1adeedf43851fef40dbe6e9565131fcc  wordpress-1.5.2.tar.gz

the exact difference between this and the fixed version can be found within wp-settings.php.

In the original tarball you will find the following piece of code, that is actually vulnerable to a GLOBALS unset vulnerability, that is f.e. triggered by adding GLOBALS=1 as first parameter. This will result in the GLOBALS array being unset before the offending variables are unset. It is obvious that this completely bypasses the whole protection.

<?php
// Turn register globals off
if ( ini_get('register_globals') ) {
$superglobals = array($_SERVER, $_ENV, $_FILES, $_COOKIE, $_POST, $_GET);
if ( isset($_SESSION) )
array_unshift($superglobals, $_SESSION);

foreach ( $superglobals as $superglobal )
foreach ( $superglobal as $global => $value )
if ( 'table_prefix' != $global )
unset( $GLOBALS[$global] );
}

?>

I have sent them the following code, that is now also part of the PHP manual and that is able to handle all known problems in other register globals deregistration code snipsets. This code is now within the replaced tarball.

<?php

// Turn register globals off

function unregister_GLOBALS() {

if ( !ini_get('register_globals') )

return;

if ( isset($_REQUEST['GLOBALS']) )

die('GLOBALS overwrite attempt detected');

// Variables that shouldn't be unset

$noUnset = array('GLOBALS', '_GET', '_POST', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES', 'table_prefix');

$input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array());

foreach ( $input as $k => $v )

if ( !in_array($k, $noUnset) && isset($GLOBALS[$k]) )

unset($GLOBALS[$k]);

}

unregister_GLOBALS();

...

unset( $wp_filter, $cache_userdata, $cache_lastcommentmodified, $cache_lastpostdate, $cache_settings, $category_cache, $cache_categories );

?>

I think it is not necessary to underline what I think about silently replacing tarballs to fix vulnerabilities, and not warning the own users, for marketing reasons. Luckily this is the world of open source and everyone has the choice to choose a developer team, that cares about the security of its users.