WordPress/TimThumb Security Vulnerability

Intro­duc­tion

It’s no secret that users love Word­Press for eas­ily cre­at­ing and shar­ing con­tent. There are a lot of great sites that do a mul­ti­tude of extremely use­ful things at the UW, and we only see growth and adop­tion increas­ing as we look into the future. How­ever, as with any other con­tent man­age­ment sys­tem, Word­Press sees its share of secu­rity vul­ner­a­bil­i­ties. While the core is soild and the Word­Press team has done an excel­lent job lock­ing it down, 3rd party theme and plu­gin devel­op­ers can oftn write inse­cure code that leads to zero-day exploits that can do some very nasty things to your site.

Good File Gone Bad: TimThumb.php

While it isn’t included in the stock Word­Press expe­ri­ence, many themes and plu­g­ins use a file called “timthumb.php” to work with uploaded images. Unfor­tu­nately, the timthumb.php code was highly inse­cure and an attacker could upload a spe­cially crafted “image” file that would allow them to upload and run arbi­trary scripts onto the web server.

Find Out More

http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many-wordpress-themes/
http://blog.sucuri.net/2011/08/mass-infection-of-wordpress-sites-counter-wordpress-com.html

http://wordpress.org/extend/plugins/timthumb-vulnerability-scanner/

Check to See if Your Site is Infected

The links above offer greater insights into this issue and check­ing to see if your site is impacted. If you dis­cover some unknown code, odd behaiv­iour, or oth­er­wise signs that may indi­cate a pos­si­ble site, please con­tact help@uw.edu