It appears that there are now demonstrated exploits of PHP apps that use mt_rand() and/or rand() as a result of issues of seeding in one application affecting the PRNG stream in another application that used the PRNG to generate passwords or similar such things. From mt_srand and not so random numbers: … it is strongly [...]
¶
Posted 31 August 2008
† 2718.us
§
Web Programming
‡
°
Also tagged: /dev/random, /dev/srandom, mersenne twister, mt_rand, password, php, prng, pseudo-random number, pseudo-random number generator, pseudorandom number generator, rand, random, random number, random number generator, rng
So, as a followup to parts 1 and 2, per WordPress Trac ticket #7001, WordPress 2.6 has split up the login cookies into three parts: what was the one and only login cookie in 2.5 is now limited to /wp-admin there’s a copy of that one that’s just limited to /wp-content/plugins, for backward compatibility with [...]
¶
Posted 03 August 2008
† 2718.us
§
Web Programming
‡
°
Also tagged: 2.6, action hook, add_action, admin_cookie_path, authentication, auth_redirect, cookie, cookie path, cookie paths, COOKIEPATH, cookies, do_action, hook, is_user_logged_in, plugin, plugin api, set_auth_cookie, user, user authentication, user login, wordpress, wordpress 2.6, wp, wp2.6
Having stated the problem and now played further, I’ve got good news and bad news. The good news is that there’s an action hook, ‘set_auth_cookie’, that gets called whenever the cookies are set, so if the stuff for which you want to authenticate is on the same server but at a different path, you can [...]
¶
Posted 29 July 2008
† 2718.us
§
Web Programming
‡
°
Also tagged: 2.6, action hook, add_action, admin_cookie_path, authentication, auth_redirect, cookie, cookie path, cookie paths, cookies, do_action, hook, plugin, plugin api, set_auth_cookie, user, user authentication, user login, wordpress, wordpress 2.6, wp, wp2.6
I’ve been hoping for the last hour or two that there’d be just one post on this topic, giving the problem and solution all together, but I have yet to solve it and so I’m just going to post the issue for now, until I have a solution. As a security measure in WP2.6, login [...]
¶
Posted 29 July 2008
† 2718.us
§
Web Programming
‡
°
Also tagged: 2.6, admin_cookie_path, authentication, auth_redirect, cookie, cookie path, cookie paths, cookies, user, user authentication, user login, wordpress, wordpress 2.6, wp, wp2.6
I subscribe to a few security-alert email lists, most of which I skim and delete (since I already know that there are new fixes for multiple vulnerabilities in MS Windows and/or Office without being told and since I don’t care about issues with multi-thousand-dollar Oracle/Cisco/Sun products). It’s rare that an alert really catches my eye [...]
I’ve gotten into the habit of actually reading the various blogs to which there are links on my WordPress dashboard and I saw this today from boren.nu: To make cookies secure against attacks where someone has managed to get into your database through an SQL injection exploit or other means, WordPress 2.5 introduced a user-definable [...]
Even though the post title and first paragraph are about calling out a sound-and-fury-signifying-nothing alert, most of his post is good stuff on WordPress, with lots of links. … there is a wave of attacks going around targeting old WordPress blogs, particularly those on the 2.1 or 2.2 branch. They’re exploiting problems that have been [...]
¶
Posted 14 April 2008
† 2718.us
§
Blogging
‡
°
Also tagged: alert, false alarm, false alert, faulkner, hack, ma.tt, macbeth, shakespeare, sound and fury, sql, wordpress, wp