1 Topic by zy

  • zy
  • zy
  • Theme Author
  • Offline
  • From: Singapore
  • Registered: 2009-12-29
  • Posts: 588
  • User Karma: 43

Topic: Zero Day Vulnerability in timthumb script

There have been reports that versions prior to 1.3.4 of timthumb script have a serious security vulnerability that allows hackers to access sensitive information from your web server via the script.

http://markmaunder.com/2011/zero-day-vu … ss-themes/

As such, it is HIGHLY RECOMMENDED that you update the timthumb script to its latest version to fix the security hole.

Two ways to patch the theme for timthumb:

1. Download timthumb and overwrite the file at /wp-content/themes/arras/library/timthumb.php:
http://timthumb.googlecode.com/svn/trunk/timthumb.php

2. If you are not using timthumb as your primary thumbnail management method, you can simply replace timthumb.php with a blank file.

3. Download Arras 1.5.1.2 with TimThumb functionality removed:
http://arras-theme.googlecode.com/files … mthumb.zip

There may be plans to remove timthumb support for the next major version of the theme, in favour of WordPress' built-in post thumbnail system. I'll give more details about it in the next future.

Last edited by zy (2011-09-26 19:44:04)

Twitter | Blog

zy's Website

Thumbs up

  • Registered: 2011-01-12
  • Posts: 4

Re: Zero Day Vulnerability in timthumb script

Thank you so much for posting this. Just saw the security release about it and came to send a message to you all. Good work, devs, at being quick to fix this issue. smile

Thumbs up

  • Registered: 2011-07-08
  • Posts: 3

Re: Zero Day Vulnerability in timthumb script

Thanks for acting early and the heads up! I saw a message elsewhere, but didn't realize it applied to me!  cool

Thumbs up

  • Registered: 2011-05-31
  • Posts: 12
  • User Karma: 2

Re: Zero Day Vulnerability in timthumb script

zy wrote:

There have been reports that versions prior to 1.3.4 of timthumb script have a serious security vulnerability that allows hackers to access sensitive information from your web server via the script.

http://markmaunder.com/2011/zero-day-vu … ss-themes/

As such, it is HIGHLY RECOMMENDED that you update the timthumb script to its latest version to fix the security hole.

Two ways to patch the theme for timthumb:

1. Download timthumb 1.3.4 and overwrite the file at /wp-content/themes/arras/library/timthumb.php:
http://timthumb.googlecode.com/svn/trunk/timthumb.php

2. Download and update Arras to 1.5.1.2, which has the latest version of timthumb:
http://www.arrastheme.com/forums/post29318.html#p29318

There may be plans to remove timthumb support for the next major version of the theme, in favour of WordPress' built-in post thumbnail system. I'll give more details about it in the next future.

--------
Is it better to remove the array entirely ? as some reports have noted... from


$allowedSites = array (
    'flickr.com',
    'picasa.com',
    'img.youtube.com',
    'upload.wikimedia.org',
);

// STOP MODIFYING HERE!
// --------------------

to

$allowedSites = array ( );

// STOP MODIFYING HERE!
// --------------------


Also it seems like later comments suggest that using WP core to do this rather than keeping tomthumb is a very good idea (so any plans to move in that direction?)

http://codex.wordpress.org/Function_Ref … image_size

Last edited by dialogcrm (2011-08-02 22:54:47)

Thumbs up

5 Reply by zy

  • zy
  • zy
  • Theme Author
  • Offline
  • From: Singapore
  • Registered: 2009-12-29
  • Posts: 588
  • User Karma: 43

Re: Zero Day Vulnerability in timthumb script

dialogcrm wrote:
zy wrote:

There have been reports that versions prior to 1.3.4 of timthumb script have a serious security vulnerability that allows hackers to access sensitive information from your web server via the script.

http://markmaunder.com/2011/zero-day-vu … ss-themes/

As such, it is HIGHLY RECOMMENDED that you update the timthumb script to its latest version to fix the security hole.

