geoffreywalton, on 25 December 2011, 10:57, said:
and changing application_top and login
Initially though, those shops that did not have htpasswd protection on their stores would have been vulnerable, those that did have htpasswd protection would have been protected irregardless of where the security patch was available or not (I am speaking historically here).
The fix seems to have come out by way of an upgrade of versions numbers to 2.3 however many continued to download the earlier versions not aware of the impact of such an action because it seems the mass attacks started at a later stage.
People are still downloading and installing the older versions today because those versions are still available on other websites for download or in prepackaged downloads released by freelancers.
geoffreywalton, on 25 December 2011, 10:57, said:
The point I was really making was how many people got a site that could be easily hacked because the download was not updated or the other way to let people know was to update the front splash sceen wasn't updated either.
I was not around here when the vulnerability was first known about but what I can see is that at some point the fix was put out by way of a version update from 2.2RC1a to 2.3. I would assume that the link to the earlier version should have been pulled from this site at that time, but that is only a guess.
geoffreywalton, on 25 December 2011, 10:57, said:
It would have taken less than half an hour to have done either....".
It seems again that once the update was released by way of the version update to 2.3, those users that had been hacked then either updated to 2.3 or made the executive decision to try and patch up their version 2.2RC1a sites i.e. add htpasswd to the admin, or change the admin directory name etc.
Adding to the confusion would have been a number of security addons that came out after that time proporting to patch the 2.2RC1a against the security attacks. However there is nothing in their code ( Security Pro, IP Trap, Anti-XSS ) then that could have prevented the admin login bypass, and that is still the same today.
Eventually FWR Media put out a version of its Ultimate SEO URLs addon that had a version of the 2.3 patch code for the $PHP_SELF code and users that updated that addon would have inadvertently received the benefit of having their sites partially patched against the admin login bypass exploit.
I guess my point is, things do not seem to have happened as smoothly as they should have.
geoffreywalton, on 25 December 2011, 10:57, said:
....so what chance of anyone using the ability "to notify users of urgent updates of the core code".
That is the standard now for content management systems to notify users when they log into their admin area, of any pending updates that need to be done to either the core code, addons or templates.
Once that is completely implimented (core, addons and templates notifications), then the response times will be hours rather than months if a crisis arises.
At any rate, 2.3.1 is secure enough with the htpasswd layer covering the admin directory. Although I have my reservations about using the same user and password for both the htpasswd and admin login.php, that however is another issue.
There has been
one notification of a possible security issue with 2.3.1 but that was a false alert.
0
