Serendipity 1.1.3 and 1.2-beta2 released due to SQL exploit

Serendipity 1.1.3 and 1.2-beta2 have been released due to a SQL injection attack reported by Dr. Neal Krawetz today. It is possible to abuse a 'commentMode' variable to inject SQL code that was targeted to the function that fetches comment information. This variable was introduced to Serendipity 1.1 - all prior versions are not affected.

Please update your blogs as soon as possible. If you are using a database backend that allows SQL union queries, the injection could probably lead to disclosure of the stored MD5 password hashes. Because of this, we also suggest to update your blog user account passwords.

It is a good idea to check your server's Access-Logs and search for the 'commentMode' variable to see, if malicious request have been issued to your blog already.

For those people that do not want to upgrade to a whole new version, you can also simply patch the file include/functions_comments.inc.php and replace the single occurence of:

$type = $serendipity['GET']['commentMode'];

to

$type = serendipity_db_escape_string($serendipity['GET']['commentMode']);

We are very sorry for this, but happy to provide a quick fix in short time. You can download the latest files as usual on www.s9y.org. Read the FAQ on how to perform an easy update.

Trackbacks

Trackback-URL für diesen Eintrag

  • Keine Trackbacks

Kommentare

Ansicht der Kommentare: (Linear | Verschachtelt)

Neut am um :

Done. Thanks for the info and quick fix (modding the comments.inc.php).

sqall am um :

Thx for the info. I've made a whole upgrade...

deminy am um :

Just upgraded from v1.1.1 to v1.2 beta 2. Thanks.

Ben am um :

Thx...Very fast. I made a whole update, but this patch works also well...

disgruntled user am um :

Too bad the late great hacker Dr. Neal Krawetz didn't find this vulnerability. He just checked his http logs after getting owned.

Really? am um :

How was he owned? As of 10 minutes ago, he seems to be running a non-vulerable version of s9y. I've sent him an email asking about this.

Really? am um :

That was fast. He just wrote back and included some of his logs. He says he wasn't owned and his logs show someone trying different SQL variations for more than 12 hours without success.

Hey disgruntled user: his last log entry was from a few hours ago, just before your posting here. Are you the guy at 24.154.233.208 who failed to own his blog?

Niels am um :

thx!

that was very fast. i love this software ;)

Hasdne am um :

Awesome! Thanks!

Paws am um :

Thanks for the fix!

I did mod the code. Seemed to be the fastest way. No need to upload the full package again when it's only 1 line of code that has changed.

Thanks again!

Paws ^^

Andy am um :

Thanks for the fast fix and the info to prevent a full upgrade...

Jörg am um :

Thanks a lot. Just updated! ;-)

Luca am um :

thanks very much, updated it

verb0ten am um :

Thanks for the fix! Very important for me :)

Kommentar schreiben

Die angegebene E-Mail-Adresse wird nicht dargestellt, sondern nur für eventuelle Benachrichtigungen verwendet.

Um maschinelle und automatische Übertragung von Spamkommentaren zu verhindern, bitte die Zeichenfolge im dargestellten Bild in der Eingabemaske eintragen. Nur wenn die Zeichenfolge richtig eingegeben wurde, kann der Kommentar angenommen werden. Bitte beachten Sie, dass Ihr Browser Cookies unterstützen muss, um dieses Verfahren anzuwenden.
CAPTCHA

BBCode-Formatierung erlaubt
Markdown-Formatierung erlaubt