Two ways to patch the theme for timthumb:

1. Download timthumb 1.3.4 and overwrite the file at /wp-content/themes/arras/library/timthumb.php:
http://timthumb.googlecode.com/svn/trunk/timthumb.php

2. Download and update Arras to 1.5.1.2, which has the latest version of timthumb:
http://www.arrastheme.com/forums/post29318.html#p29318

There may be plans to remove timthumb support for the next major version of the theme, in favour of WordPress' built-in post thumbnail system. I'll give more details about it in the next future.

--------
Is it better to remove the array entirely ? as some reports have noted... from


$allowedSites = array (
    'flickr.com',
    'picasa.com',
    'img.youtube.com',
    'upload.wikimedia.org',
);

// STOP MODIFYING HERE!
// --------------------

to

$allowedSites = array ( );

// STOP MODIFYING HERE!
// --------------------


Also it seems like later comments suggest that using WP core to do this rather than keeping tomthumb is a very good idea (so any plans to move in that direction?)

http://codex.wordpress.org/Function_Ref … image_size

You can remove the array as well if you don't intend to link images from external allowed sites like those above, though I would highly recommend it if you don't use timthumb at all.

Arras already supports built-in thumbnails since 1.5, but the timthumb feature is still available for users who wish to continue using it.

Twitter | Blog

zy's Website

Thumbs up

  • Registered: 2011-05-31
  • Posts: 12
  • User Karma: 2

Re: Zero Day Vulnerability in timthumb script

OK - thanks - none of my sites use the tim thumb feature so removing it entirely for now

John Ford also recommends removing it entirely if it is not being used
http://blog.vaultpress.com/2011/08/02/v … -timthumb/

Thumbs up

  • Registered: 2011-07-31
  • Posts: 2

Re: Zero Day Vulnerability in timthumb script

I just flat-out deleted it.

Amazing theme, BTW and thanks for the update!  big_smile

Thumbs up

  • From: NL
  • Registered: 2010-12-30
  • Posts: 207
  • User Karma: 13

Re: Zero Day Vulnerability in timthumb script

thanks for the warning and fix hints! Updated right away

All You Need Is Lists - Powered by Arras Theme

duckbilljones's Website

Thumbs up

  • Registered: 2011-07-24
  • Posts: 1

Re: Zero Day Vulnerability in timthumb script

thank u for sharing this warning.. it can really helps a lot..

Thumbs up

10 Reply by kdw

  • kdw
  • Member
  • Offline
  • Registered: 2010-06-01
  • Posts: 3

Re: Zero Day Vulnerability in timthumb script

Hi,

still using Arras 1.3.6 for now (upgrade is planned, but not immediately possible), and our site was impacted.
We have updated to the new timthumb.php, but now the post images / post thumbnails do no longer show up.
Is there an incompatibility between arras 1.3.6 and the latest timthumb? Any possible quick fix?
Thanks a lot.

<update> seems to have fixed itself after a while

Last edited by kdw (2011-08-20 09:13:18)

Thumbs up

  • Registered: 2011-09-21
  • Posts: 4

Re: Zero Day Vulnerability in timthumb script

My hosting provider had fortunaltely put offline my website yesterday. It was due to this vunerability. I've found it while running the plugin "Explot Scanner".
With the new version of timthumb.php, there is still a severe Warning. Is it really safe to use it ?

wp-content/themes/arras/library/timthumb.php:208
Used by malicious scripts to decode previously obscured data/programs    $imgData = base64_decode("R0lGODlhUAAMAIAAAP8AAP///yH5BAAHAP8ALAAAA

Last edited by libretto (2011-09-21 16:03:23)

Thumbs up

  • Registered: 2010-01-02
  • Posts: 2,038
  • User Karma: 84

Re: Zero Day Vulnerability in timthumb script

Just curious.

Are you using the latest version of Arras or have you manually updated the timthumb security file as indicated in the opening post?

