0-day vulnerability on WordPress 3.x (remote command execution)

nbpoole wrote: post #3

Lying about a highly dangerous 0-day in a very widely distributed piece of software seems in bad taste, even for April Fools Day.

particularly when you also implicate someone specific in the process.

Re: 0-day vulnerability on WordPress 3.x (remote command execution)

#5

Post by [deleted] » Fri, Apr 01, 2011, 12:34 PM UTC

[deleted]

Re: 0-day vulnerability on WordPress 3.x (remote command execution)

#6

Post by [deleted] » Fri, Apr 01, 2011, 12:35 PM UTC

fredoliveira wrote: post #4

nbpoole wrote: post #3

Lying about a highly dangerous 0-day in a very widely distributed piece of software seems in bad taste, even for April Fools Day.

particularly when you also implicate someone specific in the process.

[deleted]

Re: 0-day vulnerability on WordPress 3.x (remote command execution)

#7

Post by nbpoole » Fri, Apr 01, 2011, 12:36 PM UTC

fredoliveira wrote: post #4

nbpoole wrote: post #3

Lying about a highly dangerous 0-day in a very widely distributed piece of software seems in bad taste, even for April Fools Day.

particularly when you also implicate someone specific in the process.

Indeed.

The danger is that people will read "0 day" and start freaking out. If you actually read the post, you see a couple warnings signs:

1. They claim it's part of a larger conspiracy and that people should sue Automattic.

2. The "vulnerable" filename is wp-att.php, as in AT&T

3. They point out that the MD5sums to trigger this behavior come from the words "remote_control" and "nsa"

But even noticing that, I still felt the need to log in to my server and make sure the file didn't actually exist; when someone cries "0 day", it would be irresponsible of me not to, no matter how crazy they sound.

Re: 0-day vulnerability on WordPress 3.x (remote command execution)

#8

Post by [deleted] » Fri, Apr 01, 2011, 12:37 PM UTC

[deleted] wrote: post #6

fredoliveira wrote: post #4

Earlier quoted context omitted.

particularly when you also implicate someone specific in the process.

[deleted]

[deleted]

Re: 0-day vulnerability on WordPress 3.x (remote command execution)

#9

Post by nhoss2 » Fri, Apr 01, 2011, 12:37 PM UTC

[deleted] wrote: post #6

fredoliveira wrote: post #4

Earlier quoted context omitted.

particularly when you also implicate someone specific in the process.

[deleted]

There is no wp-att.php ;)

Re: 0-day vulnerability on WordPress 3.x (remote command execution)

#10

Post by mikecane » Fri, Apr 01, 2011, 12:38 PM UTC

OK, if that was April Fool's, it's in very, very bad taste. People like me who aren't hackers or technically savvy will take it seriously. I tweeted it around. At the end they could have at least said April Fools, FFS!