Recently, Automattic issued an update for WordPress, the popular online blogging and publishing platform. The latest version, WordPress 3.1.3 has fixed multiple security vulnerabilities. Security flaws addressed in the latest version of the blogging platform are associated with security hardening, taxonomy query, file upload security, media security, and clickjacking. The latest version also mitigates vulnerabilities, which cause leakage of user names of non-authors.
In case of clickjacking, attackers place a fake button behind a genuine button on a legitimate site. When users click on the genuine button, they also inadvertently trigger the hidden button related to a third-party site. Attackers aim to exploit Adobe Flash and javascript vulnerabilities of web browsers through clickjacking.
Vulnerability in file upload mechanism results in improper validation of uploaded files. The flaw could cause attackers to upload .phtml file appended with dangerous file extensions. Successful exploitation of the vulnerability may cause cross-site scripting, allow unauthorized access to system information, and enable remote attackers to gain control of a computer system. The vulnerability was identified by security firm Secunia and affects WordPress 3.1.2.
The latest version also cleans up old import files, if import fails to finish. Security researchers have advised publishers to immediately upgrade to the latest version, to avoid exploitation of security flaws in the earlier versions. Web-application vulnerabilities are one of the popular targets for cybercriminals. Publishers must keep track of security advisories and guidelines, and update to latest platforms. In-house security researchers, professionals qualified in penetration testing, masters of security science, independent security experts or other developers often detect vulnerabilities. In this case, researchers Alexander Concha, John Lamansky, and experts affiliated to Microsoft identified security flaws in WordPress. Authors, and publishers may update themselves on security threats and information security practices through security blogs, online tutorials, and e-learning and online degree programs.
Automattic also released WordPress 3.2 Beta 2. The developer plans to deliver the final release of WordPress 3.2 by the end of June. The latest Beta version comes with new features such as support for Google Chrome Frame in admin and improvised admin for Internet Explorer 7 among others.
The popularity and growing use of web publishing and blogging platforms make them susceptible to intrusion attempts from cybercriminals. Associated databases of the platforms contain sensitive information such as names, author profiles, addresses, e-mail addresses, and login credentials. Use of unique and different login credentials is crucial to ensure data security. Internet users must adhere to security and software updates, and browser updates. They must use strong and unique passwords. They must adhere to cyber security tips to safeguard their computer systems and data from sophisticated Internet-based attacks. Attackers may also gain access to copyright protected information. Regular in-depth security tests of web applications and platforms are crucial to prevent security and data breach incidents.
The vibrant security threats have made it inevitable for security professionals to update themselves on latest developments by participating in security conferences, seminars, and improve their technical expertise by undertaking online university degree courses and security certifications.
Contact Press
EC-Council
Website: http://www.eccuni.us
Email: [email protected]
Tel: 505-341-3228
EC-Council University is based in Albuquerque, New Mexico and offers Master of Security Science (MSS) degree to students from various backgrounds such as graduates, IT Professionals, and military students amongst several others. The MSS is offered as a 100% online degree program and allows EC-Council University to reach students from not only the United States, but from all around the world.
EC-Council is a member-based organization that certifies individuals in cybersecurity and e-commerce skills. It is the owner and developer of 16 security certifications, including Certified Ethical Hacker (CEH), Computer Hacking Forensics Investigator (CHFI) and EC-Council Certified Security Analyst (ECSA)/License Penetration Tester (LPT). Its certificate programs are offered in over 60 countries around the world.
EC-Council has trained over 80,000 individuals and certified more than 30,000 members, through more than 450 training partners globally. These certifications are recognized worldwide and have received endorsements from various government agencies including the U.S. federal government via the Montgomery GI Bill, Department of Defense via DoD 8570.01-M, National Security Agency (NSA) and the Committee on National Security Systems (CNSS). EC-Council also operates the global series of Hacker Halted security conferences.
