wp 2.1.1 backdoor

[japan]

http://wordpress.org/development/2007/03/upgrade-212/

[Ilija Studen]

Za one koji ne bi da čitaju ceo članak:

This morning we received a note to our security mailing address about unusual and highly exploitable code in WordPress. The issue was investigated, and it appeared that the 2.1.1 download had been modified from its original code. We took the website down immediately to investigate what happened.

It was determined that a cracker had gained user-level access to one of the servers that powers wordpress.org, and had used that access to modify the download file. We have locked down that server for further forensics, but at this time it appears that the 2.1.1 download was the only thing touched by the attack. They modified two files in WP to include code that would allow for remote PHP execution.

To je cena popularnosti i jedna od stvari za koju se samo moliš da se ne desi. Čini mi se da prilično fino vladaju situacijom, ali videćemo kako će "veći" mediji dočekati ovo.

[misk0]

Hoce reci, ako bas nisi juche skinuo WP i instalirao ga, nema da brines

[ivanhoe]

ma da, vise me brine ako im je uzeo server sto je onda mozda uspeo da uzme jos nesto, tipa passworde (ili bar mailove) sa wordpress.com bloga koji ima brdo korisnika..

[[nq]]

Off Topic:

Originalno napisao misk0

Hoce reci, ako bas nisi juche skinuo WP i instalirao ga, nema da brines

Kao ja npr.