow an unauthenticated attacker access to your blog. Product affected: WordPress Version(s):

hackademix.net

It’s simple like…

Posted: December 13th, 2008, 4:26pm CST by Giorgio

Tags: Advisories [edit]

Microsoft’s “clarification” on the various workarounds for the recent Internet Explorer security debacle.
More Bad News for IE Users

Posted: December 12th, 2008, 10:09am CST by Giorgio

Tags: Advisories [edit]
Latest updates from Microsoft: the critical remote execution bug which we already talked about affects all IE versions (included IE8 beta) on every supported Windows operating system.
The bulletin also corrects some early assumptions about this unpatched vulnerability, which is being actively exploited in the wild from apparently legitimate sites infected through automated SQL injections:
- The hole is in data binding, and not in XML processing like many (me too) reported initially.
- Increasing the security level of the Internet Zone to “High” and disabling active scripting does not suffice to protect you, even if it makes attacker’s life slightly harder. Not harder than yours, though, since Microsoft’s “Security Zones” have nothing of NoScript’s usability…
The only work-around suggested by Microsoft is disabling both active scripting and the OLEDB32 library, which is unluckily required by most applications working with databases.

So, do you really want to keep inflicting yourself that blue “e”? Or are you ready for a red panda?

BlogSecurity

WordPress 2.6.2 Snoopy Vulnerability

Posted: November 1st, 2008, 10:56am CDT by DK

Tags: Advisories [edit]

WordPress announced the following vulnerability in WordPress 2.6.2: A vulnerability in the Snoopy library was announced today. WordPress uses Snoopy to fetch the feeds shown in the Dashboard. Although this seems to be a low risk vulnerability for WordPress users, we wanted to get an update out immediately. 2.6.3 is available for download right now. If [...]
st_newsletter SQL Injection

Posted: November 1st, 2008, 10:50am CDT by Philipp

Tags: Advisories [edit]

The st_newsletter Plugin is once again vulnerable to SQL Injection. The hole is located within the page stnl_iframe.php, the parameter newsletter is missing correct sanitisation and so the plugin is prone to this attack. Currently we’re not aware about any fixes, users should disable the Plugin in the meantime, or should fix the problem their self. [...]
Multiple vulnerabilities in WP Comment Remix 1.4.3

Posted: November 1st, 2008, 10:47am CDT by Philipp

Tags: Advisories [edit]

A number of vulnerabilities have been discovered in the WP Comment Remix 1.4.3 plugin. The following is a short overview of the vulnerabilities discovered: SQL Injection: caused by unsanitized variable “p” in the ajax_comments.php file. Cross Site Scripting: This affects authenticated and unauthenticated users. Cross Site Request Forgery: the form generated through wpcr_do_options_page lacks the WordPress wp_nonce security function. These [...]
Wordpress-MU Cross Site Scripting Vulnerability

Posted: October 2nd, 2008, 3:46pm CDT by Philipp

Tags: Advisories [edit]

Product: Wordpress-MU (multi-user)
Version: Versions prior to 2.6 are affected
Credits: Juan Galiana

Juan Galiana has published the advisory to Bugtraq this week which includes a proof of concept exploit.

Wordpress-MU is affected by a Cross Site Scripting vulnerability, an attacker can perform an XSS attack that allows him to access the
targeted user cookies to gain administrator privileges

In /wp-admin/wpmu-blogs.php an attacker can inject javascript code, the input variables “s” and “ip_address” of GET method aren’t properly sanitized

WordPress-MU were notified and version 2.6.1 addresses this issue. We recommend all users upgrade as soon as possible.
WordPress 2.6.1 Weak Entropy Vulnerability

Posted: September 11th, 2008, 5:08am CDT by DK

Tags: Advisories [edit]

iso^kpsbr has discovered a vulnerability that may allow an external attacker to gain admin access to WordPress 2.6.1.

WordPress is prone to a weakness in the entropy of generated passwords. Successfully exploiting this issue may allow an attacker to guess randomly generated passwords. WordPress 2.6.1 is vulnerable; other versions may also be affected.

The original advisory and proof of concept exploit is available on securityfocus.
WP Contact-Form Vulnerabilities

Posted: August 13th, 2008, 10:03am CDT by DK

Tags: Advisories [edit]

WP Contact Form is a very popular WordPress plugin.

Mustlive has reported a number of vulnerabilities which you can view at his web page here.

