CVE-2015-5730

WordPress Core < 4.2.4 - Timing Side-Channel Attack

2015-08-04 00:00

Strategic Overview

Status: Patched in 3.7.10
Affected Core: WordPress 4.2
Affected Version: 3.7 – 4.2.3 · 7 branches
CVSS: 5.3Medium
Weakness type: CWE-208 · Observable Timing Discrepancy
CVE: CVE-2015-5730

At a glance

CVE-2015-5730 is a medium-severity Observable Timing Discrepancy vulnerability in the WordPress 4.2 WordPress release line, affecting 3.7 – 4.2.3 · 7 branches. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 3.7.10; sites on affected versions should update now. Disclosed August 2015, reported by Johannes Schmitt.

Vulnerability Overview

The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-208: Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Remediation

Update to one of the following versions, or a newer patched version: 3.7.10, 3.8.10, 3.9.8, 4.0.7, 4.1.7, 4.2.4

How does WordSec protect against this?

The fix is the thing that ends this: updating to 3.7.10 is the step that ends it.

Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2015-5730 https://www.wordfence.com/threat-intel/vulnerabilities/id/97ab2585-4178-4a5b-923f-2ce9ca44a8d7 https://nvd.nist.gov/vuln/detail/CVE-2015-5730

Related records

Other vulnerabilities in WordPress 4.2

CVSS Vector

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityLow
IntegrityNone
AvailabilityNone

This record contains material that is subject to copyright

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/