The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."

Update spans MU-versions for the following security releases from upstream:
http://wordpress.org/development/2009/08/2-8-4-security-release/ http://wordpress.org/development/2009/08/wordpress-2-8-3-security-rele ase/

  - Backport of XSS fixes from WordPress 2.8.2 * Backport of     security fixes for admin.php?page= bugs (CVE-2009-2334)     Backport of security fixes for admin.php?page= bugs     (CVE-2009-2334) Backport of security fixes for     admin.php?page= bugs (CVE-2009-2334)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Jul 10 2009 Adrian Reber <adrian at lisas.de> -     2.8.1-1

    - updated to 2.8.1 for security fixes - BZ 510745

    - Mon Jun 22 2009 Adrian Reber <adrian at lisas.de> -       2.8-1

    - updated to 2.8

    - Wed Feb 25 2009 Fedora Release Engineering <rel-eng at       lists.fedoraproject.org> - 2.7.1-2

    - Rebuilt for       https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

    - Wed Feb 11 2009 Adrian Reber <adrian at lisas.de> -       2.7.1-1

    - updated to 2.7.1

    - Wed Nov 26 2008 Adrian Reber <adrian at lisas.de> -       2.6.5-2

    - updated to 2.6.5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Jul 10 2009 Adrian Reber <adrian at lisas.de> -     2.8.1-1

    - updated to 2.8.1 for security fixes - BZ 510745

    - Mon Jun 22 2009 Adrian Reber <adrian at lisas.de> -       2.8-1

    - updated to 2.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of WordPress earlier than 2.8.1. Such versions are reportedly affected by multiple vulnerabilities : 

  - A username enumeration weakness caused by the application displaying different responses to login requests depending on the existence of the supplied username. (CVE-2009-2334)

  - A security-bypass vulnerability in the 'wp-admin/admin.php' script when it is called with the 'pages' parameter set to a plug-in configuration page. An authenticated attacker could exploit this to gain access to configuration scripts. (CVE-2009-2335)

ID	Name	Product	Family	Severity
40601	Fedora 10 : wordpress-mu-2.8.4a-1.fc10 (2009-8538)	Nessus	Fedora Local Security Checks	medium
40599	Fedora 11 : wordpress-mu-2.8.4a-1.fc11 (2009-8529)	Nessus	Fedora Local Security Checks	medium
39859	Fedora 10 : wordpress-2.8.1-1.fc10 (2009-7729)	Nessus	Fedora Local Security Checks	medium
39856	Fedora 11 : wordpress-2.8.1-1.fc11 (2009-7701)	Nessus	Fedora Local Security Checks	medium
5096	WordPress < 2.8.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2009-2336

medium

Tenable Plugins

medium

medium

medium

medium

medium