Wordpress on System Overlord

[CVE-2014-5204] Wordpress nonce Issues

david@systemoverlord.com (David Tomaschik) — Wed, 10 Sep 2014 22:54:52 +0000

Wordpress 3.9.2, released August 6th, contained fixes for two closely related vulnerabilities (CVE-2014-5204) in the way it handles Wordpress nonces (CSRF Tokens, essentially) that I reported to the Wordpress Security Team. I’d like to say the delay in my publishing this write-up was to allow people time to patch, but the reality is I’ve just been busy and haven’t gotten around to this.

TL;DR: Wordpress < 3.9.2 generated nonces in a manner that would allow an attacker to generate valid nonces for other users for a small subset of possible actions. Additionally, nonces were compared with ==, leading to a timing attack against nonce comparison. (Although this is very difficult to execute.)

Welcome (back) to Drupal!

david@systemoverlord.com (David Tomaschik) — Wed, 23 Mar 2011 01:21:23 +0000

Regular readers of my blog may have noticed a significant change. As of about midnight last night, I had completed the migration of my site from Wordpress 3.1 to Drupal 7. A few features are not yet implemented, including automatically posting my blog entries to Twitter, but the RSS feeds do work. Additionally, some of the RSS feed URLs have changed, so please check your feed readers.

Welcome to Nginx!

david@systemoverlord.com (David Tomaschik) — Sun, 23 Jan 2011 17:49:21 +0000

If you're reading this, it's thanks to Nginx. As of about midnight last night, all content on SystemOverlord.com is being served up by Nginx. I did this for two reasons: Nginx has a much smaller memory profile than Apache, which is important when running on a 512MB VPS, and Nginx's preferred PHP path is through a FastCGI interface, which allows me to run separate PHP FastCGIs under different users for each application on my server. Privilege separation for different webapps has always been a big thing security-wise, and I'm glad I was able to get it going with a minimum of fuss. Wordpress, Nginx, MySQL, and Ubuntu Server powered, all on a Linode VPS!