Learn CSS | Firebug | My Arras Solutions
Profane Entertainment | Dev/Testing Site
Donate to Arras | Donate To Me

dgodfather's Website

Thumbs up

  • Registered: 2011-09-21
  • Posts: 4

Re: Zero Day Vulnerability in timthumb script

@dgodfather : I've manually updated timthumb.php

This may not be a problem, here is the source cod from timthunb.php :

if(BLOCK_EXTERNAL_LEECHERS && array_key_exists('HTTP_REFERER', $_SERVER) && (! preg_match('/^https?:\/\/(?:www\.)?' . $this->myHost . '(?:$|\/)/i', $_SERVER['HTTP_REFERER']))){
            // base64 encoded red image that says 'no hotlinkers'
            // nothing to worry about! smile
            $imgData = base64_decode("R0lGODlhUAAMAIAAAP8AAP///yH5BAAHAP8ALAAAAABQAAwAAAJpjI+py+0Po5y0OgAMjjv01YUZ\nOGplhWXfNa6JCLnWkXplrcBmW+spbwvaVr/cDyg7IoFC2KbYVC2NQ5MQ4ZNao9Ynzjl9ScNYpneb\nDULB3RP6JuPuaGfuuV4fumf8PuvqFyhYtjdoeFgAADs=");

Last edited by libretto (2011-09-22 04:58:36)

Thumbs up

14 Reply by zy

  • zy
  • zy
  • Theme Author
  • Offline
  • From: Singapore
  • Registered: 2009-12-29
  • Posts: 588
  • User Karma: 43

Re: Zero Day Vulnerability in timthumb script

@libretto: if you do not need timthumb you can simply replace timthumb.php with a blank file. The theme should still work.

Twitter | Blog

zy's Website

Thumbs up

  • From: VietNam
  • Registered: 2011-09-24
  • Posts: 1

Re: Zero Day Vulnerability in timthumb script

thanks so much

Thumbs up

16 Reply by zy

  • zy
  • zy
  • Theme Author
  • Offline
  • From: Singapore
  • Registered: 2009-12-29
  • Posts: 588
  • User Karma: 43

Re: Zero Day Vulnerability in timthumb script

Updated first post with new option and added new link for Arras 1.5.1.2 with TimThumb functionality removed.

Twitter | Blog

zy's Website

Thumbs up

  • Registered: 2011-04-05
  • Posts: 54

Re: Zero Day Vulnerability in timthumb script

ignitionsix wrote:

I just flat-out deleted it.

Amazing theme, BTW and thanks for the update!  big_smile

Amen to that - I just deleted the file prior to install.
big_smile

Thumbs up

  • Meet
  • Member
  • Offline
  • Registered: 2011-11-21
  • Posts: 1

Re: Zero Day Vulnerability in timthumb script

Hi,

Thanks a lot for providing the information related to the vulnerability.

Regards
Meet
iPhone Cases

Thumbs up

  • Registered: 2011-10-02
  • Posts: 2

Re: Zero Day Vulnerability in timthumb script

zy wrote:

@libretto: if you do not need timthumb you can simply replace timthumb.php with a blank file. The theme should still work.

Thanks for the help zt smile marijuana seeds for sale weed seeds for sale

Thumbs up

  • Registered: 2011-12-01
  • Posts: 1

Re: Zero Day Vulnerability in timthumb script

1.3.4 of timthumb script have a serious security vulnerability HEARED. but how can we get rid of this security problem

Thumbs up

  • Registered: 2010-01-02
  • Posts: 2,038
  • User Karma: 84

Re: Zero Day Vulnerability in timthumb script

The latest version of the theme has it removed. See the opening post.

Learn CSS | Firebug | My Arras Solutions
Profane Entertainment | Dev/Testing Site
Donate to Arras | Donate To Me

dgodfather's Website

Thumbs up

  • Registered: 2011-12-01
  • Posts: 3

Re: Zero Day Vulnerability in timthumb script

D'oh i was wondering the same.. hadn't noticed that either smile pot seeds cannabis seedS for sale

Thumbs up