Zero Day Vulnerability in many WordPress Themes
 

If you are using a theme that re-sizes images then you are mostly likely using a version of TimThumb.php.

There is a fix....

URL: http://markmaunder.com/2011/zero-day...dpress-themes/
================
Update: Ben, the developer of timthumb has been in contact and is working on a fix. His own site was hacked Friday using the same method. I?ve submitted a tiny patch and if you?re a solid PHP hacker it?d be great if you could eyeball the code with us and submit a patch (really easy to do on Google code) if you spot any other opportunities for cleanup (there are many). Given enough eyeballs? you know the quote.

The Exec summary: An image resizing utility called timthumb.php is widely used by many WordPress themes. Google shows over 39 million results for the script name. If your WordPress theme is bundled with an unmodified timthumb.php as many commercial and free themes are, then you should immediately either remove it or edit it and set the $allowedSites array to be empty. The utility only does a partial match on hostnames allowing hackers to upload and execute arbitrary PHP code in your timthumb cache directory. I haven?t audited the rest of the code, so this may or may not fix all vulnerabilities. Also recursively grep your WordPress directory and subdirs for the base64_decode function and look out for long encoded strings to check if you?ve been compromised..............
http://markmaunder.com/2011/zero-day...dpress-themes/

Bump fixed mine up, thanks

i dont use it

Thanks for this.

Thanks for the heads up, man. :-)

Thanks, had it on a couple blogs.

A lot of Themeforest authors rely on TimThumb heavily instead of using WP built-in functions. Definitely check your themforest themes for timthumb.php

Fuck...

Everybody pretty much uses this script or modify it a bit.

Well, at least I now know how to exploit a WordPress site using TimThumb

Discussion on Google Code seems to be ongoing about whether the fix is good enough or not.
http://code.google.com/p/timthumb/issues/detail?id=212

when the day wil come, when wp wont need updates....?

It's important to note that this is not WordPress. It's something separate that several theme authors and plugin authors have used to make the creation of images of various sizes easier.

when you have something that is 4 or 5 years ahead of the standard you may find that things may need correction here and there. The good news is that they are actually corrected. Think about this: is absolutely impossible for any program, piece of software, code snippet, whatever to be as advanced as a collaborative environment with tens of thousands programmers behind it

this.


either way, personally, I couldn't care less, I don't use timthumbs since like 4 years ago. It was nice and OK if you didn't mind the look of your site, but it gets very random results. WP built in image features might not be as complete, but they're 100 times better :2 cents:

Dumb question here... but is there a quick way to search my WP installs for this file? I know it's not one I have installed as a plugin but as said many themes and plugins use it that I may not be aware of.

Look in the /wp-content/themes/"theme folder you are using*/timthumb.php or thumb.php

It should be listed in the admin under the editor, where you edit all the theme files including CSS. It's usually listed near the bottom and the 'allowedsites' array will be pretty close to the top of the file. *not all themes that use it will have it listed here but odds are that it is.

find ./ -name timthumb.php

find would be better, locate only works if the locate db is up to date.

luckily, i dont have timthumb.php on my server.

No luck about it Cool Dude. It's called skill!

damn, just noticed , the theme i am working on for current project is using older version of timthumb, so 1st i upgraded that file to
http://code.google.com/p/timthumb/so...k/timthumb.php

and then secured it by

http://markmaunder.com/2011/zero-day...dpress-themes/


thanks guys....

plus thats freebsd isnt it?

No, a LINUX ...

i have dozens that may use timthumb :helpme not going to be a fun weekend :mad: