WordPress 2.6.2 released for security reasons
Free blog software WordPress notifies of a security update in its 2.6.2 version.
The WordPress security breaches were discoverd by Stefan Esser. They are based partly on SQL column truncation and partly on the weakness of the mt_rand() function. These breaches are especially noticeable if open registration is allowed on the blog. An immediate WordPress upgrade is recommended for such blogs.
As the developers make clear in their announcement, it is possible in WordPress to reset another user's password. Taken alone this may be a mere annoyance to users, but combined with the weakness of the mt_rand() function there is a risk that the randomly generated password can be predicted. The discoverer of this security breach will release details soon. Possible other PHP applications are susceptible, according to the WordPress Blog. The project recommends a patch, but certainly an upgrade to 2.6.2 in case open user registration is enabled. The upgrade also includes a number of bug fixes.
Issue 163/2014
Buy this issue as a PDF
Digital Issue: Price $9.99
(incl. VAT)
Tag Cloud
News
-
An Even Smaller Raspberry Pi
The Raspberry Pi Foundation has announced an even smaller version of the tiny computer that will fit into a DIMM slot.
-
Newly Discovered Android Vulnerability Causes Privilege Escalation
A new class of problems lets a malicious app pre-configure an invisible privilege update.
-
Facebook Rolls Out New PHP-like Programming Language
New Hack language adds static typing and other conveniences.
-
Fedora Announces Innovative Crytography Policy System
New crypto policy system will offer easier configuration and more uniform security.
-
Shuttleworth Calls for Declarative Firmware
Ubuntu founder denounces insecurity in proprietary, close-source software blobs.
-
New TLS Attack Takes the S out of HTTPS
Vulnerability affects many Linux web servers
-
Munich Adopts Kolab
The Bavarian capital shuns Microsoft, Google, and other alternatives to implement an open source groupware solution.
-
Canonical Announces Ubuntu Smartphones
Phone vendor partnerships bring Mark Shuttleworth's dream of Ubuntu on a phone a step closer to reality.
-
Piviti Seeks Funding
Donors will get to vote on new features for the free video editor.
-
Debian Tech Committee Votes for systemd
Debian project puts init out to pasture and says no to Ubuntu's Upstart.