Description
vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP header, which vars.php uses to redefine $_SERVER['REMOTE_ADDR'].
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 2.0.3-1 | — |
| Debian 13 | wordpress | 2.0.3-1 | — |
| Debian 12 | wordpress | 2.0.3-1 | — |
References
- 20271 third-party-advisory
- ADV-2006-1992 vdb-entry
- 25935 vdb-entry
- wordpress-pcremoteaddr-ip-spoofing(26688) vdb-entry
- 20608 third-party-advisory
- GLSA-200606-08 vendor-advisory
- http://retrogod.altervista.org/wordpress_202_xpl.html
- 20060525 Wordpress <=2.0.2 'cache' shell injection mailing-list