Description
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 2.5.0-1 | — |
| Debian 13 | wordpress | 2.5.0-1 | — |
| Debian 12 | wordpress | 2.5.0-1 | — |
References
- 20071119 Wordpress Cookie Authentication Vulnerability mailing-list
- FEDORA-2008-0126 vendor-advisory
- http://www.cl.cam.ac.uk/~sjm217/advisories/wordpress-cookie-auth.txt
- http://trac.wordpress.org/ticket/5367
- 3375 third-party-advisory
- 20071119 Wordpress Cookie Authentication Vulnerability mailing-list
- ADV-2007-3941 vdb-entry
- wordpress-password-weak-security(38578) vdb-entry
- 28310 third-party-advisory
- 1018980 vdb-entry
- 40801 vdb-entry
- FEDORA-2008-0103 vendor-advisory
- 27714 third-party-advisory