According to the plugin authors page, the latest version is 3.1.8. We went ahead and downloaded a copy to have a look. The actual contact form page that your users see is not vulnerable to these attacks. However, the "/wp-admin/admin.php?page=wp-contact-form
/options-contactform.php" is vulnerable.

Please note at the time of writing this article all versions appear affected (<=3.1.8). We recommend disabling this plugin until a fix can be provided.
WP Downloads Manager 0.2 Remote File Upload

Posted: August 7th, 2008, 4:21pm CDT by DK

Tags: Advisories [edit]

The Wp Downloads Manager module is a plugin for WordPress.

Wp Downloads Manager is prone to a vulnerability that lets attackers upload and execute arbitrary code. This issue occurs because the application fails to sufficiently sanitize user-supplied file extensions before uploading files onto the webserver via the ‘upload.php’ script.

Successfully exploiting this issue will allow attackers to upload and execute arbitrary PHP code within the context of the webserver process. This may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Wp Downloads Manager 0.2 is vulnerable; other versions may also be affected.
Affected Products:
Giulio Ganci Wp Downloads Manager 0.2
References:
Giulio Ganci: Wp Downloads Manager Homepage

An exploit has been made available on Milw0rm and is publically available.
Credits:
Thanks to MustLive for informing us of this issue.

More information is available at [www.juniper.net]
Nextgen gallery - XSS flaw

Posted: June 18th, 2008, 4:01am CDT by Philipp

Tags: Advisories [edit]
The Nextgen Gallery Plugin version <= 0.96 have been found vulnerable to a persistent Cross Site Scripting bug..

According to the advisory, the attacker does require authentication and access to the following URL:
```
http://[host]/[directory]/wp-admin/admin.php?page=nggallery-manage-gallery
```
As far as we know, no fix is currently available.
WordPress Upload File Plugin SQL Injection

Posted: May 31st, 2008, 3:31pm CDT by Philipp

Tags: Advisories [edit]

A SQL Injection vulnerability has been reported in WordPress by the Balsec Team. The advisory is lacking alot of detail.

This post will be updated as new information is made available.
WordPress 2.3.3 Directory Traversal Vulnerability

Posted: May 31st, 2008, 3:26pm CDT by Philipp

Tags: Advisories [edit]

Sandor Attila Gerendi found a vulnerability within WordPress 2.3.3, which under certain circumstances allows an attacker to run arbitrary PHP code on WordPress 2.3.3.

Input passed via the “cat” parameter to index.php is not properly sanitised in the “get_category_template()” function in wp-includes/theme.php before being used to include files in template-loader.php. This can be exploited to include arbitrary PHP files from local resources via directory traversal attacks.

According to the advisory, successful exploitation allows execution of arbitrary PHP code, but requires privileges to store PHP files on an affected system and that WordPress is installed on a Windows platform.

The vulnerability is confirmed in version 2.3.3.

Solution:
Update to version 2.5.1.

If you wish to patch your 2.3.3 install, please see the WordPress Trac.
WordPress 2.5.1 Malicious File Execution

Posted: May 31st, 2008, 3:18pm CDT by Philipp

Tags: Advisories [edit]

CWH Underground have published an advisory regarding a malicious file execution vulnerability in WordPress 2.5.1.

We do not quite follow this advisory. The vulnerability discusses the idea of uploading a PHP backdoor onto a WordPress blog via the upload file facility, or via the plugin edit facility. I don’t think this is really a WordPress issue but rather the correct functionality of WordPress.

We have discussed before in our WordPress Whitepaper that the file upload facility should be restricted to trusted users only. We also recommend you reading our Role Management post.

hackademix.net

Unpatched Flash Vulnerability Widely Exploited in the Wild

Posted: May 28th, 2008, 3:33am CDT by Giorgio

Tags: Advisories [edit]

Yesterday Symantec elevated its ThreatCon rating as a response to an infection involving about 20,000 web pages (250,000 according to other sources), and probably still actively spreading through an automated SQL injection.

The main news is that this time an apparently unpatched vulnerability affecting Adobe Flash Player is being exploited, making the attack on end-users effectively cross-browser and potentially cross-platform:

The attack uses multiple layers of SWF redirection and generates URLs designed to target specific Flash version and browser combinations, supporting both Internet Explorer and Firefox.

The Adobe Product Security Incident Response Team reports of being aware of this problem and cooperating with the antivirus company for a precise assessment.

