news aggregator

[Honeypot Alert] Active Probes for WordPress revslider_show_image Plugin Local File Inclusion Flaw

Web Security Blog - Wed, 2014-09-03 16:22

A local file inclusion vulnerability in the WordPress Slider Revolution Plugin has been released:

Apparently this vulnerability has been discussed on some underground forums for a couple months but it wasn't until these more main stream websites published data that we saw attackers start scanning for vulnerable sites.  Our web honeypots picked up increased scanning activity today.  Here is an example full audit log dump of the HTTP request from our ModSecurity WAF:

In this attack example, the attacker is trying to access the WordPress config file in the hopes of obtaining sensitive data such as database credentials.

Recommendations Update your WordPress Slider Revolution Plugin

Sucuri Security is seeing similar activity and it also reporting that the developer of this Plugin chose to silently patch this vulnerability.  This did a disservice to the Plugin userbase to be aware of the problem and to prompt updating.  A couple notes:

  • Updating this plugin may need to be done manually if your WP manager does not provide an interface for it.
  • Beware that "disabling' the Plugin may end up being superceded by the Theme and be re-enabled.  You may need to remove it altogether if you can not update it. 
Use WAF Protections

WAFs can be used to help prevent exploitation until you can get your systems updated.  Trustwave's WebDefend WAF would block this attack either through a generic "Directory Traversal Attack" signature or through an anomaly of the learned resource profile.  For ModSecurity WAF, we have added a new signature to our commercial rules feed:

Categories: web server

PHP 5.6.0 released

php.net - Thu, 2014-08-28 00:00
The PHP Development Team announces the immediate availability of PHP 5.6.0. This new version comes with new features, some backward incompatible changes and many improvements. The main features of PHP 5.6.0 include:Constant scalar expressions.Variadic functions and argument unpacking using the ... operator.Exponentiation using the ** operator.Function and constant importing with the use keyword.phpdbg as an interactive integrated debugger SAPI.php://input is now reusable, and $HTTP_RAW_POST_DATA is deprecated.GMP objects now support operator overloading.File uploads larger than 2 gigabytes in size are now accepted.For a full list of new features, you may read the new features chapter of the migration guide.PHP 5.6.0 also introduces changes that affect compatibility:Array keys won't be overwritten when defining an array as a property of a class via an array literal.json_decode() is more strict in JSON syntax parsing.Stream wrappers now verify peer certificates and host names by default when using SSL/TLS.GMP resources are now objects.Mcrypt functions now require valid keys and IVs. For users upgrading from PHP 5.5, a full migration guide is available, detailing the changes between 5.5 and 5.6.0. For source downloads of PHP 5.6.0, please visit our downloads page. Windows binaries can be found on windows.php.net/download/. The full list of changes is available in the ChangeLog.
Categories: news, PHP

Advanced Object-Oriented Programming in PHP

PHPBuilder.com - Tue, 2014-08-26 13:48
PHP is a server side scripting language used to develop web pages. In the recent times, PHP has become popular because of its simplicity. PHP code can be combined with HTML code and once the PHP code is executed, the web server sends the resulting content in the form of HTML or images that can be interpreted by the browser. We all know the power and importance of object-oriented programming or OOP. This is a technique that is widely used in the modern programming languages.
Categories: PHP

#NoHacked: a global campaign to spread hacking awareness

Google Webmaster Central Blog - Mon, 2014-08-25 15:17
Webmaster level: All

This June, we introduced a weeklong social campaign called #NoHacked. The goals for #NoHacked are to bring awareness to hacking attacks and offer tips on how to keep your sites safe from hackers.

We held the campaign in 11 languages on multiple channels including Google+, Twitter and Weibo. About 1 million people viewed our tips and hundreds of users used the hashtag #NoHacked to spread awareness and to share their own tips. Check them out below!

