SPIP Security Alert + new version SPIP 2.0.9

(from an alert posted on “spip-ann” mailing list)

Hello,

A big security issue has just been discovered : this issue affects all SPIP versions from 2.0.x to 2.0.8, the branch 1.9 is also affected. This breach lets a hacker with no password at all, to take control on the SPIP website and on the web server.

This alert is to be taken seriously, as it has not been discovered by someone “nice” but by a real “naughty one” who took control on an existing website in order to insert malwares on it.

Corrections :

We publish today 2 new maintenance versions for SPIP, which fix this issue :

  • SPIP 2.0.9, latest official and stable version, which offers the fix and a list of improvments listed below.
  • SPIP 1.9.2i, maintenance version for the branch 1.9.2

Download them at : http://files.spip.org/spip/stable/

or, if you wish to use spip_loader : http://xxx.example.tld/spip_loader.php

For security specialists, the lone security patch, which corrects nothing else but the issue and does not bring any other improvment, can be found at :
http://fil.rezo.net/secu-14346-14350+14354.patch
Check revisions [14347] [14348] [14349] [14350] and [14354].

For the branch 1.9.2x patch is available there :
http://trac.rezo.net/trac/spip/changeset/14354/branches/spip-1.9.2

Security Screen :

If you have no way to upgrade completely at once, we suggest you to fix the breach as soon as possible by installing on your SPIP website the “security screen”. You can discover this at :
http://www.spip.net/fr_article4200.html (Fr.)

This “screen” lets you block certain attacks without the need of upgrading SPIP.

Credits :

This issue was found and analysed by Thomas Sutton et Pierre Rousset.

We also feel free to remind you that, the best way to let us know about a security issue with SPIP is to send a mail at spip-team [AT] rezo.net

Discussion

No discussion

Add a comment

Avant de faire part d’un problème sur un plugin X, merci de lire ce qui suit :

  • Désactiver tous les plugins que vous ne voulez pas tester afin de vous assurer que le bug vient bien du plugin X. Cela vous évitera d’écrire sur le forum d’une contribution qui n’est finalement pas en cause.
  • Cherchez et notez les numéros de version de tout ce qui est en place au moment du test :
    • version de SPIP, en bas de la partie privée
    • version du plugin testé et des éventuels plugins nécessités
    • version de PHP (exec=info en partie privée)
    • version de MySQL / SQLite / PostgreSQL
  • Si votre problème concerne la partie publique de votre site, donnez une URL où le bug est visible, pour que les gens puissent voir par eux-mêmes.
  • En cas de page blanche, merci d’activer l’affichage des erreurs, et d’indiquer ensuite l’erreur qui apparait.

Merci d’avance pour les personnes qui vous aideront !

Par ailleurs, n’oubliez pas que les contributeurs et contributrices ont une vie en dehors de SPIP.

Who are you?
[Log in]

To show your avatar with your message, register it first on gravatar.com (free et painless) and don’t forget to indicate your Email addresse here.

Enter your comment here

This form accepts SPIP shortcuts {{bold}} {italic} -*list [text->url] <quote> <code> and HTML code <q> <del> <ins>. To create paragraphs, just leave empty lines.

Add a document

Follow the comments: RSS 2.0 | Atom