In the meanwhile, according to Symantec, you should:

Avoid browsing to untrustworthy sites. Consider disabling or uninstalling Flash until patches are available. Deploy script-blocking mechanisms, such as NoScript for Firefox, to explicitly prevent SWFs from loading on all but explicitly trusted sites. Temporarily set the kill bit on CLSID d27cdb6e-ae6d-11cf-96b8-444553540000 until patches availability is confirmed.

Additional notes for NoScript users
Since the offending SWF files are served from external ad-hoc Chinese domains, (wuqing17173.cn, woai117.cn and dota11.cn at this moment,very unlikely to be in your whitelist), even if a trusted site was infected you should still be protected.

However, if you want maximum protection, it’s a good time to check NoScript Options|Plugins|Apply these restrictions to trusted sites as well.
This option turns NoScript in an effective security-oriented replacement of the FlashBlock extension, working also with Java, Silverlight and other potentially vulnerable plugins such as QuickTime.
All the active embedded content pieces, no matter where they come from, will be blocked preemptively and you will be able to load them selectively by clicking on visual placeholders.
Update
(from PSIRT’s blog):

This exploit appears to be taking advantage of a known vulnerability, reported by Mark Dowd of the ISS X-Force and wushi of team509, that was resolved in Flash Player 9.0.124.0. We strongly encourage everyone to download and install the latest Flash Player update, 9.0.124.0.

Since the currently exploited vulnerability appears to be patched, but the attacking vector explicitly tests for the 9.0.124.0 player and can perform dynamic redirects, I’d obviously upgrade but still stay on the cautious side, deploying preemptive countermeasures just in case they’re saving the real zero-day for a second weave…

BlogSecurity

WordPress 2.5.1 Release Fixes Several Vulnerabilities

Posted: April 28th, 2008, 3:30am CDT by Philipp

Tags: Advisories [edit]

The First Security- & Bugfix Release of the latest WordPress branch is now available. WordPress do not mention the vulnerabilities fixed on the download page, but BlogSec recommended 2.5 users upgrade ASAP.

Of all the bugs fixed, two fairly critical security issues were fixed. A Cross-Site Scripting vulnerability and the WP 2.5 Cookie Integrity Protection Vulnerability, discovered by Steven J. Murdoch.

The latest WordPress 2.5.1 can be downloaded from WordPress.

WordPress discuss the vulnerabilities here and as part of their development feed.
Wordpress 2.5 Cookie Integrity Protection Vulnerability

Posted: April 27th, 2008, 2:12pm CDT by DK

Tags: Advisories [edit]

Steven J. Murdoch has discovered a vulnerability in WordPress 2.5 that may allow a registered user to gain admin level access on the blog. Only WP 2.5 blogs that permit users to register user accounts are vulnerable.

According to Steven:

This vulnerability exists because it is possible to modify
authentication cookies without invalidating the cryptographic
integrity protection.

If a Wordpress blog is configured to freely permit account creation,
a remote attacker can gain Wordpress-administrator access and then
elevate this to arbitrary code execution as the web server user.

The fix is fairly straight forward and WordPress have released a fix in WordPress 2.5.1.

Please note this vulnerability is different to [blogsecurity.net]

Steven’s Advisory is available here.
WordPress 2.5 Secret_Key Vulnerability

Posted: April 16th, 2008, 4:20am CDT by DK

Tags: Advisories [edit]
José Carlos Nieto Jarquín has found a vulnerability affecting WordPress 2.5 ONLY. His advisory was released on SecurityFocus yesterday.

Our recent "Secure WordPress Whitepaper Revision" shows the new WordPress SECRET_KEY variable in the ‘wp-config.php’ file. This SECRET_KEY must be set to something random, as specified in the WordPress documentation. If not, it may be possible for an attacker to brute force the default WordPress SALT generation process to gain access to your blog.

The vulnerability has been reported as a Medium risk as it only affects WordPress installations matching a certain criteria. See advisory for more details.

A proof of concept exploit is publicly available. Please ensure that you set your SECRET_KEY in your ‘wp-config.php’ file to something random.

