Serendipity 1.1.3 and 1.2-beta2 released due to SQL exploit

Serendipity 1.1.3 and 1.2-beta2 have been released due to a SQL injection attack reported by Dr. Neal Krawetz today. It is possible to abuse a 'commentMode' variable to inject SQL code that was targeted to the function that fetches comment information. This variable was introduced to Serendipity 1.1 - all prior versions are not affected.

Please update your blogs as soon as possible. If you are using a database backend that allows SQL union queries, the injection could probably lead to disclosure of the stored MD5 password hashes. Because of this, we also suggest to update your blog user account passwords.

It is a good idea to check your server's Access-Logs and search for the 'commentMode' variable to see, if malicious request have been issued to your blog already.

For those people that do not want to upgrade to a whole new version, you can also simply patch the file include/functions_comments.inc.php and replace the single occurence of:

$type = $serendipity['GET']['commentMode'];

to

$type = serendipity_db_escape_string($serendipity['GET']['commentMode']);

We are very sorry for this, but happy to provide a quick fix in short time. You can download the latest files as usual on www.s9y.org. Read the FAQ on how to perform an easy update.

Trackbacks

Trackback specific URI for this entry

  • No Trackbacks

Comments

Display comments as (Linear | Threaded)

Neut on at :

Done. Thanks for the info and quick fix (modding the comments.inc.php).

sqall on at :

Thx for the info. I've made a whole upgrade...

deminy on at :

Just upgraded from v1.1.1 to v1.2 beta 2. Thanks.

Ben on at :

Thx...Very fast. I made a whole update, but this patch works also well...

disgruntled user on at :

Too bad the late great hacker Dr. Neal Krawetz didn't find this vulnerability. He just checked his http logs after getting owned.

Really? on at :

How was he owned? As of 10 minutes ago, he seems to be running a non-vulerable version of s9y. I've sent him an email asking about this.

Really? on at :

That was fast. He just wrote back and included some of his logs. He says he wasn't owned and his logs show someone trying different SQL variations for more than 12 hours without success.

Hey disgruntled user: his last log entry was from a few hours ago, just before your posting here. Are you the guy at 24.154.233.208 who failed to own his blog?

Niels on at :

thx!

that was very fast.
i love this software ;)

Hasdne on at :

Awesome! Thanks!

Paws on at :

Thanks for the fix!

I did mod the code. Seemed to be the fastest way. No need to upload the full package again when it's only 1 line of code that has changed.

Thanks again!

Paws ^^

Ben on at :

Thanks! *fixed

Kangaxx on at :

Thanks.
Great Software. :-)

Andy on at :

Thanks for the fast fix and the info to prevent a full upgrade...

Jörg on at :

Thanks a lot. Just updated! ;-)

Luca on at :

thanks very much, updated it

verb0ten on at :

Thanks for the fix! Very important for me :)

Add Comment

E-Mail addresses will not be displayed and will only be used for E-Mail notifications.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

BBCode format allowed