Welcome to Geeklog, Anonymous Thursday, March 28 2024 @ 07:29 am EDT

Reminder: Remove the install script!

  • Thursday, June 04 2009 @ 03:40 pm EDT
  • Contributed by:
  • Views: 11,598
Security

A recent posting on the Bugtraq security mailing list should serve as a reminder to always remove the install script after a successful install or upgrade of Geeklog: MaXe points out an XSS, a path disclosure, and a remote file inclusion in the 1.5.x install script. The XSS is still present in the 1.6.0 install script and has been pointed out to us before by a person who called himself Nemesis.

We'll take care of this in the next 1.6.0 release (probably rc1). So again: Please follow the installation instructions and the built-in reminders to remove the install script and the other security tips that we provide before, during, and after the install.