From wp-config.php:
```
Change SECRET_KEY to a unique phrase.  You won't have to remember
it later, so make it long and complicated.  You can visit
https://www.grc.com/passwords.htm to get a phrase generated for you,
or just make something up.
define('SECRET_KEY', 'put your unique phrase here');
```
WordPress.com Blogs Vulnerable

Posted: March 9th, 2008, 3:21pm CDT by Philipp

Tags: Advisories [edit]

WordPress.com (2.3.2) is vulnerable to two Cross-Site Scripting vulnerabilities. It is important to note that these only affect WordPress.com blogs.

Proof of concept exploits have been released and there is a danger that an XSS Worm could use this type of vulnerability to compromise thousands of WordPress.com blogs. (See developer verse hosted blogs debate.).

Doz from hackerscenter.com released the advisory. The full disclosure advisory is available and a Video demonstration was also released.

Note (again):These vulnerabilities only affect the Hosting Platform WordPress.com as the download package of WordPress doesn’t include invite.php or users.php file.
wp-people, Simple Forum, WP Photo Album, Search Unleashed, Sniplets

Posted: February 27th, 2008, 11:18am CST by Philipp

Tags: Advisories [edit]

Once again a number of critical issues have been discovered in a variety of WordPress plugins. If you are using one of these plugins, we suggest disabling the plugin until a fix has been produced by the plugin developer. Info as follows:

WP People <=1.6 is vulnerable to SQL Injection. The person parameter is not correctly sanitised. This means the WordPress blog database and blog may be compromised. Credit goes once more to S@BUN
Original Entry on BugTraq

Simple Forum <2.1 (Build 237) The Forum and Topic parameters are not correctly sanitised. This means the WordPress blog database and blog may be compromised. S@BUN is credited for these Disclosures: SF 1, SF 2.

WP Photo Album - WPPA <1.1 The photo and album parameters are not correctly sanitised. This means the WordPress blog database and blog may be compromised.
The vulnerability was found by S@BUN and is fixed in Version 1.1 of WPPA.

Search Unleased <=0.2.0 is vulnerable to Arbitrary HTML Injection. Advisory here. Krzysztof Burghardt is credited for this discovery. This vulnerability is confirmed within Version 0.2.0 and will be fixed with the upcoming Release 0.2.1. This vulnerability is being exploited in the wild, we recommend disabling the plugin until a fix can be provided.

Sniplets 1.1.2 (and possibly other versions) have been found vulnerable to a number of HIGH risk issues, including HTML Injection, File Upload and PHP code execution. We strongly recommend disabling this plugin until a fix is provided.
nbbn@gmx.net is credited for discovering these issues.
Ferruh WordPress CSRF Vulnerability

Posted: February 13th, 2008, 6:07am CST by DK

Tags: Advisories [edit]

Ferruh sent BlogSec an email this morning about a new attack vector for WordPress, using CSRF (Cross Site Request Forgery).

We have not yet had time to investigate the issue further, but it looks interesting. The basic concept revolves around the fact that WordPress is user friendly and asks the user for confirmation before submitting a request without a valid nonce.

By dressing the request in some fancy CSS it may be possible to get the user to confirm the request without them knowing.

Its a CSRF with some user intervention requirements which may mean a little social-engineering. Ferruh also provides a proof of concept exploit.

Ferruh credits BlogSec’s Gareth Heyes for his work around CSS Overlays.

Nice work Ferruh!
WordPress Mu 1.3.3 Security release

Posted: February 7th, 2008, 3:52am CST by Philipp

Tags: Advisories [edit]

Donncha has announced the new release of WordPress MU (1.3.3). This release fixes the same flaw in XML-RPC as the WordPress core release.

We recommend you update your WP-MU to the latest version or atleast upgrade your xmlrpc.php file.
dmsguestbook, st_newsletter, Wordspew, wp-footnotes vulnerabilities

Posted: February 5th, 2008, 3:39am CST by Philipp

Tags: Advisories [edit]

Within the last few days a number of remote SQL Injection vulnerablities within a variety of plugins have been released. This new search for this type of vulnerability follows David Kierznowski’s recent finding in the popular WP TextLinkAds plugin.

dmsguestbook 1.7.0 is vulnerable to multiple vulnerabilites. At first it’s possible to Deface your wp-config.php, an Attacker can gain in that way access to your MySQL data. It’s caused by improperly control/sanitization of the parameters folder & file. At the same time there are multiple XSS vulnerabilities which are also HIGH risk issues.

There are several SQL Injection vulnerabilities within this plugin. More information is available at bugtraq.

