Movabletype should be update on lucid and others to address security vulnerability.

[William Metcalf]

The PBS website was hacked with a security vulnerability found in movable type prior to version 4.3.6.1. See articles below.

http://techcrunch.com/2011/06/09/six-apart-releases-movable-type-updates-to-plug-security-holes-following-pbs-hack/
http://www.movabletype.com/blog/2011/06/movable-type-511-and-5051-4361-security-updates.html

I see that oneiric has been updated to 4.3.6.1 which addresses the unspecified vulns in the PBS hack. Have these fixes been back-ported to Lucid, or are there plans to upgrade Lucid to 4.3.6.1?

#oneriric changelog
http://changelogs.ubuntu.com/changelogs/pool/universe/m/movabletype-opensource/movabletype-opensource_4.3.6.1+dfsg-1/changelog

#lucid changelog
http://changelogs.ubuntu.com/changelogs/pool/universe/m/movabletype-opensource/movabletype-opensource_4.3.3-1/changelog

[William Metcalf (william-metcalf)]

It seems that this issue has been addressed in Debian.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=627936