The Lair

Do not meddle in the affairs of dragons, for you are crunchy and taste good with ketchup

wordpress 2.1.1 exploitable in the worst way

March 3rd, 2007

Dev blog announcement. Essentially, someone got into the Wordpress install hosted on the servers and made some modifications to a couple of files. Malicious changes at that. The information in the blog post seems to indicate that feed.php and theme.php (both in wp-includes) were modified. Perhaps other files were as well. The changes seem to have been made fairly recently (3-4 days ago?) but best not to take any chances.

So umm. Please go download the latest release (2.1.2) if you are running 2.1.1 – don’t mess around waiting with this one, just go do it now. Upgrade, make sure all the files are overwritten by the latest release.

I also took the liberty of mailing a few people who are running potentially exploitable versions of Wordpress – drop me a reply if you need a hand upgrading or need a few custom access rules to prevent malicious access in the meantime.

And yeah, stuff like this can happen from time to time. It can happen to anyone and to any project. I’m not particularly happy with how long it took before the malicious mod was discovered but better late than never applies, I suppose. Oh and a few hours of combing through logs for a couple of blogs await – I need to see if some nasty cracker exploited the wide open installs on this domain before I had a chance to make the upgrade. Le sigh.

SK2-WP2Compatibility

November 29th, 2005

Well, it’s hardly a secret that Wordpress 2.0 is drawing ever closer to release … But because there are lots and lots (and I mean literally hundreds) of changes across the board, it’s hardly surprising that plugin compatibility is a big issue.

In the big list of compatible plugins, Spam Karma features as well. It stops spam, regardless of your version of Wordpress.

But there’s a problem. Because one of the internal changes to Wordpress’ database tables introduced the comment_count field. And Wordpress 2.0 displays the number of comments against a post based on the value in this field. And Spam Karma in its current incarnation doesn’t know about no steenkin’ comment_count field.

Enter SK2-WP2Compatibility.

SK2-WP2Compatibility (yes, I tried hard to think of a fun name, honest!) is a plugin for Spam Karma 2. Anyone may download and use it; however, it only has any effect if you run it in a Wordpress 2.0 installation. Beta-1 is fine. Beta-2 is fine. RC1 is good too. Even bleeding edge SVN updated Wordpress 2.0 is fine.

It doesn’t kill any spam. It doesn’t make Spam Karma any better than it already is at killing spam. It doesn’t make you breakfast in bed. It doesn’t drag your lazy ass to work. Nope. None of those. It just tries to make sure that the poor comment_count field in your shiny Wordpress installation gets an appropriate amount of lurve. And updating. Don’t forget the updating.

So, if you’ve been plagued by a swarm of incorrect comment counts and you’ve identified Spam Karma as the culprit, maybe you should give this plugin a shot.

Simply download and copy to your SK2/sk2_plugins directory. If the plugin (SK2 plugin, not Wordpress plugin) detects that you are running Wordpress 2.0; it will run an extra update each time someone posts a comment. If you’re still running Wordpress 1.5.2, nothing happens.

Requirements: You must have Spam Karma 2 installed. If you have Spam Karma 2.1 beta 4 or later, you do not need this plugin. Simply upgrade to the latest Spam Karma and you get comment counts updated for free. No plugin required.

Current version: 1.0. Just download, unzip, read the included readme file and move the .php file to the appropriate location and you’re done.

Problems ? comments ? suggestions ? *gasp* bug reports ? Please leave a comment here or mail me directly at lair AT fierydragon dot org. Please make sure, however, that the title of your email includes the phrase sk2_wp2compatibility lest my overzealous spam killing bin your mail. I’m also available in the #wordpress IRC channel on freenode; with the innocuous nickname of tinster.

Update 3rd Jan 2005: The most recent beta of Spam Karma 2.1 fixes the comment count problem without needing this plugin. Please download SK 2.1 beta from this location. Simply delete sk2_wp2compatibility.php from your sk2_plugins directory to uninstall.

.

Update 10th Jan 2005: Spam Karma 2.1 final is out. The latest release of SK is fully compatible with Wordpress 2.0. Basically, if you upgrade to SK 2.1 (and you should!) then you no longer need this plugin. Delete the php file to uninstall.