Test ID:	1.3.6.1.4.1.25623.1.0.60436
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-1502-1)
Summary:	The remote host is missing an update for the Debian 'wordpress' package(s) announced via the DSA-1502-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'wordpress' package(s) announced via the DSA-1502-1 advisory. Vulnerability Insight: Several remote vulnerabilities have been discovered in wordpress, a weblog manager. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2007-3238 Cross-site scripting (XSS) vulnerability in functions.php in the default theme in WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the PATH_INFO (REQUEST_URI) to wp-admin/themes.php. CVE-2007-2821 SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter. CVE-2008-0193 Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php. CVE-2008-0194 Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read arbitrary files, delete arbitrary files, and cause a denial of service via a .. (dot dot) in the backup parameter in a wp-db-backup.php action to wp-admin/edit.php. Wordpress is not present in the oldstable distribution (sarge). For the stable distribution (etch), these problems have been fixed in version 2.0.10-1etch1. We recommend that you upgrade your wordpress package. Affected Software/OS: 'wordpress' package(s) on Debian 4. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2007-2821 BugTraq ID: 24076 http://www.securityfocus.com/bid/24076 Bugtraq: 20070521 [waraxe-2007-SA#050] - Sql Injection in WordPress 2.1.3 (Google Search) http://www.securityfocus.com/archive/1/469258/100/0/threaded Debian Security Information: DSA-1502 (Google Search) http://www.debian.org/security/2008/dsa-1502 http://www.exploit-db.com/exploits/3960 http://www.waraxe.us/advisory-50.html http://osvdb.org/36311 http://secunia.com/advisories/25345 http://secunia.com/advisories/29014 http://www.vupen.com/english/advisories/2007/1889 XForce ISS Database: wordpress-adminajax-sql-injection(34399) https://exchange.xforce.ibmcloud.com/vulnerabilities/34399 Common Vulnerability Exposure (CVE) ID: CVE-2007-3238 BugTraq ID: 25161 http://www.securityfocus.com/bid/25161 Bugtraq: 20070608 Wordpress default theme XSS (admin) and other problems (Google Search) http://www.securityfocus.com/archive/1/470837/100/0/threaded http://blogsecurity.net/wordpress/news/news-100607-1/ http://codex.wordpress.org/Roles_and_Capabilities http://mybeni.rootzilla.de/mybeNi/2007/wordpress_zeroday_vulnerability_roundhouse_kick_and_why_i_nearly_wrote_the_first_blog_worm/ http://www.xssnews.com/ http://osvdb.org/37293 http://secunia.com/advisories/25541/ http://securityreason.com/securityalert/2807 XForce ISS Database: wordpress-themes-xss(34785) https://exchange.xforce.ibmcloud.com/vulnerabilities/34785 Common Vulnerability Exposure (CVE) ID: CVE-2008-0193 BugTraq ID: 27123 http://www.securityfocus.com/bid/27123 Bugtraq: 20080103 securityvulns.com russian vulnerabilities digest (Google Search) http://www.securityfocus.com/archive/1/485786/100/0/threaded http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html http://securityvulns.ru/Sdocument755.html http://websecurity.com.ua/1676/ http://securityreason.com/securityalert/3539 Common Vulnerability Exposure (CVE) ID: CVE-2008-0194
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.