Wordpress 2.1.2 Update

By The.Clinton
in Back Page News

 Share

Recommended Posts

Community Regular

The.Clinton

Posted
Posted (edited)

Long story short: If you downloaded WordPress 2.1.1 within the past 3-4 days, your files may include a security exploit that was added by a cracker, and you should upgrade all of your files to 2.1.2 immediately.

Longer explanation: This morning we received a note to our security mailing address about unusual and highly exploitable code in WordPress. The issue was investigated, and it appeared that the 2.1.1 download had been modified from its original code. We took the website down immediately to investigate what happened.

It was determined that a cracker had gained user-level access to one of the servers that powers wordpress.org, and had used that access to modify the download file. We have locked down that server for further forensics, but at this time it appears that the 2.1.1 download was the only thing touched by the attack. They modified two files in WP to include code that would allow for remote PHP execution.

This is the kind of thing you pray never happens, but it did and now we?re dealing with it as best we can. Although not all downloads of 2.1.1 were affected, we?re declaring the entire version dangerous and have released a new version 2.1.2 that includes minor updates and entirely verified files. We are also taking lots of measures to ensure something like this can?t happen again, not the least of which is minutely external verification of the download package so we?ll know immediately if something goes wrong for any reason.

Finally, we reset passwords for a number of users with SVN and other access, so you may need to reset your password on the forums before you can login What You Can Do to HelpHelp

If your blog is running 2.1.1, please upgrade immediately and do a full overwrite of your old files, especially those in wp-includes. Check out your friends blogs and if any of them are running 2.1.1 drop them a note and, if you can, pitch in and help them with the upgrade.

If you are a web host or network administrator, block access to ?theme.php? and ?feed.php?, and any query string with ?ix=? or ?iz=? in it. If you?re a customer at a web host, you may want to send them a note to let them know about this release and the above information.

Thanks to Ryan, Barry, Donncha, Mark, Michael, and Dougal for working through the night to figure out and address this problem, and thanks to Ivan Fratric for reporting it in the first place.

Questions and Answers

Because of the highly unusual nature of this event and release, we?ve set up an email address [email protected] that you can email questions to, and we?ll be updating this entry with more infIs version 2.0 affected?b>Is version 2.0 affected?

No downloads were altered except 2.1.1, so if you?ve downloaded any versWhat if we update from SVN?>What if we update from SVN?

Nothing in the Subversion repository was touched, so if you upgrade and maintain your blog via SVN there is no chance you downloaded the corrupted release file.

souricon.gif News source: Source

softicon.gif Download: Download

Edited by DeanClinton
Link to comment
https://www.neowin.net/forum/topic/543166-wordpress-212-update/
Share on other sites
Grand Master

Xtreme $niper

Posted
Posted

Bah sorry if this is kinda off topic, but I'd assume it would be a fairly short answer... I haven't really learned how WordPress is actually set up too much, but I'm afraid to update mine mainly because I fear that the files that it requires to overwrite in order to perform the update will overwrite a file from my template design... I haven't actually gotten around to doing this yet to find out if it will happen, but can anyone tell me if my template will be safe when I do an update? Or do I have to back up certain files and restore them after the update?

Grand Master

Xtreme $niper

Posted
Posted
Custom templates aren't touched during the update. Only core files and default themes are included in the download.

Oh awesome, I guess I have no more excuses to give it a try. Not like my blog has much on it at this point. I could just back everything up and restore it if something goes wrong.

Thanks.

Veteran

Neil

Posted
Posted
Oh awesome, I guess I have no more excuses to give it a try. Not like my blog has much on it at this point. I could just back everything up and restore it if something goes wrong.

Thanks.

As long as you don't overwrite the wp-content folder - this would mean that you would remove everything inside and start clean, that is all.

Mentor

chrisgeleven

Posted
Posted

What you should backup before doing a WordPress upgrade:

wp-config.php (this has all of your database connection stuff)

\wp-content\ (your plugins and themes)

What I typically do is delete every file except the wp-content folder and wp-config.php, then upload the new version. Afterwards, I go into my \wp-content\plugins folder and make sure the Akismet plugin is the latest.

Community Regular

The.Clinton

Posted
  • Author
Posted
What you should backup before doing a WordPress upgrade:

wp-config.php (this has all of your database connection stuff)

\wp-content\ (your plugins and themes)

What I typically do is delete every file except the wp-content folder and wp-config.php, then upload the new version. Afterwards, I go into my \wp-content\plugins folder and make sure the Akismet plugin is the latest.

