Protection against the WordPress “large comment” security bug

Posted April 27th, 2015 in Tech Corner. Tags: , , .

The authors of WordPress today released version 4.2.1 that fixes a critical security bug.

While upgrading is always a good idea, we’ve blocked the attack for all versions of WordPress on all sites that we host. We’ve also verified using our MySQL binary logs that no sites were attacked before we started the blocking.

Can I see the mod_security rules?

Although our customers are fully protected, we’re often asked to share our mod_security rules when we post something like this. If you’re the technical person running a server for other people who use old versions of WordPress, something like this should stop the attacks:

SecRule REQUEST_LINE "^post .*/wp-comments-post\.php" "deny,auditlog,chain"
SecRule ARGS_POST:comment ".{65530}"

(You may want to add similar rules for other comment fields out of caution, too.)

  1. Recent Posts

    1. PHP versions 8.1.30, 8.2.24, and 8.3.12
    2. MariaDB (MySQL) database server update from 10.5 to 10.11 (completed)
    3. Labor Day 2024 holiday hours
    4. PHP versions 8.2.22 and 8.3.10
    5. WordPress 6.6
    6. PHP versions 8.1.29, 8.2.21, and 8.3.9
    7. 4th of July 2024 holiday hours
    8. Memorial Day 2024 holiday hours
    9. PHP versions 8.2.19 and 8.3.7
    10. PHP versions 8.1.28, 8.2.18, and 8.3.6

  2. Categories

  3. Tags

    all servers email holiday hours linux mailman maintenance mod_security mysql network php phpmyadmin security server updates spam ssl status updates webmail wordpress zapp

  4. Feeds