Im gleichen Atmenzug wie WordPress 2.3.3 wurde heute WordPress MU 1.3.3 veröffentlicht. Dies ist ein Sicherheitsrelease und es wird empfohlen sofort die neue Version einzuspielen (natürlich mit Backup). Zu einem wurde die Sicherheitslücke aus WordPress 2.3.2 und WordPress MU 1.3.2 geschlossen, aber es wurden außerdem 3 MU-spezifische Bugs behoben.

1. The options pages were overhauled and security tightened. Alexander Concha released an exploit that allows any user with, “‘manage_options’ and ‘upload_files’ capabilities” to execute arbitrary PHP code. Here’s the exploit. I hope you’ve all upgraded.
2. The signup page authentication was missing where new user registration was turned off. A carefully crafted POST could create empty blogs. (I just want to thank the spammers who attacked my dev server with this, it helped me find the exploit, thanks guys!)
3. Alexander also discovered that file size on upload wasn’t checked all the time.

Punkt 1 beschreibt, dass es möglich war über einen Exploit die Einstellungen für einen Blog zu ändern, um z.B. mehr Speicherplatz zu gewähren. Außerdem wurde eine Lücke geschlossen (Punkt 2), die Spam-Blog-Ersteller genutzt hatten. Zu dem werden nun wirklich alle Uploads im System geprüft (Punkt 3).

• Theard im englischen Forum
• Download der Version 1.3.3

Dieser Beitrag wurde am
Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /kunden/91267_51467/webseiten/pressthis.de/wp-includes/functions.php on line 35

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /kunden/91267_51467/webseiten/pressthis.de/wp-includes/functions.php on line 107

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /kunden/91267_51467/webseiten/pressthis.de/wp-includes/functions.php on line 109

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /kunden/91267_51467/webseiten/pressthis.de/wp-includes/functions.php on line 111

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /kunden/91267_51467/webseiten/pressthis.de/wp-includes/functions.php on line 112
5. Februar 2008 um
Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /kunden/91267_51467/webseiten/pressthis.de/wp-includes/functions.php on line 35

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /kunden/91267_51467/webseiten/pressthis.de/wp-includes/functions.php on line 107

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /kunden/91267_51467/webseiten/pressthis.de/wp-includes/functions.php on line 109

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /kunden/91267_51467/webseiten/pressthis.de/wp-includes/functions.php on line 111

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /kunden/91267_51467/webseiten/pressthis.de/wp-includes/functions.php on line 112
18:35 von Dennis Morhardt in der Rubrik Release abgelegt.
Über neue Kommentare kannst du dich via
Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /kunden/91267_51467/webseiten/pressthis.de/wp-includes/link-template.php on line 113

Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /kunden/91267_51467/webseiten/pressthis.de/wp-includes/link-template.php on line 138
RSS 2.0 benachrichtigen lassen. Trackback URI