fly_head

Be strong, TimThumb!

by   |  August 26th, 2011
Web Development


 

 
0
 
 

There’s been lots of press about WordPress sites being compromised because of the “TimThumb vulnerability.” What’s this about and what do you need to do?


TimThumb is a is a popular script that is used by many WordPress themes and plug-ins to manipulate image files. Unfortunately the TimThumb developers left open a doorway through which hackers can insert code into WordPress template files. This code adds links to Russian sites and inserts malware to try to infect the computers of anyone who visits the infected site. Google has begun listing infected sites as malware and blocking them.


If you have a WordPress site, how do you know if it has been infected or is  vulnerable to attack?


  1. First use Sucuri to scan your website for malware. Sucuri checks 10-12 links on each site. This is sufficient if all your site pages and posts use the same template files, but if your site uses multiple templates (e.g., blog, page, home page, single-column, multi-column), make sure you scan at least one example of each template. If the scanner finds problems, follow the suggestions there.
  2. Site clean? Great — no malware has been installed. But your site may still be vulnerable to attack. The good news is that many theme and plugin developers have already updated their code. Update your theme and plugins to the latest version.
  3. Some plugins, such as the popular Verve Meta Boxes, are no longer actively supported and have not been updated. To be sure you get all copies of TimThumb updated, search the files in your plugins and themes directories for “timthumb.php.” If you find a copy that has not been updated as part of a plugin or theme update, you can replace it with a new version. Download the latest TimThumb file from http://code.google.com/p/timthumb/.
  4. Some developers have changed the name of the TimThumb file from “timthumb.php” to “thumb.php.” We recommend searching for both names, and updating all the files.


For more information on TimThumb and how to protect your site:



Note that this vulnerability is not unique to WordPress. Some Joomla and Drupal themes and plugins also use TimThumb, and all the warnings apply to them as well.


Donna McMaster

» View all posts
» View website
 
 
 


Leave a reply