Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica) [LWN.net]

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 0:04 UTC (Wed) by bmur (guest, #52954)
In reply to: Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica) by ballombe
Parent article: Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Asking if wordpress needs an admin account is like asking if linux needs a root user. I'm not sure what your point is.

In wordpress it's possible to setup author & editor level accounts for posting if you wish.

To your other comment about browser security. It's pretty common for client/server apps that security of the client plays a large role in security to the server.

to post comments

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 11:33 UTC (Wed) by oldtomas (guest, #72579) [Link] (2 responses)

> To your other comment about browser security. It's pretty common for client/server apps that security of the client plays a large role in security to the server.

But this is exactly the problem. The very idea that a "document" can take total control of your document viewer (or put in another way: the idea that I have an application which downloads and executes random content from the Intarwebs) should stick out as a "very bad idea" -- this painful experience was made long time ago (remember Word macro viruses?).

A site (and especially the admin endpoint of a site) should offer basic usability without any client-side scripting whatsoever, so that a user (and especially an admin) should be able to disable client-side scripting if she choses to do so.

With HTML5 this ship is sailing away quickly. But any other fixes (server-side XSS protections, sandboxing in the clients, selective script execution à la Noscript) are bound to show cracks at ever-changing unexpected places.

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 17:32 UTC (Wed) by raven667 (subscriber, #5198) [Link] (1 responses)

I think that web sites have stopped being "documents" and are in fact client/server applications for a long time now, like since Netscape 2, that ship has sailed and sent postcards from the other shore. The fact that the web is primarily an application delivery platform, with document viewing being a built-in application, was a major goal from the outset in the 1990s and is why vendors like MS were so scared, that most things would move into web apps (like it has done now) and they would be left without any leverage in the market (which they kind of don't have now).

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Dec 11, 2014 2:54 UTC (Thu) by Baylink (guest, #755) [Link]

Certainly, but I believe you've misunderstood the assertion.

It is not that websites shouldn't *be* code.

It's that they shouldn't *run* code provided to them through their public user interfaces (probably "whether authenticated or not").

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 15:38 UTC (Wed) by ballombe (subscriber, #9523) [Link] (1 responses)

> Asking if wordpress needs an admin account is like asking if linux needs a root user. I'm not sure what your point is.

You should be able to perform admin task without a web browser.

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 23:22 UTC (Wed) by dlang (guest, #313) [Link]

> You should be able to perform admin task without a web browser.

Ok, so you are saying that the wordpress users need to be taught how to ssh into a server to make changes to their config.

Can you see how this could be a problem for windows users?

Can you see how allowing $randon_internet_user shell access on a shared server would be even more dangerous than them using a browser to administer their site?

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 23:48 UTC (Wed) by iabervon (subscriber, #722) [Link]

Actually, WordPress doesn't have the equivalent of a root account; instead, some users simply have admin privileges while they ordinarily use the site. This hole wouldn't have been possible if you couldn't simultaneously have the ability to read posts and the authorization to do administrative tasks. (Or, rather, it would have been limited to author/editor-type impact.)