WordPress crypt_private () Remote Denial of Service Vulnerability

Release date:
Updated on: 2013-06-30

Affected Systems:
WordPress 3.5.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 60477
CVE (CAN) ID: CVE-2013-2173
 
WordPress is a Blog developed using the PHP language and MySQL database.
 
Security vulnerabilities in the class-phpass.php of the encryption module of WordPress can cause denial of service. To exploit this vulnerability, at least one post must be password protected.
 
<* Source: rgod (rgod@autistici.org)

Link: http://seclists.org/bugtraq/2013/Jun/41
Https://vndh.net/note:wordpress-351-denial-service
*>

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:
 
Before the vendor releases a patch or upgrade, NSFOCUS recommends that you take the following measures to reduce the threat:
 

--- Wp-DES/class-phpass.php
++ Wp-DES/class-phpass.php
@-120,7 + 120,7 @@
Return $ output;

$ Count_log2 = strpos ($ this-> itoa64, $ setting [3]);
-If ($ count_log2 <7 | $ count_log2> 30)
+ If ($ count_log2 <7 | $ count_log2> 13)
Return $ output;

$ Count = 1 <$ count_log2;
 
Vendor patch:
 
WordPress
---------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://wordpress.org/