Slashdot Mirror
WordPress Exploit Allows Admin Password Reset
Multiple readers have sent word of a vulnerability in WordPress 2.8.3 which allows anyone to lock an admin out of his or her account by resetting the password. "The bug ... is trivial to exploit remotely using nothing more than a web browser and a specially manipulated link. Typically, requests to reset a password are handled using a registered email address. Using the special URL, the old password is removed and a new one generated in its place with no confirmation required." An alert on the Full Disclosure mailing list detailed the vulnerability, and WordPress quickly rolled out version 2.8.4 to address the issue.
For those who don't RTFA, this doesn't give the attacker access to the new, reset, password. That requires access to the admin's mailbox as well. So the link saying "lock an admin out" is a bit, well, not completely true. It could be true if his/her inbox is hacked, but not otherwise.
Beware: In C++, your friends can see your privates!
Is that not a bit soon? Especially with wordpress - it's going to be ages before many people update, and it's not a critical problem.
This is not about root passwords. This is an admin password to a blog system or CMS.
You're going to need admin accounts as long as you want to have different classes of users and have certain users manage some stuff.
so what do you do when you want to install an update? :_)
[ irc.p2p-network.net -> #zomgwtfbbq ][ http://zomgwtfbbq.info ]
Don't be silly. Setup a root account, setup sudo permissions, and then use the sudo authority when you need to do something instead of su or logging into root. You can still have your root, just don't use it unless you absolutely have to, and when you do access it via the terminal from a non-root user.
"Sorrow is better than laughter, for by sadness of face the heart is made glad." [Ecclesiastes 7:3]
That's funny, my copy of Wordpress is not vulnerable to this issue. Oh wait, I tweaked things so that all of the logins and the like go over a separate, password-protected SSL connection. https://DOMAIN_NAME.TLD/wp-login.php?action=rp&key[]= just won't work :) Obviously this won't work if you let arbitrary users login to your wordpress account.
I was tired of constantly having security issues and having to upgrade. Isn't there less feature-filled blog app out there that's all lightweight and whatnot?
Thanks for the notice. I just logged in and upgraded mine. Now to do the other sites later tonight.
please hide all the elements if the AJAX reply is "Moderated 'Interesting.' 0 points left."
Thank you.
Love,
Your #1 fan.
PS: In "preview," blank lines don't show up between the paragraphs if I'm using 3*CRLF or the
elemenet.
Love,
Your #1 fan.
Disabling the ability to login as root/administrator does not remove the account from the machine.
The kernel on a *nix machine still runs at the same privilege level, along with a bunch of system daemons.
Same with Windows. You can't log in as Administrator on an XP Home machine....until you boot in safe mode. But programs can still run with administrator privileges, even when the account forbids login.
In fact, completely removing the root/administrator account on a machine would probably render it non-bootable, or at least very screwed up.
Keep in mind, you need root/admin privileges to bring up network interfaces, directly access hardware for sound, video, or other output, and a bunch of other stuff. So with no root privs on the machine at all, you can't get sound, networking, or video, unless you assign regular users to be able to access those hardware interfaces, at which point you've just replaced the root account with a differently named root account, which you run all the time, thereby lowering your security, instead of improving it.
"City hall" in German is "Rathaus" Kinda explains a few things......
so what do you do when you want to install an update? :_)
"return the system to a known state" :-)
My question is, how does he do backups, if no account has permission to access those system files that only root can access? /", and added himself to every group on the machine? /"?
Or has he done a "chmod g+rw -R
Or maybe "chmod a+wrx -R
"City hall" in German is "Rathaus" Kinda explains a few things......
If Code is Poetry then Wordpress is some 15 year old's notebook scribblings on angst, Twilight and Dashboard Confessional.
If you're looking for alternatives that don't have gaping security issues with seemingly every release, check out Serendipity.
*opens dashboard, presses "Upgrade to 2.8.4" button*
Fixed. :D
The kernel on a *nix machine still runs at the same privilege level, along with a bunch of system daemons.
No it doesn't. The kernel runs in ring 0 with no user account. When making a system call into the kernel, a classical *NIX machine will check whether the call is made by UID 0 (root) but the kernel itself is not running as the root user. On a more modern system, there are privilege elevation mechanisms that allow the kernel to perform privileged operations on behalf of other users, so you don't need the root user at all.
I am TheRaven on Soylent News
I'm not a PHP expert, but why does this work?
$key = preg_replace('/[^a-z0-9]/i', '', $key);
if ( empty( $key ) )
return new WP_Error('invalid_key', __('Invalid key'));
$user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE
user_activation_key = %s", $key));
if ( empty( $user ) )
return new WP_Error('invalid_key', __('Invalid key'));
Is it because the $key is an array and that somehow makes the $user get a value?
