Wordpress 2.6.2 – Important Security Fix

Well What do you know, there is another release of Wordpress. And a crucial one that should upgrade to as soon as possible. I have already upgraded my site, and I recommend you guys to do the same. Recently, Stefan Esser warned developers of the dangers of SQL Column Truncation and the weakness of mt_rand().

It is mainly geared towards users who have open registration enabled because WP 2.6.1 and earlier versions allow you to craft a username so it will allow resetting another user’s password to a randomly generated password. The randomly generated password is not disclosed to the attacker, but it is still annoying to know that someone can do this, so it was more of annoyance rather than a security exploit.

Even though it wasn’t a security exploit, it can lead to many breakthroughs. So simply by seeding random numbers mt_rand(), attacker could predict the randomly generated password (so the formula how random number generates). While the attack is difficult to accomplish, and most people don’t know how to do it. But there is a possibility. And when there is, you know not to take risks. So upgrade to wordpress 2.6.2. Thanks to Stefan because with his help Wordpress team was able to fix the issue. He will be releasing the complete attack details soon.

Other PHP applications are also susceptible to this class of attack. To protect all of your applications, get the latest version of Suhosin. If you’ve already updated Suhosin, your existing WordPress install is already protected from the full exploit. You should still upgrade to 2.6.2 if you allow open user registration so you can prevent the possibility of passwords being guessed by the attacker.

2.6.2 also contains a handful of bug fixes. Check out the full changeset and list of changed files.