<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: New 0-Day WordPress Exploit</title>
	<atom:link href="http://www.stevefortuna.com/new-0-day-wordpress-exploit/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.stevefortuna.com/new-0-day-wordpress-exploit/</link>
	<description>Technology Blog</description>
	<lastBuildDate>Wed, 25 Aug 2010 15:05:10 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
	<item>
		<title>By: Your Best Blog Post So Far - Net Builders</title>
		<link>http://www.stevefortuna.com/new-0-day-wordpress-exploit/#comment-955</link>
		<dc:creator>Your Best Blog Post So Far - Net Builders</dc:creator>
		<pubDate>Fri, 23 Apr 2010 19:03:28 +0000</pubDate>
		<guid isPermaLink="false">http://www.stevefortuna.com/?p=66#comment-955</guid>
		<description>[...] have to say of the handful of blog posts I&#039;ve made, this one has been the best:  New 0-Day Wordpress Exploit &#124; Steve Fortuna  I was the first one in English to publicly post this information and in turn got a lot of links [...]</description>
		<content:encoded><![CDATA[<p>[...] have to say of the handful of blog posts I&#39;ve made, this one has been the best:  New 0-Day WordPress Exploit | Steve Fortuna  I was the first one in English to publicly post this information and in turn got a lot of links [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Jared Atchison &#187; Blog Archive &#187; Wordpress trackback exploit found</title>
		<link>http://www.stevefortuna.com/new-0-day-wordpress-exploit/#comment-138</link>
		<dc:creator>Jared Atchison &#187; Blog Archive &#187; Wordpress trackback exploit found</dc:creator>
		<pubDate>Fri, 23 Oct 2009 15:51:59 +0000</pubDate>
		<guid isPermaLink="false">http://www.stevefortuna.com/?p=66#comment-138</guid>
		<description>[...] If you want to read more about all the technical stuff you can find the original blog post detailing the exploit here. [...]</description>
		<content:encoded><![CDATA[<p>[...] If you want to read more about all the technical stuff you can find the original blog post detailing the exploit here. [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: steve</title>
		<link>http://www.stevefortuna.com/new-0-day-wordpress-exploit/#comment-137</link>
		<dc:creator>steve</dc:creator>
		<pubDate>Fri, 23 Oct 2009 13:02:12 +0000</pubDate>
		<guid isPermaLink="false">http://www.stevefortuna.com/?p=66#comment-137</guid>
		<description>I haven&#039;t looked at the MU setup before but if you can find the vulnerable code in wp-trackback.php, then it would be in your best interest to upgrade or apply the patch.

&lt;blockquote cite=&quot;#commentbody-136&quot;&gt;
&lt;strong&gt;&lt;a href=&quot;#comment-136&quot; rel=&quot;nofollow&quot;&gt;jez&lt;/a&gt; :&lt;/strong&gt;
          &lt;p&gt;hey steve,&lt;/p&gt;
&lt;p&gt;I am running wp-mu on my sites and they did not update to 2.8.5 yet, reading your and glenn’s remarks I wonder if putting glenn’s plugin in the plugins folder and activating it sidewide will sort me out? &lt;/p&gt;
&lt;p&gt;cheers&lt;/p&gt;
         &lt;/blockquote&gt;</description>
		<content:encoded><![CDATA[<p>I haven&#8217;t looked at the MU setup before but if you can find the vulnerable code in wp-trackback.php, then it would be in your best interest to upgrade or apply the patch.</p>
<blockquote cite="#commentbody-136"><p>
<strong><a href="#comment-136" rel="nofollow">jez</a> :</strong></p>
<p>hey steve,</p>
<p>I am running wp-mu on my sites and they did not update to 2.8.5 yet, reading your and glenn’s remarks I wonder if putting glenn’s plugin in the plugins folder and activating it sidewide will sort me out? </p>
<p>cheers</p>
</blockquote>
]]></content:encoded>
	</item>
	<item>
		<title>By: jez</title>
		<link>http://www.stevefortuna.com/new-0-day-wordpress-exploit/#comment-136</link>
		<dc:creator>jez</dc:creator>
		<pubDate>Fri, 23 Oct 2009 09:16:43 +0000</pubDate>
		<guid isPermaLink="false">http://www.stevefortuna.com/?p=66#comment-136</guid>
		<description>hey steve,

