WordPress 2.5 Secret_Key Vulnerability
José Carlos Nieto Jarquín has found a vulnerability affecting WordPress 2.5 ONLY. His advisory was released on SecurityFocus yesterday.
Our recent "Secure WordPress Whitepaper Revision" shows the new WordPress SECRET_KEY variable in the ‘wp-config.php’ file. This SECRET_KEY must be set to something random, as specified in the WordPress documentation. If not, it may be possible for an attacker to brute force the default WordPress SALT generation process to gain access to your blog.
The vulnerability has been reported as a Medium risk as it only affects WordPress installations matching a certain criteria. See advisory for more details.
A proof of concept exploit is publicly available. Please ensure that you set your SECRET_KEY in your ‘wp-config.php’ file to something random.
From wp-config.php:
Change SECRET_KEY to a unique phrase. You won't have to remember
it later, so make it long and complicated. You can visit
https://www.grc.com/passwords.htm to get a phrase generated for you,
or just make something up.
define('SECRET_KEY', 'put your unique phrase here');
Random Posts
If you enjoyed this post, please leave a comment or subscribe to the feed and get future articles delivered to your feed reader.
Comments
[...] Este fallo ha sido anunciado en securityfocus con los detalles suficientes para poder comprobar que la amenaza es real, además de contrastado por Blogsecurity.net. [...]
[...] Il problema riguarda solo la versione 2.5 ed è stato scoperto dal blogger messicano José Carlos Anieto; la falla è stata annunciata anche su SecurityFocus con tutti i dettagli e su BlogSecurity. [...]
I had exactly the same thoughts as Malte above. Generate a long random salt value during installation or upgrade. There is no need for the user to be able to change this value.
[...] announced a security vulnerability about WordPress 2.5, posted on SecurityFocus, read the article: WordPress 2.5 Secret_Key Vulnerability. This security pitfall only involves a few WordPress configurations, but if you’re in those [...]
[...] vulnerabilità di WordPress 2.5, scoperta e riportata su SecurityFocus, leggete l’articolo WordPress 2.5 Secret_Key Vulnerability. Questa falla riguarda solo alcune installazioni di WordPress per motivi che vengono spiegati [...]
[...] has also a link for the Secret Key vulnerability in WordPress 2.5 which gives you a random string for your SECRET_KEY entry in [...]
[...] note this vulnerability is different to http://blogsecurity.net/wordpress/wordpress-25-secret_key-vulnerability/ Enjoy the article? Please take a second to: Digg it! | StumbleUpon it! [...]
WP 2.5.1: Secure Cookies in Wordpress with SECRET_KEY parameter in config settings…
José Carlos Nieto Jarquín reported a vulnerability WP 2.5:
He published an advisory on SecurityFocus on 15 Apr 2008 regarding insecurity regarding the default SECRET_KEY configuration value. You could gain access to any account if you know the defaul…
[...] you can’t just simply add anything , BlogSecurity remind you that it need to something totally random. What you can do is make use of secret key generator by the wordpress team, it will generate a [...]
WP 2.5 Sicherheitslücke…
WordPress 2.5 verwendet in der neuen config.php (im WordPress Stammverzeichnis) einen Schlüssel, der individuell geändert werden sollte, um mögliche Brute Force-Attacken auf diesen wahrscheinlich vielfach vorhandenen Key zu vermeiden. Dazu muß eine…