Full Disclosure mailing list archives
Re: TWSL2012-002: Multiple Vulnerabilities in WordPress
From: Henri Salo <henri () nerv fi>
Date: Wed, 25 Jan 2012 17:22:39 +0200
On Wed, Jan 25, 2012 at 08:43:34AM -0600, Trustwave Advisories wrote:
The vendor was notified. They have chosen not to fix the issue at this time. The Vendor Response section has the details: Vendor Response: Due to the fact that the component in question is an installation script, the vendor has stated that the attack surface is too small to warrant a fix: "We give priority to a better user experience at the install process. It is unlikely a user would go to the trouble of installing a copy of WordPress and then not finishing the setup process more-or-less immediately. The window of opportunity for exploiting such a vulnerability is very small." However, Trustwave SpiderLabs urges caution in situations where the WordPress installation script is provided as part of a default image. This is often done as a convenience on hosting providers, even in cases where the client does not use the software. It is a best practice to ensure that no installation scripts are exposed to outsiders, and these vulnerabilities reinforce the importance of this step.
There is A LOT of these open installation pages in the Internet. It is not uncommon to leave those open by accident. Some people also do this, because they just don't understand the risks. I am wondering if WordPress would apply patch if we create one as a collaborative effort. I would be more than happy to help creating a patch for this if this is the case. - Henri Salo _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- TWSL2012-002: Multiple Vulnerabilities in WordPress Trustwave Advisories (Jan 24)
- Re: TWSL2012-002: Multiple Vulnerabilities in WordPress Henri Salo (Jan 24)
- Re: TWSL2012-002: Multiple Vulnerabilities in WordPress Trustwave Advisories (Jan 25)
- Re: TWSL2012-002: Multiple Vulnerabilities in WordPress Henri Salo (Jan 25)
- Re: TWSL2012-002: Multiple Vulnerabilities in WordPress Tim Brown (Jan 25)
- Re: TWSL2012-002: Multiple Vulnerabilities in WordPress Benji (Jan 25)
- Re: TWSL2012-002: Multiple Vulnerabilities in WordPress Julius Kivimäki (Jan 25)
- Re: TWSL2012-002: Multiple Vulnerabilities in WordPress Benji (Jan 25)
- Re: TWSL2012-002: Multiple Vulnerabilities in WordPress Henri Salo (Jan 26)
- Re: TWSL2012-002: Multiple Vulnerabilities in WordPress Trustwave Advisories (Jan 25)
- Re: TWSL2012-002: Multiple Vulnerabilities in WordPress Henri Salo (Jan 24)