サービス不能状態や任意のコードが実行されてしまう様なコトになる前に、ソース管理に気をつけよう

1. @ryo_apejp

2. timthumb.php
chrome
google
timthumb.php

3. WordPress
wp-config.php
Cleaning Up the TimThumb Hack | WP Theming

4. “wordpress.org”
■ WordPress › Support » Google issuing warnings about WP site: “content
■ from counter-wordpress.com”?
■ WordPress › Support » [TimThumb Vulnerability] iframe hack
”timthumb.php”
■ timthumb – image crop zoom resize management – Google Project Hosting
■ WPZOOM Support Forum – View topic – [Updated] IMPORTANT Security Fix

5. Make sure this constant is set to false:
define( 'ALLOW_EXTERNAL', false );
Before:
$allowedSites = array (
! 'flickr.com',
! 'picasa.com',
! 'img.youtube.com',
! 'upload.wikimedia.org',
);
After:
$allowedSites = array();
Theme and plugin authors should use the built-in WordPress functions such asadd_image_size to resize images.
Vulnerability Found in timthumb.php | VaultPress Blog

6. ◦
◦
•
• grep
•
◦ JPCERT Adobe Reader Acrobat
https://www.jpcert.or.jp/at/2012/at120003.html
◦ JPCERT/CC
•
•

7. WordPress Timthumb
Timthumb Vulnerability Scanner for WordPress