Blog Elements

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

WordPress 4.5.2 Security Release

2016-05-09/0 Comments/in Vulnerability, Web Security/by SecurityOrb_Staff

WordPress 4.5.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress Redirect Hack via Test0.com/Default7.com

2016-05-06/0 Comments/in Vulnerability/by SecurityOrb_Staff

We’ve been working on a few WordPress sites with the same infection that randomly redirects visitors to malicious sites via the default7 .com / test0 .com / test246 .com domains.

WordPress 4.5.2 Security Release

2016-05-09/0 Comments/in Vulnerability, Web Security/by SecurityOrb_Staff

WordPress 4.5.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress Redirect Hack via Test0.com/Default7.com

2016-05-06/0 Comments/in Vulnerability/by SecurityOrb_Staff

We’ve been working on a few WordPress sites with the same infection that randomly redirects visitors to malicious sites via the default7 .com / test0 .com / test246 .com domains.

Full Sized Blog Element (Big Preview Pic)

WordPress 4.5.2 Security Release

2016-05-09/0 Comments/in Vulnerability, Web Security/by SecurityOrb_Staff

WordPress 4.5.2 Security Release

Posted May 6, 2016 by Helen Hou-Sandi on the WordPress Blog Site.

WordPress 4.5.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.5.1 and earlier are affected by a SOME vulnerability through Plupload, the third-party library WordPress uses for uploading files. WordPress versions 4.2 through 4.5.1 are vulnerable to reflected XSS using specially crafted URIs through MediaElement.js, the third-party library used for media players. MediaElement.js and Plupload have also released updates fixing these issues.

Both issues were analyzed and reported by Mario Heiderich, Masato Kinugawa, and Filedescriptor from Cure53. Thanks to the team for practicing responsible disclosure, and to the Plupload and MediaElement.js teams for working closely with us to coördinate and fix these issues.

Download WordPress 4.5.2 or venture over to Dashboard → Updates and simply click “Update Now.” Sites that support automatic background updates are already beginning to update to WordPress 4.5.2.

Additionally, there are multiple widely publicized vulnerabilities in the ImageMagick image processing library, which is used by a number of hosts and is supported in WordPress. For our current response to these issues, see this post on the core development blog.

WordPress Redirect Hack via Test0.com/Default7.com

2016-05-06/0 Comments/in Vulnerability/by SecurityOrb_Staff

WordPress Redirect Hack via Test0.com/Default7.com

An article written by Denis Sinegubko:

05052016_WordPressRedirect_V1
We’ve been working on a few WordPress sites with the same infection that randomly redirects visitors to malicious sites via the default7 .com / test0 .com / test246 .com domains. In this post, we’ll provide you with a review of this attack, investigated by our malware analyst, John Castro.

Header.php Injection

In all cases, the malware injects 10-12 lines of code at the top of the header.php file of the current WordPress theme:

Malicious injection in header.php

When decoded, you see this main part of the malware:

Decoded malware

The logic is simple. It redirects visitors to default7. com if it’s their first visit to this site after the infection, then it sets the 896diC9OFnqeAcKGN7fW cookie for one year to track returning visitors. If they are not search engine crawlers, it checks the user agent header.

For more information, read more here.