We highly recommend to disable and remove the plugin from your Blog until a major version release to address all these holes. It is likely that previous versions are affected as well.

The Version 1.8 is available but BlogSecurity have received reports that it does not solve all the problems.

st_newsletter 2.x is vulnerable to SQL Injection. This is caused by improper sanitisation of the newsletter parameter within the shiftthis-preview.php file. This makes it possible to retrieve a list of all registered Users and their Password hashes. This hole was discovered by S@BUN and we’re not aware of any current fixes.

Another SQL Injection was made public by S@BUN again, for Wordspew here is the parameter id in wordspew-rss.php. This parameter is not sanitized and therefore open to attacks. Again we’re not aware of any fixes.The latest version, 3.72 fixes the Vulnerability. It’s available on the official WordSpew Webpage

The last hole for now is within wp-footnotes 2.2. The current version allows access to the Adminpanel of the plugin via the URL. This results in XSS vulnerabilities. More can be found over on BugTraq. Again no fix is currently available.
Fredrik Fahlstad Plugins Vulnerable

Posted: February 1st, 2008, 3:27am CST by Philipp

Tags: Advisories [edit]

The H-T Team made some new exploits public which affect following Plugins by Fredik Fahlstad fGallery 2.4.1 and WP-Cal 0.3, both are vulnerable against Remote SQL Injection. It is likely that earlier versions are affected.

Within the WP-Cal Plugin, the File editevent.php is vulnerable for this attack, because of improper sanitisation of the id parameter. Within the fGallery Plugin the File fim_rss.php is vulnerable to this attack, the parameter album isn’t properly sanitized as well.

PoCs are available on Milw0rm here and there.

To fix these vulnerabilites you have to change the following lines For WP-Cal:
$id = $_GET['id']; $event = $wpdb->get_row(”SELECT * FROM $table WHERE id = $id”);
To
$id = intval($_GET[’id’]); $event = $wpdb->get_row(”SELECT * FROM $table WHERE id = $id”);

And for fGallery:
$cat = $wpdb->get_row("SELECT * FROM $cats WHERE id = $_GET[album]"); $images = $wpdb->get_results(”SELECT * FROM $imgs WHERE cat = $_GET[album] AND status = ‘include’”);

To
$cat = $wpdb->get_row("SELECT * FROM $cats WHERE id = intval($_GET[album])“); $images = $wpdb->get_results(”SELECT * FROM $imgs WHERE cat = intval($_GET[album]) AND status = ‘include’”);
More changes may be needed, to fix the vulnerability at all.

Currently we’re not aware of any official fixes for these holes.
wp-calc & wp adserv plugin vulnerabilities

Posted: February 1st, 2008, 3:21am CST by DK

Tags: Advisories [edit]

Jeffro2pt0 at WeblogToolsCollection has reported two new vulnerabilities that have recently been found in WordPress plugins:

Today, we have a moderately critical SQL Injection Vulnerability that was discovered by HouSSaMix in the “WP-Cal” plugin version 0.x for WordPress.

A person who goes by the handle “enter_the_dragon” has discovered a vulnerability within the Adserve Plugin version 0.2 for WordPress.

More info at WeblogToolsCollection website.
WP-Forum 1.7.4 SQL Injection

Posted: January 22nd, 2008, 2:23pm CST by Philipp

Tags: Advisories [edit]

For Fredrik Fahlstads WP-Forum Plugin was a critical vulnerability made public. Details are available on Secunia and milw0rm.

This hole may allow an unauthenticated attacker full access to your blog and potentally your web server/host.

Input passed to the “user” parameter in the WordPress installation’s index.php script (when “forumaction” is set to “showprofile” and “page_id” to a page with the “” tag) is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
PoC
See milw0rm
Fix
The BlogSec team are unaware of any fixes at this time.
WP TextLinkAds Plugin SQL Injection Vulnerability

Posted: January 16th, 2008, 5:07pm CST by DK

Tags: Advisories [edit]

David Kierznowski of BlogSecurity has found a critical vulnerability in the popular TextLinkAds plugin for WordPress. The vulnerability allows an unauthenticated, remote attacker to completely compromise your database and therefore your blog.

This is a serious security risk, and should take higher priority then what it has. I have shared various emails with TextLinkAds (starting 31 Dec 2007), but no fix has been made available to date - as far as I am aware. It was trivial to find and there are most likely others… I am releasing this now as attackers may already be exploiting it and I am reluctant to leave it longer.

