升级到 WordPress 2.8.6
从 WordPress 官方开发日志了解到，这次主要修复两个安全问题：
2.8.6 fixes two security problems that can be exploited by registered, logged in users who have posting privileges.
其中一个漏洞为“Press This”的XSS弱点攻击，另一个为在特定Apache配置环境下上传的文件名可能被利用，导致php代码在上传目录执行（翻译的不知道有没有问题，感觉怪怪的！）！
还是看下原文吧：
The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch. The second problem, discovered by Dawid Golunski, is an issue with sanitizing uploaded file names that can be exploited in certain Apache configurations.
官方建议：若你对博客下注册的用户(作者)不是很信任，那么就更新到 2.8.6 。
这次打包的日期是20091113日，修改的文件列表为：
│ readme.html
│
├─wp-admin
│ press-this.php
│
├─wp-content
│ └─plugins
│ └─akismet
│ akismet.php
│ readme.txt
│
└─wp-includes
│ formatting.php
│ functions.php
│ version.php
│
└─js
└─swfupload
└─plugins
swfupload.speed.js
最新的文件修改日期为20091112，打包日期为20091113。
16日更新：
WordPress 2.8.5 任意文件上传漏洞，导致php代码可能被执行
比如
test-image.php.jpg
包含以下代码
<?php phpinfo(); ?>
上传之后，访问“图片”文件链接，可看到 php info 的执行结果。
间接的防御办法可在上传目录下(wordpress/wp-content/uploads)建一个 .htaccess 文件，内容如下：
deny from all <Files ~ "^\w+\.(gif|jpe?g|png|avi)$"> order deny,allow allow from all </Files>
参考：http://clin003.com/wp-use/learning-wordpress-security-whitepaper-1438/
.php.jpg 这样的扩展名中的php代码可能被执行和apache支持多扩展名的有一定关系，下面引用一段 Apache docs 中的介绍：
Files can have more than one extension, and the order of the extensions is normally irrelevant.
For example, if the file welcome.html.fr maps onto content type text/html and language French then
the file welcome.fr.html will map onto exactly the same information. If more than one extension is
given that maps onto the same type of meta-information, then the one to the right will be used,
except for languages and content encodings. For example, if .gif maps to the MIME-type image/gif
and .html maps to the MIME-type text/html, then the file welcome.gif.html will be associated with
the MIME-type text/html.Care should be taken when a file with multiple extensions gets associated with both a MIME-type
and a handler. This will usually result in the request being handled by the module associated with
the handler. For example, if the .imap extension is mapped to the handler imap-file
(from mod_imagemap) and the .html extension is mapped to the MIME-type text/html, then the file
world.imap.html will be associated with both the imap-file handler and text/html MIME-type.
When it is processed, the imap-file handler will be used, and so it will be treated as a
mod_imagemap imagemap file.
参考：http://httpd.apache.org/docs/2.2/mod/mod_mime.html#multipleext
。
新鲜评论