Remote users may reset the admin password (?)

[Rolf Leggewie]

Binary package hint: wordpress

I just browsed the Debian BTS today and came across. http://bugs.debian.org/541102

I don't think vulnerability has been established yet, but I thought I'd report it here nonetheless to give you a chance to take a look.

According to the information in the original report on lists.grok.org.uk, all current Ubuntu releases of Wordpress would be affected.

http://lists.grok.org.uk/pipermail/full-disclosure/2009-August/070137.html
http://core.trac.wordpress.org/changeset/11798

[Giuseppe Iuculano (giuseppe-iuculano)]

This was fixed in 2.8.3-2ubuntu1

[Rolf Leggewie (r0lf)]

Thank you, great!

Giuseppe, the way I understand it, this affects releases prior to Karmic, too, doesn't it?

[Giuseppe Iuculano (giuseppe-iuculano)]

Rolf Leggewie ha scritto:
> Thank you, great!
>
> Giuseppe, the way I understand it, this affects releases prior to
> Karmic, too, doesn't it?
>

Not really.
I wasn't able to reproduce this issue in 2.5.1-11 and 2.0.10-1, but I didn't
investigate the code because it really seems just an annoying bug, not a
security issue.

Cheers,
Giuseppe.

[Rolf Leggewie (r0lf)]

Giuseppe, thank you for doing some verification work. I skipped that for lack of time and was going purely by the description. Being able to remotely reset the admin password of a wordpress installation does sound pretty serious, even if limited in scope and not affecting the whole system.