The vulnerability was tested on version 1.1.1 and the latest version 1.1.3, both were found vulnerable. Please note I have verified that this vulnerability affects v3.0.8.. Please note, all plugins are likely affected before (15/Jan/08). DO NOT rely on the version numbers.
Proof of concept:
Removed for security reasons.
Fix information:
The vulnerable code is found on line 512:
$postId = $postId;
This variable is passed to $wpdb->get_results without being sanitised.
to fix this hole, simply change the above line to:
$postId = (int) $postId; /* FIXED */

While browsing through the code, I did notice other SQL Injection problems, but some of these are mitigated by the fact that you need a valid TextLinkAds key to call the function, but a more indepth view may reveal more.
Summary
Although I have provided a fix, I would suggest disabling this plugin until a full review of the code has been conducted by TextLinkAds and an appropriate fix released. I am sure this will cause alot of anxiety, especially as a number of larger and smaller blogs earn income via this service.
Democracy 2.0.1 HTML Injection Vulnerability

Posted: January 16th, 2008, 6:24am CST by DK

Tags: Advisories [edit]

Intro
Democracy is a popular AJAX driven voting plugin for WordPress.

BlogSecurity found a vulnerability in the latest version of Democracy (2.0.1) that may allow attackers to hijack your admin/user accounts as well as a vast number of other attack vectors.

Proof of concept (test your blog):

http://wordpress.dom/blah’style=xss:expression(alert(document.cookie)); (Tested on IE7)
OR
http://wordpress.dom/blah’onMouseOver=javascript:alert(document.cookie);// (Testing on Firebox & IE)

This proof of concept exploits above can be used to test for vulnerable blogs.
How to fix?
Go to your democracy plugin directory and edit class.php.

Vulnerable code: in class.php (Line 166)
$url = htmlspecialchars(add_query_arg(array(’dem_action’ => ‘view’, ‘dem_poll_id’ => $this->id)));

Change to:
$url = htmlspecialchars(add_query_arg(array(’dem_action’ => ‘view’, ‘dem_poll_id’ => $this->id)), ENT_QUOTES);

Double quotes are escaped but single quotes aren’t. As single quotes are used in $url, we can append malicious code.As a fix, we simply use htmlspecialchars() with ENT_QUOTES.
Summary
The Democracy author was contacted initially on the 31 December, and then again at the beginning of last week. As we have not heard anything in over 15 days, we are releasing the advisory along with a fix.

David Kierznowski is credited for the find.
Defeating Audio Captcha Systems

Posted: January 11th, 2008, 8:24am CST by DK

Tags: Advisories [edit]
Jose Palazon, sent us an advisory he wrote which allows defeating of a WordPress antispam plugin named, "Peter’s Math AntiSpam spinoff".

I think this is one of the first practical audio captcha hacks I’ve seen. Very cool actually, nice one Jose.

Now, back to the details…

Here’s another spin-off of Peter’s Custom Anti-Spam Image for WordPress that will generate math anti-spam equations as images instead of custom anti-spam images….

The goal of this spin-off plugin is to further fool spambots somewhat by combining the “make them answer a math equation” and “make them read an image” ideas. This plugin aims to keep the readability of the Custom Anti-Spam version, as well as other features like random fonts and colours.

Jose’s research demonstrates practical Pseudo code to attack this plugin. I’m not going to try summarise, just read the paper. In short, spammers are going to have a BBQ with your blog.

Solution? Use an alternate AntiSpam plugin like Akismet or BlogSec’s SpamBam.
- Jose’s full advisory is available here.
- Jochem van der Vorm released a paper last year on defeating Voice/Audio Captchas. More details here.
WP Directory Traversal Vulnerabilities

Posted: January 3rd, 2008, 4:09am CST by DK

Tags: Advisories [edit]

Mustlive has found a number of directory traversal vulnerabilities in WP 2.0.11 (Latest 2.0 branch). BlogSec have confirmed this in WordPress 2.3.1. WP 2.3.2 is not vulnerable.

Please note, this only affects WordPress running on MS Windows.

A directory traversal attack, means an attacker can potentially edit and view files outside of its ‘allowed’ area. Depending on how the web server has been configured, this may allow an authenticated user to view sensitive files such as wp-config, password files etc.

The problem lies in the following function:

function validate_file(..)
if (false !== strpos($file, ‘./’))

This works fine for Linux, however, MS Windows operating-systems supports backslash (.). This means we can bypass the above check (’./’) by using (’.’).

