Bluehost Corrected a Security Risk On My WordPress Account

This blog and two more other was infected by a malware last month where I did some major house cleaning to my Bluehost account. A pain for all self-hosted WordPress users for the vulnerability in the TimThumb {thumb.php}, I contacted support but it was not resolved, I have to do it manually by myself.  Then I received an email from them last 4 days ago that they have corrected a security risk on my account. It’s a big relief for me and felt secure to all my WordPress accounts, all {thumb.php} is updated to the latest version. Here’s the email I got.

 

Dear customer,

This is a courtesy notice that we have found and corrected exploitable timthumb.php file(s) on your ebarrun.com account, which are listed below.  While we have corrected these files, we do recommend you ensure all potential exploits are corrected on your account.  This is best done by updating all scripts, plugins, modules and themes on your account to the latest version.

As the owner of the account, you are responsible for keeping your hosted content free of malicious software.  For technical assistance, you can also reach our chat team from Bluehost.com or by going directly to:

http://www.bluehost.com/chat

The timthumb.php file is a script commonly used in WordPress’s (and other software’s) themes and plugins to resize images. The exploit allows an attacker to arbitrarily upload and create files and/or folders on your account, which can then be used for a number of malicious tasks, including but not limited to defacement, browser high-jacking and infection, data harvesting and more.  After a site has been exploited, it may lead to becoming labeled a “Malicious Website” by Google or other security authorities.

Any timthumb.php file below version 1.35, but above version 1.09 is considered vulnerable, unless patched. To prevent being compromised, we advise you update all instances of timthumb.php to version 2.0, or patch the existing vulnerable files.  Note that patching the files requires more in-depth knowledge of the PHP scripting language.

The updated version of timthumb.php can be found here:

http://timthumb.googlecode.com/svn/trunk/timthumb.php

Additional information regarding the compromise can be found at the following two websites, as well as others; note that all external websites in this email are not affiliated with Bluehost.com in any capacity, and are for your reference only.

http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many-wordpress-themes/
http://redleg-redleg.blogspot.com/2011/08/malware-hosted-newportalsecom.html

Note: some information has been deleted for privacy reasons.

 

Though it’s my responsibility to update everything to the latest versions, I’m so delighted for a nice customer service by Bluehost, I now feel more secure than ever.