I am running wp-mu on my sites and they did not update to 2.8.5 yet, reading your and glenn&#039;s remarks I wonder if putting glenn&#039;s plugin in the plugins folder and activating it sidewide will sort me out? 

cheers</description>
		<content:encoded><![CDATA[<p>hey steve,</p>
<p>I am running wp-mu on my sites and they did not update to 2.8.5 yet, reading your and glenn&#8217;s remarks I wonder if putting glenn&#8217;s plugin in the plugins folder and activating it sidewide will sort me out? </p>
<p>cheers</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: WordPress 2.8.5 is available to download. &#187; RongDhonu Tutorials - Tutorials on SEO, WordPress, Joomla, cPanel, MySQL</title>
		<link>http://www.stevefortuna.com/new-0-day-wordpress-exploit/#comment-133</link>
		<dc:creator>WordPress 2.8.5 is available to download. &#187; RongDhonu Tutorials - Tutorials on SEO, WordPress, Joomla, cPanel, MySQL</dc:creator>
		<pubDate>Thu, 22 Oct 2009 10:16:16 +0000</pubDate>
		<guid isPermaLink="false">http://www.stevefortuna.com/?p=66#comment-133</guid>
		<description>[...] when used. This has specifically been addressed in 2.8.5. Thanks goes out to Steve Fortuna for releasing a fix to this 0 day exploit. The release also contains a few bug fixes as [...]</description>
		<content:encoded><![CDATA[<p>[...] when used. This has specifically been addressed in 2.8.5. Thanks goes out to Steve Fortuna for releasing a fix to this 0 day exploit. The release also contains a few bug fixes as [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Opět nečekaný WordPress 2.8.5 s bezpečnostní opravou proti DoS útoku &#124; Separatista</title>
		<link>http://www.stevefortuna.com/new-0-day-wordpress-exploit/#comment-128</link>
		<dc:creator>Opět nečekaný WordPress 2.8.5 s bezpečnostní opravou proti DoS útoku &#124; Separatista</dc:creator>
		<pubDate>Wed, 21 Oct 2009 20:24:42 +0000</pubDate>
		<guid isPermaLink="false">http://www.stevefortuna.com/?p=66#comment-128</guid>
		<description>[...] se objevil DoS (Denial-of-Service) útok pomocí trackbacků, čemuž by měla nová verze [...]</description>
		<content:encoded><![CDATA[<p>[...] se objevil DoS (Denial-of-Service) útok pomocí trackbacků, čemuž by měla nová verze [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Otto</title>
		<link>http://www.stevefortuna.com/new-0-day-wordpress-exploit/#comment-126</link>
		<dc:creator>Otto</dc:creator>
		<pubDate>Wed, 21 Oct 2009 14:16:08 +0000</pubDate>
		<guid isPermaLink="false">http://www.stevefortuna.com/?p=66#comment-126</guid>
		<description>The fix in the WordPress 2.8.5 release is this:

&lt;code&gt;
if ($charset)
        $charset = str_replace( array(&#039;,&#039;, &#039; &#039;), &#039;&#039;, strtoupper( trim($charset) ) );
else
        $charset = &#039;ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS&#039;;
&lt;/code&gt;