Proof of concept:
http://site/wp-admin/index.php?page=.....htaccess

This is fixed in WP 2.3.2 (latest version checks for ‘..’ and ‘./’).
WordPress PictPress File Include Vulnerability

Posted: December 19th, 2007, 10:48am CST by DK

Tags: Advisories [edit]

An exploit has been made publicly available affecting Wordpress PictPress
This is a remote file include vulnerability. This means an attacker requires no authentication or action from the blog administrator in order to compromise or gain full access to the blog.

This is a CRITICAL risk issue. It is recommended that you disable this plugin if in use, until a fix has been provided by the plugin developer.

Credits to Gold_M for discovering this vulnerability.
WP-ContactForm HTML Injection Vulnerability

Posted: December 19th, 2007, 10:35am CST by DK

Tags: Advisories [edit]

The popular WP-ContactForm plugin has been found vulnerable to HTML Injection.

This could allow an attacker to compromise your blog if you are authenticated to your blog while at the same time visiting a page with the embedded attack. Another popular attack is using phishing type e-mails.

BlogSec is not aware of any fixes as yet. We will update this post when more information is available to us.

Credit to Mustlive for discovering and publishing the vulnerability.

Check BlogSec’s double agent post

for HTML Injection mitigation ideas.
Wordpress 2.3.1 Charset SQL Injection Vulnerability

Posted: December 11th, 2007, 7:23am CST by DK

Tags: Advisories [edit]
Abel Cheung has discovered yet another vulnerability in WordPress.

It is found that the search function provided within WordPress fails to
sanitize input based on different character sets. So if WordPress tries
to query MySQL database using certain specific character sets, WordPress
search function is exploitable using charset-based SQL injection.

Currently known character sets exploitable include Big5 and GBK (see your wp-config.php, as this will mainly affect Chinese blogs). All of them may use backslash (’') as part of multibyte character. WordPress with MySQL database created any other character sets fulfilling such property may also be exploitable.

Workaround: This vulnerability only exists for database queries performed
using certain character sets. For databases created in most other
character sets no remedy is needed.
- a. It is recommended to convert WordPress database to use character sets not vulnerable to such SQL exploit. One such charset is UTF-8, which does not use backslash (’') as part of character and it supports various languages.
- b. Alternatively, edit WordPress theme to remove search capability.
The full advisory is available here.

Thanks to Abel for keeping us in the loop, and great find.
WordPress 2.3.1 SQL Injection Vulnerability

Posted: December 10th, 2007, 9:31am CST by DK

Tags: Advisories [edit]

Update: 10/12/07 This vulnerability has been downgraded to an information disclosure vulnerability ONLY as no proof of concept exploit has been possible. This is contrary to the original advisory. More info here.

A new SQL Injection vulnerability may have been discovered in WordPress 2.3.1. This is a critical security risk that may allow an attacker to remotely compromise your blog.

Test your blog (proof of concept):
POC = http://localhost/path_to_wordpress/?feed=rss2&p=1

Currently, the BlogSec team are unaware of a patch. Please keep an eye on this post for updates.

The original advisory can be found here.

Beenu Arora has been credited for finding the vulnerability.

Thanks to Mustlive for bringing it to our attention.

hackademix.net

Pornowned! (3ivx MP4 Codec Stack Overflow)

Posted: December 9th, 2007, 1:40am CST by Giorgio

Tags: Advisories [edit]
The 3ivx high performance MPEG-4 audio/video codec (MP4) for Microsoft Windows is vulnerable to stack overflow, with shellcode proof of concept published by SYS 49152 (a C64 nostalgic like me, undoubtedly).
Surely affected versions are 4.5.1, quite widespread, and the latest 5.0.1.

The most likely exploitation scenario involves user downloading a movie clip in MP4 format from an untrusted source (did you say p0rn?) and consuming it through a media player which relies on the 3ivx codec (the PoC above exploits Media Player Classic, for instance).
Notice that the file name extension doesn’t need to be “.mp4″, as mp4 streams can be wrapped inside container formats such as ASF or AVI.
Of course, if the vulnerable media player installed also its own browser plugin, you can be owned instantly just stumbling upon an untrusted web page, unless you already took proper countermeasures.
How to protect yourself
1. Open your Windows Control Panel.
2. Select Add or Remove Programs.
3. Locate the 3ivx D4 entry, select it and click the Remove button.
4. Optionally, if you couldn’t locate any 3ivx D4 item, check if you’ve got 3ivx.dll and/or 3ivxVfWCode.dll in your %WinDir%System32 folder; if you can find these files, delete or rename them.
If you still need to play MP4 files and you find your system can’t do it anymore, you may want to install the excellent open source VLC Media Player, which uses a different codec.