Posts we shared during the campaign:
https://plus.google.com/+GoogleWebmasters/posts/1BzXjgJMGFU

https://plus.google.com/+GoogleWebmasters/posts/TMhfwQG3p8P

https://plus.google.com/+GoogleWebmasters/posts/AcUS4WhF6LL

https://plus.google.com/+GoogleWebmasters/posts/DUTpSGmkBUP

https://plus.google.com/+GoogleWebmasters/posts/UjZRbySM5gM

Some of the many tips shared by users across the globe:
  • Pablo Silvio Esquivel from Brazil recommends users not to use pirated software (source)
  • Rens Blom from the Netherlands suggests using different passwords for your accounts, changing them regularly, and using an extra layer of security such as two-step authentication (source)
  • Дмитрий Комягин from Russia says to regularly monitor traffic sources, search queries and landing pages, and to look out for spikes in traffic (source)
  • 工務店コンサルタント from Japan advises everyone to choose a good hosting company that's knowledgeable in hacking issues and to set email forwarding in Webmaster Tools (source)
  • Kamil Guzdek from Poland advocates changing the default table prefix in wp-config to a custom one when installing a new WordPress to lower the risk of the database from being hacked (source)

Hacking is still a surprisingly common issue around the world so we highly encourage all webmasters to follow these useful tips. Feel free to continue using the hashtag #NoHacked to share your own tips or experiences around hacking prevention and awareness. Thanks for supporting the #NoHacked campaign!

And in the unfortunate event that your site gets hacked, we’ll help you toward a speedy and thorough recovery:

Posted by your friendly #NoHacked helpers
Categories: sysadmin

PHP 5.5.16 is released

php.net - Fri, 2014-08-22 00:00
The PHP Development Team announces the immediate availability of PHP 5.5.16. This release fixes several bugs against PHP 5.5.15 and resolves CVE-2014-3538, CVE-2014-3587, CVE-2014-2497, CVE-2014-5120 and CVE-2014-3597. All PHP users are encouraged to upgrade to this new version.For source downloads of PHP 5.5.16, please visit our downloads page. Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.
Categories: news, PHP

PHP 5.4.32 Released

php.net - Thu, 2014-08-21 00:00
The PHP development team announces the immediate availability of PHP 5.4.32. 16 bugs were fixed in this release, including the following security-related issues: CVE-2014-2497, CVE-2014-3538, CVE-2014-3587, CVE-2014-3597, CVE-2014-4670, CVE-2014-4698, CVE-2014-5120. All PHP 5.4 users are encouraged to upgrade to this version. For source downloads of PHP 5.4.32 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.
Categories: news, PHP

PHP 5.6.0RC4 is available

php.net - Fri, 2014-08-15 00:00
The PHP development team announces the immediate availability of the fourth and hopefully last release candidate of PHP 5.6.0. As we entered the feature freeze with beta1, this is a bugfix-only release. All users of PHP are encouraged to test this version carefully, and report any bugs in the bug tracking system. THIS IS A DEVELOPMENT PREVIEW - DO NOT USE IT IN PRODUCTION! For more information about the new features you can check out the work-in-progress documentation or you can read the full list of changes in the NEWS file contained in the release archive. For source downloads of PHP 5.6.0RC4 please visit the download page. Windows binaries can be found on windows.php.net/qa/. The stable 5.6.0 release should show up on the 28th of August. Thank you for helping us make PHP better.
Categories: news, PHP

Last 5.3 release ever available: PHP 5.3.29 - 5.3 now EOL

php.net - Thu, 2014-08-14 00:00
The PHP development team announces the immediate availability of PHP 5.3.29. This release marks the end of life of the PHP 5.3 series. Future releases of this series are not planned. All PHP 5.3 users are encouraged to upgrade to the current stable version of PHP 5.5 or previous stable version of PHP 5.4, which are supported till at least 2016 and 2015 respectively.PHP 5.3.29 contains about 25 potentially security related fixes backported from PHP 5.4 and 5.5.For source downloads of PHP 5.3.29, please visit our downloads page. Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.For helping your migration to newer versions please refer to our migration guides for updates from PHP 5.3 to 5.4 and from PHP 5.4 to 5.5.
Categories: news, PHP

Valentina DB Solutions for PHP

PHPBuilder.com - Tue, 2014-08-12 16:39
Learn about all the main Paradigma Software products and how to use Valentina PHP ADK as a PHP DB solution for your applications.
Categories: PHP

Pages