That eliminates the commas and spaces from the charset string, eliminating the resource exhaustion.</description>
		<content:encoded><![CDATA[<p>The fix in the WordPress 2.8.5 release is this:</p>
<p><code><br />
if ($charset)<br />
        $charset = str_replace( array(',', ' '), '', strtoupper( trim($charset) ) );<br />
else<br />
        $charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS';<br />
</code></p>
<p>That eliminates the commas and spaces from the charset string, eliminating the resource exhaustion.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: webanalyser-Blog &#187; Blog Archive &#187; Erneut Sicherheitsupdate von Wordpress verfügbar</title>
		<link>http://www.stevefortuna.com/new-0-day-wordpress-exploit/#comment-125</link>
		<dc:creator>webanalyser-Blog &#187; Blog Archive &#187; Erneut Sicherheitsupdate von Wordpress verfügbar</dc:creator>
		<pubDate>Wed, 21 Oct 2009 14:13:39 +0000</pubDate>
		<guid isPermaLink="false">http://www.stevefortuna.com/?p=66#comment-125</guid>
		<description>[...] 2.9 implementiert sein werden, auf die 2.8er-Reihe übertragen wurden. So wurde das Problem mit DoS-Attacken über die Datei wp-trackback.php gefixt. Ebenso wurde Programmcode entfernt, in dem PHP-Code über [...]</description>
		<content:encoded><![CDATA[<p>[...] 2.9 implementiert sein werden, auf die 2.8er-Reihe übertragen wurden. So wurde das Problem mit DoS-Attacken über die Datei wp-trackback.php gefixt. Ebenso wurde Programmcode entfernt, in dem PHP-Code über [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: steve</title>
		<link>http://www.stevefortuna.com/new-0-day-wordpress-exploit/#comment-124</link>
		<dc:creator>steve</dc:creator>
		<pubDate>Wed, 21 Oct 2009 12:49:43 +0000</pubDate>
		<guid isPermaLink="false">http://www.stevefortuna.com/?p=66#comment-124</guid>
		<description>I&#039;m sure there are a lot of ways to fix the bug.  What I posted is just one of those.

&lt;blockquote cite=&quot;#commentbody-116&quot;&gt;
&lt;strong&gt;&lt;a href=&quot;#comment-116&quot; rel=&quot;nofollow&quot;&gt;Gros&lt;/a&gt; :&lt;/strong&gt;
          &lt;p&gt;escuse me, something like this:&lt;/p&gt;
&lt;p&gt;if ( ($charset) &amp;&amp; strtoupper( trim($charset))=== get_option(’blog_charset’);&lt;br&gt;
$charset = strtoupper( trim($charset)); //$charset = get_option(’blog_charset’);&lt;br&gt;
else&lt;br&gt;
$charset = ‘ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS’;&lt;/p&gt;
         &lt;/blockquote&gt;</description>
		<content:encoded><![CDATA[<p>I&#8217;m sure there are a lot of ways to fix the bug.  What I posted is just one of those.</p>
<blockquote cite="#commentbody-116"><p>
<strong><a href="#comment-116" rel="nofollow">Gros</a> :</strong></p>
<p>escuse me, something like this:</p>
<p>if ( ($charset) &amp;&amp; strtoupper( trim($charset))=== get_option(’blog_charset’);<br />
$charset = strtoupper( trim($charset)); //$charset = get_option(’blog_charset’);<br />
else<br />
$charset = ‘ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS’;</p>
</blockquote>
]]></content:encoded>
	</item>
	<item>
		<title>By: Johnny's World &#124; 记录个人生活以及学习网络营销与推广</title>
		<link>http://www.stevefortuna.com/new-0-day-wordpress-exploit/#comment-123</link>
		<dc:creator>Johnny's World &#124; 记录个人生活以及学习网络营销与推广</dc:creator>
		<pubDate>Wed, 21 Oct 2009 12:07:33 +0000</pubDate>
		<guid isPermaLink="false">http://www.stevefortuna.com/?p=66#comment-123</guid>
		<description>[...] 2.8.4的漏洞，有兴趣的朋友可以看看这里：New 0-Day Wordpress Exploit。 [...]</description>
		<content:encoded><![CDATA[<p>[...] 2.8.4的漏洞，有兴趣的朋友可以看看这里：New 0-Day WordPress Exploit。 [...]</p>
]]></content:encoded>
	</item>
</channel>
</rss>
