sazsaz
June 21st, 2013, 00:52
سلام عزيزان
متاسفانه باگي وحشتناك در وردپرس يافت شده كه خواهشمندم هر چه زودتر اين مورد را حل نمايند
كل وضعيت باگ با توضيحات كامل به شرح ذيل مي باشد
کد php:
On Fri, Jun 07, 2013 at 06:29:48PM +0200, Krzysztof Katowicz-Kowalewski wrote:
> Version 3.5.1 (latest) of popular blogging engine WordPress suffers
from remote denial of service vulnerability. The bug exists in
encryption module (class-phpass.php). The exploitation of this
vulnerability is possible only when at least one post is protected by a
password.
>
> Time frames:
> 31.05.2013 WordPress security team has been informed about the vulnerability (no response).
> 07.06.2013 The vulnerability has been released to the public.
>
> More information (including proof of concept):
> https://vndh.net/note:wordpress-351-denial-service
>
> A way out (before official WordPress update) to secure existing installations is to apply the following patch:
>
> --- wp-includes/class-phpass.php
> +++ wp-includes/class-phpass.php
> @@ -120,7 +120,7 @@
> return $output;
>
> $count_log2 = strpos($this->itoa64, $setting[3]);
> - if ($count_log2 < 7 || $count_log2 > 30)
> + if ($count_log2 < 7 || $count_log2 > 13)
> return $output;
>
> $count = 1 << $count_log2;
Please use CVE-2013-2173 for this issue.
---
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlG5Z+oACgkQXf6hBi6kbk9jYwCeMIThfuTWFf GOalupCsLJLIbg
KYgAoIyjMj/ikxhoeyQBUIT+Xp1LgeeH
=2I3B
-----END PGP SIGNATURE-----
براي رفع اين مشكل فايل زير را با اديتور باز كنيد
wp-includes/class-phpass.php
در سطر 123
if ($count_log2 < 7 || $count_log2 > 30)
را حذف و به جاي آن
if ($count_log2 < 7 || $count_log2 > 13)
قرار دهيد
براي آنكه مطالب بيشتري در اين زمينه كسب كنيد به باگ و رفع آن در نسخه 3.5.1 (http://wp-help.ir/showthread.php?tid=2068) مراجعه نماييد
متاسفانه باگي وحشتناك در وردپرس يافت شده كه خواهشمندم هر چه زودتر اين مورد را حل نمايند
كل وضعيت باگ با توضيحات كامل به شرح ذيل مي باشد
کد php:
On Fri, Jun 07, 2013 at 06:29:48PM +0200, Krzysztof Katowicz-Kowalewski wrote:
> Version 3.5.1 (latest) of popular blogging engine WordPress suffers
from remote denial of service vulnerability. The bug exists in
encryption module (class-phpass.php). The exploitation of this
vulnerability is possible only when at least one post is protected by a
password.
>
> Time frames:
> 31.05.2013 WordPress security team has been informed about the vulnerability (no response).
> 07.06.2013 The vulnerability has been released to the public.
>
> More information (including proof of concept):
> https://vndh.net/note:wordpress-351-denial-service
>
> A way out (before official WordPress update) to secure existing installations is to apply the following patch:
>
> --- wp-includes/class-phpass.php
> +++ wp-includes/class-phpass.php
> @@ -120,7 +120,7 @@
> return $output;
>
> $count_log2 = strpos($this->itoa64, $setting[3]);
> - if ($count_log2 < 7 || $count_log2 > 30)
> + if ($count_log2 < 7 || $count_log2 > 13)
> return $output;
>
> $count = 1 << $count_log2;
Please use CVE-2013-2173 for this issue.
---
Henri Salo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlG5Z+oACgkQXf6hBi6kbk9jYwCeMIThfuTWFf GOalupCsLJLIbg
KYgAoIyjMj/ikxhoeyQBUIT+Xp1LgeeH
=2I3B
-----END PGP SIGNATURE-----
براي رفع اين مشكل فايل زير را با اديتور باز كنيد
wp-includes/class-phpass.php
در سطر 123
if ($count_log2 < 7 || $count_log2 > 30)
را حذف و به جاي آن
if ($count_log2 < 7 || $count_log2 > 13)
قرار دهيد
براي آنكه مطالب بيشتري در اين زمينه كسب كنيد به باگ و رفع آن در نسخه 3.5.1 (http://wp-help.ir/showthread.php?tid=2068) مراجعه نماييد