I didn't say the kernel ran as root. I said it runs at the same privilege level. Meaning, removing the root account will still leave any root exploit in the kernel just as open as it was before.
"City hall" in German is "Rathaus" Kinda explains a few things......
for the password reset. You enter the Admin's user ID and click on a "Forgot password" button or link and it emails a new password to the email the Admin uses.
Some software like Scoop has it and the new password is only good for a few days or so, in case the user or admin didn't request a new password and it allows the old password to work until the new password is used. Only the new password is emailed to the email address on file.
Now if it showed the new password on the web page, that would be locking out the admin from their account as the exploiter can log in as the admin and then change the email the password is reset back to and lock the admin out. But in this scenario the admin gets an email with a new password and if he or she reads the email, they can log back in. They aren't locked out if they read the email that has the new password.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
I run a site on Wordpress and managing the software updates has never been a big deal for me. I have shell access at my hosting provider, so I initially just installed Wordpress using CVS. Every time they rolled out a new bugfix, I just ran a little shell script like: "update "
With recent versions of Wordpress, though, you don't even need to do that. When a new update is available, an alert appears on your admin dashboard. From there, you can actually click a button and have the system download the update and install it automatically. I know it can be a pain when to backup your database etc., but in all honesty, for minor point bugfix updates all that is seldom if ever necessary (especially if you're diligent with backups in the first place).
Breakfast served all day!
The kernel does not run at the same privilege level as root. Root is a user which the kernel allows to access (some) privileged services. Root programs run in ring 3 (on x86, unprivileged mode on other platforms), while the kernel runs in ring 0 (or privileged mode on non-x86 platforms). The kernel can access physical hardware directly. The root user can not, they can only request that the kernel access it on their behalf. On some UNIX systems there is a device node which allows a sufficiently-privileged user to map arbitrary memory pages, however this is not something that root can do without the kernel exposing this device and without the kernel deciding which userspace processes are allowed to do so. A program running as root can not, for example, write to a device or alter the page tables without the kernel mediating this.
A privilege escalation vulnerability in the kernel may or may not be related to the root user. Often they are not, for example the recent SCTP vulnerability in Linux permitted arbitrary code to be run in kernel space, meaning that the root user was completely irrelevant. Other privilege escalation vulnerabilities only allow you to run your code as if it were run by root, in which case systems like SELinux or system immutable flags in the filesystem may still prevent you from doing things you want to.
I am TheRaven on Soylent News
It seems that most PHP apps have this problem because they encourage a "macro script" mentality.
Perl FTW.
Futurist Traditionalism
It appears that PHP, upon seeing an incoming parameter with a name that ends in [something] (where something may be empty), automatically turns that variable into an array.
How many of you PHP developers out there knew that? I didn't. And I had to dig quite a bit to find a reference to this behaviour in the docs.
So, incoming stuff from the URL or the POST data are no longer strings all the time. Can they magically become other things than strings and arrays as well? Maybe not now, but what if some PHP developer thinks up another "nifty" feature _after_ I read the docs; how then am I supposed to protect my application in the future? Do I need to re-read the docs every time I upgrade PHP?
And is there a way to turn this "we know better than you what you need"-behaviour off?
I'm sick of seing framework developers add "nifty" features that you have to know about in order to write secure code. It's not only PHP, but also several highly popular Java frameworks that I work with these days. Some of them make it quite easy to write to object fields that are normally out of reach of the input fields in a form.
I want a framework that makes it impossible to make mistakes, and where you have to _enable_ potentially dangerous features when you _know_ you need them, rather than _disable_ potentially dangerous features most people don't know about (or use).
I wonder why somebody would code that part the way they did it. As far as I understand it, they are trying to validate code by blacklisting instead of whitelisting:
(from http://core.trac.wordpress.org/changeset/11798)
$key = preg_replace('/[^a-z0-9]/i', '', $key);
if ( empty( $key ) )
die();
If you expect a hash you generated yourself, why don't you test if it preg_matches the spec you used to generate it in the first place? (/^[a-zA-Z0-9]{20}$/ in this case)
Well that and being naive enough to expect $_GET["key"] to always return a string....
Ok....vagueness in the English language breaks conversation yet again.
When I said "The kernel runs at the same privilege level," you thought I meant the kernel ran at the same privilege level as root.
I meant the kernel runs at the same privilege level regardless of whether the root user exists or not.
Perhaps I should have continued my sentence, rather than implying that....
"City hall" in German is "Rathaus" Kinda explains a few things......
Ah, that makes sense. Rereading your original post in that context, you are completely correct - sorry.
I am TheRaven on Soylent News
The problem is php, not really wordpress. All self-managed php online software is full of security holes / constant updates. That's the life of php...
That's only because fat chicks, like you, are a turnoff. If you were a hot teen boy with a tight ass and hairless crotch, my hardon would measure at least 3 inches.
number10.gov.uk anyone? :)