New SQL Injection vulnerability?
-
Gentoo is reporting that all WordPress versions < 2 are vulnerable if comments are enabled. Yet I’m not finding a warning prominent on ww.wp.xz.cn or instructions on how to patch 1.5.x versions to fix this. What’s up with it?
(See http://www.gentoo.org/security/en/glsa/glsa-200603-01.xml)
-
lhk – go for it.
well.. If you compare some files, the changes are evident. Theres some pre_comment filtering done in 2.0’s wp-comment.php thats not done in 1.5.2’s.
For those of us that are defiant, im confident it could be done with some editing.
Ironically, heres one change from 1.5.2 to 2.0 that I missed all together (ive done a fair amount of comparing too)
its “fixed” in the current download and the change to your 1.5.2 file breaks nothing. Thats a whole nother issue but still…
——–
For now, I’m good, I moderate, and unfortunately the rest of my day is pretty much spent (and then I work), I will be looking at this over the next day or so. Again, though, Im defiant.
podz – do I read sarcasm there? *still scratching – as I haven’t done more than upgrade 1.5.1 to 1.5.2 so far*
LHK
off topic, but here are two apps that are must have if you use windows >
windows grep: http://www.wingrep.com
beyond compare: http://www.scootersoftware.com
bc allows you to to do side-by-side comparisons of files, similar to diff, just with a gui.they are absolutely invaluable.
Ooo. Yes, grep is great but I never ran across bc before! Thanks….
This question is a little off topic, but somewhat related. I see these .diff files all the time, is there some magical programme that updates the files using the .diff ones or something? I can’t seem to understand what the diff is with .diff.
If you a link to an explanation about it or if such a programme exists, to that, that would be fantastic!
Thank you π
π http://en.wikipedia.org/wiki/Diff
Long story short, .diff files show the difference between what it was and what it is. Coders usually use ’em for submitting source code modifications.
Bah, of course I couldn’t possibly think of wikipedia! Thanks! *himbo day 2 for me I think*
But is there a ‘patch’ like programme for windows, one that will patch the file like the patch command in *nix?
I have WinMerge, does that do the patch trick?
So Im taking my shower, and I think, self, why are we even checking the user-agent with a comment submission? Self answered: askimet?
My guess would be that the u-a is checked IF youre using askimet. However, for those that are not using askimet, a simple fix for JUST THAT ISSUE would seem to be to removing the user-agent references all together, starting about here in comment-functions.php
function check_comment($author, $email, $url, $comment, $user_ip, $user_agent, $comment_type) { ....
(more below that)If you look at that function, I was right. its there for spam checking.
Anyway, that would satisfy that issue if you werent using askimet, and maybe even if you were. God knows what askimet does with blank u-a’s
That said, if you look at that function, theres prolly room for other things there to be trouble as well. 2.0.*’s equivalent file contains a good deal more checking.
Niziol – I have WinMerge, does that do the patch trick?
Been a bit since i used it last, but I’m pretty sure it can work with .diff files, yes.
Is akismet usable with 1.5.2?
I dont know, never tried π
Thats clearly for spam checking purposes, the inclusion of the u-a. Its checked in functions-post.php in a similar fashion,
function wp_blacklist_check($author, $email, $url, $comment, $user_ip, $user_agent) { ...—
I’m off, I absolutely HAVE to go to bank before work!
Me either…. *sigh* I suppose I can grab the number and try it. I don’t want to.
So there’s a LOT of places the u-a checking would have to be whacked then, right?
Akismet can run on 1.5.2 — or at least I was able to run it when I was testing it on 1.5.2. I’ve since upgraded the site that I use Akismet on though, and I can’t remember if I did that before the the Akismet final release or before…. urg. Sorry, that’s not terribly helpful.
The only site I have to keep 1.5.2 on is one where all comments are moderated anyway… so I think I’m ok. (It’s one that I hacked to absolute pieces to do something other than blog, and I *really* don’t want to have to upgrade.)
If anyone knows any different … please say so. π
Isn’t the code whooami posted above for checking the comments against the list of blacklisted words that you can set in the options?
HandySolo: Thanks! π
The topic ‘New SQL Injection vulnerability?’ is closed to new replies.