- Messages
- 1,069
- Name
- Carl Davis
- Edit My Images
- Yes
This is copied from another forum but thought it was worth bringing to people attention
"Whilst it's not WordPress Core issue as such, it's been used by many theme designers over the years and has been banned from usage in the WP Theme Repositary but still heavily used in third party premium themes. TimThumb is a dynamic image resizer that's heavily used in both and premium themes, if you have a theme that uses it then update now. The problem has now expanded to include plug-ins and anything else that uses this script. If you don't know how to check or update find someone who can, this is now being used in the wild.
This problem is rapidly becoming the biggest security nightmare this year with the number of outdated scripts out there you can probably expect to see a lot of SEO poisoning over the next few months along the lines of what took out OSX/Windows with Google image search. Currently they're doing a number of attacks but doesn't take much imagination to see where this could go. To give you an idea of the potential scale of the problem WordPress currently powers about 25% of the websites you visit.
Sucuri has a good write up:
http://blog.sucuri.net/2011/08/timthumb-php-security-vulnerability-just-the-tip-of-the-iceberg.html
http://blog.sucuri.net/2011/08/timthumb-security-vulnerability-list-of-themes-including-it.html
http://blog.sucuri.net/2011/08/atta...list-of-themes-and-plugins-being-scanned.html
You will find many photography 'folio and image based blogs will use this script and there is updated versions from WP themselves to help secure but TimThumb has been the source of so much security issues it's better to see if you can find a theme that can work without it. Hopefully When WP 3.3 is released in November and does include the new dynamic resizing feature then this problem will decrease."
"Whilst it's not WordPress Core issue as such, it's been used by many theme designers over the years and has been banned from usage in the WP Theme Repositary but still heavily used in third party premium themes. TimThumb is a dynamic image resizer that's heavily used in both and premium themes, if you have a theme that uses it then update now. The problem has now expanded to include plug-ins and anything else that uses this script. If you don't know how to check or update find someone who can, this is now being used in the wild.
This problem is rapidly becoming the biggest security nightmare this year with the number of outdated scripts out there you can probably expect to see a lot of SEO poisoning over the next few months along the lines of what took out OSX/Windows with Google image search. Currently they're doing a number of attacks but doesn't take much imagination to see where this could go. To give you an idea of the potential scale of the problem WordPress currently powers about 25% of the websites you visit.
Sucuri has a good write up:
http://blog.sucuri.net/2011/08/timthumb-php-security-vulnerability-just-the-tip-of-the-iceberg.html
http://blog.sucuri.net/2011/08/timthumb-security-vulnerability-list-of-themes-including-it.html
http://blog.sucuri.net/2011/08/atta...list-of-themes-and-plugins-being-scanned.html
You will find many photography 'folio and image based blogs will use this script and there is updated versions from WP themselves to help secure but TimThumb has been the source of so much security issues it's better to see if you can find a theme that can work without it. Hopefully When WP 3.3 is released in November and does include the new dynamic resizing feature then this problem will decrease."