Thats the same way I do it

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • LibreWolf 151.0.3-1

      By Copernic · Posted

      LibreWolf 151.0.3-1 by Razvan Serea LibreWolf is an independent “fork” of Firefox, with the primary goals of privacy security and user freedom. It is the community run successor to LibreFox. LibreWolf is designed to increase protection against tracking and fingerprinting techniques, while also including a few security improvements. This is achieved through our privacy and security oriented settings and patches. LibreWolf also aims to remove all the telemetry, data collection and annoyances, as well as disabling anti-freedom features like DRM. LibreWolf features: Latest Firefox — LibreWolf is compiled directly from the latest build of Firefox Stable. You will have the the latest features, and security updates. Independent Build — LibreWolf uses a build independent of Firefox and has its own settings, profile folder and installation path. As a result, it can be installed alongside Firefox or any other browser. No phoning home — Embedded server links and other calling home functions are removed. In other words, minimal background connections by default. User settings updates Extensions firewall: limit internet access for extensions. Multi-platform (Windows/Linux/Mac/and soon Android) Community-Driven Dark theme (classic and advanced) LibreWolf privacy features: Delete cookies and website data on close. Include only privacy respecting search engines like DuckDuckGo and Searx. Include uBlockOrigin with custom default filter lists, and Tracking Protection in strict mode, to block trackers and ads. Strip tracking elements from URLs, both natively and through uBO. Enable dFPI, also known as Total Cookie Protection. Enable RFP which is part of the Tor Uplift project. RFP is considered the best in class anti-fingerprinting solution, and its goal is to make users look the same and cover as many metrics as possible, in an effort to block fingerprinting techniques. Always display user language as en-US to websites, in order to protect the language used in the browser and in the OS. Disable WebGL, as it is a strong fingerprinting vector. Prevent access to the location services of the OS, and use Mozilla's location API instead of Google's API. Limit ICE candidates generation to a single interface when sharing video or audio during a videoconference. Force DNS and WebRTC inside the proxy, when one is being used. Trim cross-origin referrers, so that they don't include the full URI. Disable link prefetching and speculative connections. Disable disk cache and clear temporary files on close. Disable form autofill. Disable search and form history...and more. LibreWolf 151.0.3-1 changelog: Upstream release, see the Firefox 151.0.3 Release Notes Notable changes: Clears the preference toolkit.winRegisterApplicationRestart, which may otherwise trigger an upstream bug on Windows (librewolf/issues#3056) Download: LibreWolf 64-bit | Portable 64-bit | ~100.0 MB (Open Source) Download: ARM64 | Portable ARM64 Links: LibreWolf Home Page | Addons | Screenshot | Reddit Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Apple reluctantly forces strict new age checks on Texas users starting today

      By excalpius · Posted

      Unsurprisingly, there's what the law says and what the old white wealthy males legally enforce...
    • [NEWS] Over 105000 games are available to play on Linux.

      By Circaflex · Posted

      Or anything online that requires an anti-cheat
    • Here is the new Surface Laptop Ultra wallpaper in high resolution

      By FunkyMike · Posted

      Gf needed a new Surface and was looking at a Surface Laptop because of the Snapdragon. Seeing as it was a two year old chip she just decided to get a Lenovo Yoga 2 in 1 instead. Personally this Surface Ultra Cassis reminds me a bit of Razor. It would be interesting if it could handle proper gaming and be 17 inch.
    • [NEWS] Over 105000 games are available to play on Linux.

      By Case_f · Posted

      No idea, frankly, I'm not into minimum requirements gaming, but it would be an interesting test to find out. Also, I just have to point out that it wasn't my intention to downplay the performance of DXVK on Linux or Linux gaming in general (despite my own experience being a bit of a mixed bag). I just thought it would be good to point out that DXVK is not Linux exclusive and that you can benefit from using it even in Windows.

  • Recent Achievements

    • Apprentice
      fernan99 went up a rank
      Apprentice
    • One Month Later
      nothanks earned a badge
      One Month Later
    • One Month Later
      B2Proxy earned a badge
      One Month Later
    • One Year In
      MadMung0 earned a badge
      One Year In
    • Week One Done
      jefred earned a badge
      Week One Done

  • Popular Contributors

    1. 1
      +primortal
      479
    2. 2
      PsYcHoKiLLa
      247
    3. 3
      Skyfrog
      79
    4. 4
      FloatingFatMan
      78
    5. 5
      Michael Scrip
      60
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!