mt vulnerability

MovableType users, there is a security issue that you need to tend to immediately. Here's what you need to do:

  1. Rename, relocate, or simply remove mt-send-entry.cgi. It's a formmail script, so people are using it* to spam other people. Of course, since it's your server that's sending out the Viagra emails, your server is going to be blacklisted when an anti-spam tracker detects it.
  2. (updated, thanks Adam) Add the following to your .htaccess file:
    <Files ~ "\.(ini|inc|tmpl|cfg)">
    Deny From all
    </Files>

    This will stop people from accessing your .ini, .inc, .tmpl and .cfg files from outside. Without this, people can get to know what your database name is, etc. While it's not critical information on its own, I'm averse to giving out anything that can be used against my server in a hack attack.

I'm not saying the spammers are using your blog right now; but they could if they wanted to. Hence, I highly recommend you immediately fix your installation of MT, if you have one. Also, for updated information on the send-entry bug is available here.

|