Serendipity 1.0.4 released!
Posted by Garvin Hicking in Announcements, Development, Plugins, Security
Comments (4)
Trackbacks (9)
This new Serendipity release addresses a local file inclusion security issue discovered yesterday. It was possible to give a special parameter to a serendipity file to include a file on your own web-tree (or other files the webserver has read access to). If used on clear-text files, this could be used to disclose information like the apache logfiles on your website.
This error can only happen in a scenario with two prerequisites: Register_Globals needs to be turned on in your PHP configuration AND your webserver must ignore the default Serendipity .htaccess file. This .htaccess file usually prevents to directly call Serendipity's include files via HTTP. Thus we feel that only a very low percentage of installations should be affected by this bug.
However, Serendipity 1.0.4 is a recommended upgrade for everyone taking security responsibly, like we do. We are thankful to the community for inspecting Serendipity, searching for bugs and security issues and reporting them to us. In this case, many thanks to Majestic from the forums for notifying us.
Most of the plugins (both bundled and available via spartacus) were upgraded to also circumvent that bug, so you should upgrade all of your active plugins to the recent versions as well.
The Serendipity 1.1 release tree was also modified with a patch for this issue. It will be contained in todays snapshot, and the 1.1-beta6 release file. The easy steps to perform an upgrade are documented in our FAQ on http://www.s9y.org/.
This new Serendipity release addresses a local file inclusion security issue discovered yesterday. It was possible to give a special parameter to a serendipity file to include a file on your own web-tree (or other files the webserver has read access to). If used on clear-text files, this could be used to disclose information like the apache logfiles on your website. This error can only happen in a scenario with two prerequisites: Register_Globals needs to be turned on in your PHP configuration AND your webserver must ignore the default Serendipity .htaccess file. This .htaccess file usually prevents to directly call Serendipity\'s include files via HTTP. Thus we feel that only a very low percentage of installations should be affected by this bug. However, Serendipity 1.0.4 is a recommended upgrade for everyone taking security responsibly, like we do. We are thankful to the community for inspecting Serendipity, searching for bugs and security issues and reporting them to us. In thBTW, the links to 1.1-beta6 on the download page haven't been updated yet (they're still pointing to Beta 5).
Best regards,
-Manuel
Documentation always changes and is enlarged, so packing it offline in a ZIP is not clever.
Our documentation is on www.s9y.org, you sadly have to wait until our server is restored.
Regards,
Garvin
Eigentlich ist mein Blog ja mehr oder weniger Serendipity-freie Zone, seit ich auch das offizielle Blog mit Infos befülle. Aus gegebenem Anlass: Scheinbar bringt die Weihnachtszeit auch mehr Freizeit für Exploiter mit sich, die gestern eine Sicherheits
Tracked: Dec 01, 10:41
Peter Glaser schreibt unter der für mich nicht nachvollziehbaren Überschrift “Dye To Buy”: Konsumieren ist die letzte verbleibende Form öffentlicher Aktivität, sagt der Architekt Rem Kohlhaas. Wie eine Insektenkolonie hat es praktisch jed
Tracked: Dec 01, 12:40
Ich habe diesen Blog soeben auf Serendipity v1.0.4 aktualisiert. Wie immer ging das Update absolut problemlos!
Tracked: Dec 01, 12:57
Heute wurde die Blogsoftware Serendipity in der Version 1.0.4 veroffentlicht. Dieses Release schließt eine akute Sicherheitslücke und sollte somit von jedem Nutzen installiert werden. Neuerungen wurden laut dem Unternehmensblog nicht in das Release...
Tracked: Dec 01, 20:47
Aufgrund eines Sicherheitslecks - das angeblich nur wenige betreffen kann - wurde heute eine bereinigte Version 1.0.4 von Serendipity/S9y veröffentllicht. Wichtiger Hinweis: Um das Sicherheitsleck vollständig zu stopfen sind über Spartacus auch etliche
Tracked: Dec 02, 00:04
Gestern wurde eine Security-Update von Serendipity veröffentlicht. Runterladen, entpacken, auf den Webspace kopieren und ausführen. Ging wie immer total unkompliziert via lux
Tracked: Dec 02, 09:42
Seems like there was another vulnerability found in S9Y. So I just updated my blog to the latest release (1.0.4a). Chris and Fox: yep... I updated your blog as well (via laemmy)
Tracked: Dec 02, 11:34
Thx an Lux, Laemmy & Doomy für die Info. Wer sonst noch S9Y benutzt sollte auch schnell updaten!
Tracked: Dec 02, 14:58
Dopo l'aggiornamento fatto ieri sera alla versione 1.0.4 di Serendipty (dovuto ad una patch di sicurezza) ho deciso di cambiare anche lo stile del mio blog.Ecco le operazioni eseguite. Dopo il dump del database ho salvato il file serendipity_config
Tracked: Dec 03, 17:40