Timthumb Vulnerability for Possible Server exploit
The other day I was installing a theme for one of our wordpress sites and I got the following email from our host ….
”
Dear customer,This is a courtesy notice that we have found and corrected exploitable timthumb.php file(s) on your _____.com account, which are listed below. While we have corrected these files, we do recommend you ensure all potential exploits are corrected on your account. This is best done by updating all scripts, plugins, modules and themes on your account to the latest version…….
The timthumb.php file is a script commonly used in WordPress’s (and other software’s) themes and plugins to resize images. The exploit allows an attacker to arbitrarily upload and create files and/or folders on your account, which can then be used for a number of malicious tasks, including but not limited to defacement, browser high-jacking and infection, data harvesting and more. After a site has been exploited, it may lead to becoming labeled a “Malicious Website” by Google or other security authorities.Any timthumb.php file below version 1.35, but above version 1.09 is considered vulnerable, unless patched. To prevent being compromised, we advise you update all instances of timthumb.php to version 2.0, or patch the existing vulnerable files. Note that patching the files requires more in-depth knowledge of the PHP scripting language.
The updated version of timthumb.php can be found here:
http://timthumb.googlecode.com/svn/trunk/timthumb.php
Additional information regarding the compromise can be found at the following two websites, as well as others; ….
http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many-wordpress-themes/
http://redleg-redleg.blogspot.com/2011/08/malware-hosted-newportalsecom.html
“
You actually just have to update your timthumb.php file by replacing it with the one from the link provided above
This must have been an old vulnerability but for those who have downloaded WordPress themes that were using the problematic version, then this article could most certainly help them with their security as did mine.
timthumb.php script is a very great php script and I like using it. Used it to most sites(if not all) I helped create. For more detailed information about the script visit the project’s website at
http://www.binarymoon.co.uk/projects/timthumb/