Slop… er… happy surfing ;)

My Security Planet » Tags » Advisories

Feeds

42 items tagged "Advisories"

Posted: July 1st, 2009, 8:33am CDT by DK

Tags: Advisories [edit]

Posted: July 1st, 2009, 8:26am CDT by DK

Tags: Advisories [edit]

Posted: May 20th, 2009, 10:21am CDT by Giorgio

Tags: Advisories [edit]

Posted: March 27th, 2009, 3:51pm CDT by Giorgio

Tags: Advisories [edit]

Posted: March 26th, 2009, 3:45pm CDT by Giorgio

Tags: Advisories [edit]

Posted: March 19th, 2009, 3:32am CDT by DK

Tags: Advisories [edit]

Posted: January 26th, 2009, 6:14pm CST by DK

Tags: Advisories [edit]

Posted: January 8th, 2009, 8:35am CST by DK

Tags: Advisories [edit]

Posted: December 13th, 2008, 4:26pm CST by Giorgio

Tags: Advisories [edit]

Posted: December 12th, 2008, 10:09am CST by Giorgio

Tags: Advisories [edit]

Posted: November 1st, 2008, 10:56am CDT by DK

Tags: Advisories [edit]

Posted: November 1st, 2008, 10:50am CDT by Philipp

Tags: Advisories [edit]

Posted: November 1st, 2008, 10:47am CDT by Philipp

Tags: Advisories [edit]

Posted: October 2nd, 2008, 3:46pm CDT by Philipp

Tags: Advisories [edit]

Posted: September 11th, 2008, 5:08am CDT by DK

Tags: Advisories [edit]

Posted: August 13th, 2008, 10:03am CDT by DK

Tags: Advisories [edit]

Posted: August 7th, 2008, 4:21pm CDT by DK

Tags: Advisories [edit]

Posted: June 18th, 2008, 4:01am CDT by Philipp

Tags: Advisories [edit]

Posted: May 31st, 2008, 3:31pm CDT by Philipp

Tags: Advisories [edit]

Posted: May 31st, 2008, 3:26pm CDT by Philipp

Tags: Advisories [edit]

Posted: May 31st, 2008, 3:18pm CDT by Philipp

Tags: Advisories [edit]

Posted: May 28th, 2008, 3:33am CDT by Giorgio

Tags: Advisories [edit]

Posted: April 28th, 2008, 3:30am CDT by Philipp

Tags: Advisories [edit]

Posted: April 27th, 2008, 2:12pm CDT by DK

Tags: Advisories [edit]

Posted: April 16th, 2008, 4:20am CDT by DK

Tags: Advisories [edit]

Posted: March 9th, 2008, 3:21pm CDT by Philipp

Tags: Advisories [edit]

Posted: February 27th, 2008, 11:18am CST by Philipp

Tags: Advisories [edit]

Posted: February 13th, 2008, 6:07am CST by DK

Tags: Advisories [edit]

Posted: February 7th, 2008, 3:52am CST by Philipp

Tags: Advisories [edit]

Posted: February 5th, 2008, 3:39am CST by Philipp

Tags: Advisories [edit]

Posted: February 1st, 2008, 3:27am CST by Philipp

Tags: Advisories [edit]

Posted: February 1st, 2008, 3:21am CST by DK

Tags: Advisories [edit]

Posted: January 22nd, 2008, 2:23pm CST by Philipp

Tags: Advisories [edit]

Posted: January 16th, 2008, 5:07pm CST by DK

Tags: Advisories [edit]

Posted: January 16th, 2008, 6:24am CST by DK

Tags: Advisories [edit]

Posted: January 11th, 2008, 8:24am CST by DK

Tags: Advisories [edit]

Posted: January 3rd, 2008, 4:09am CST by DK

Tags: Advisories [edit]

Posted: December 19th, 2007, 10:48am CST by DK

Tags: Advisories [edit]

Posted: December 19th, 2007, 10:35am CST by DK