UKC

WordPress 4.2.2 fixes a cross-site scripting vulnerability – Update Now

wordpress_logoWordPress Version 4.2.2

On May 6, 2015, WordPress 4.2.2 was released to the public. This is both a security update for all previous WordPress versions, and a maintenance release for versions 4.2 and newer.

From the announcement post, WordPress 4.2.2 fixes a cross-site scripting vulnerability contained in an HTML file shipped with recent Genericons packages included in the Twenty Fifteen theme as well as a number of popular plugins by removing the file. Auto-updates and manual updates will remove this file, however manual installations and those using VCS checkout (like SVN) will not remove this file. Version 4.2.2 also improves on a fix for a critical cross-site scripting vulnerability introduced in 4.2.1.

The release also includes hardening for a potential cross-site scripting vulnerability when using the Visual editor.

In addition to the security fixes, WordPress 4.2.2 contains fixes for 13 bugs from 4.2.1, including:

  • Fixes an emoji loading error in IE9 and IE10
  • Fixes a keyboard shortcut for saving from the Visual editor on Mac
  • Fixes oEmbed for YouTube URLs to always expect https
  • Fixes how WordPress checks for encoding when sending strings to MySQL
  • Fixes a bug with allowing queries to reference tables in the dbname.tablename format
  • Lowers memory usage for a regex checking for UTF-8 encoding
  • Fixes an issue with trying to change the wrong index in the wp_signups table on utf8mb4 conversion
  • Improves performance of loop detection in _get_term_children()
  • Fixes a bug where attachment URLs were incorrectly being forced to use https in some contexts
  • Fixes a bug where creating a temporary file could end up in an endless loop.

How to: Backup all MySQL Databases in Plesk

mysqlSometimes you need to make a dump of all MySQL databases, possibly prior to an upgrade or before you apply a required fix.

I prefer to dump all database as .SQL as an added safety measure, just in case a back out plan is required.

First we create a folder for our database dumps:

# mkdir /root/mysqlbackup

If you are running Plesk, let’s take a dump of the psa database:

# mysqldump -uadmin -p`cat /etc/psa/.psa.shadow ` psa > /root/mysqlbackup/psa.`date +%F_%H.%M`.sql

We certainly want a dump of the mysql database itself:

# mysqldump -uadmin -p`cat /etc/psa/.psa.shadow ` mysql > /root/mysqlbackup/mysql.`date +%F_%H.%M`.sql

Now we can perform a dump of all other databases:

# mysqldump -uadmin -p`cat /etc/psa/.psa.shadow ` --all-databases > /root/mysqlbackup/all.`date +%F_%H.%M`.sql

If you now need to complete a MySQL upgrade (which may have failed prior) you can complete it as follows:

# mysql_upgrade -uadmin -p` cat /etc/psa/.psa.shadow ` --debug-check --debug-info --verbose

How to: Login to the Client Area

Login to the Client Area to Manage your account

Our Client Area is where you manage all of your Domain Names and Web Hosting services as well as basic account tasks such as:

1) Tech Support and Managing Tickets
2) Billing and Invoices
3) Place new orders
4) Manage your Domain Names (name servers, DNS etc)
5) Manage your Hosting (Login to Plesk, get account details)
6) Order SSL Certificates and Disaster Recovery Products
7) Perform Service Upgrades
8) and much more!!

The credentials to login to the Client Area are your email address and chosen password.

URL: https://www.uk-cheapest.co.uk/clients/clientarea.php

Find and Rename Files Containing Pattern

sshHow to search and rename files containing specific pattern

There are times when you need to search your server storage for files containing a specific pattern within them.

For instance, if a new vulnerability allows files to be injected to your server, you need to find these files and remove them – or at least rename them for further analysis later.

In this example, we want to find all files containing eval code x47LOB.

To find and list these files, without performing any other action:

# grep -lr --include=*.php '${"\\x47LOB' /path/to/web/root/

The following will find and rename them

# grep -lr --include=*.php '${"\\x47LOB' /path/to/web/root/ | xargs -n1 bash -c 'mv $0 $0.INFECTED'

You can change the xargs to remove them instead of moving them. This should get you started on finding and processing.

MICROLITE26 Plesk 12 Upgrade

Plesk-12-Banner

MICROLITE26.COM – Upgrades

As part of our service to you, we strive to provide you with the very latest services, performance and security for your web sites. Our new upgrade schedule will completely replace your hardware and software to the very best available.

“During the period 25th thru 31st May the server hardware and plesk panel will be completely upgraded to the very latest specifications available.”

HARDWARE: The new hardware will improve the performance and reliability of the server. Response times and security will be greatly increased. The server will also be migrated to our new UK datacenter. The old IP address was 5.77.34.152. The new IP address will be 5.77.60.174.

SOFTWARE: The core OS of the new server will be of the latest stable version. PHP, MySQL  and all other features will be of the latest production versions.

PANEL: The Plesk Panel will be upgrade to Plesk 12, the current latest version of Plesk. This will provide the very latest features, functionality and security for your accounts.

ENHANCED SECURITY: The new Security Core combines ModSecurity, CSF, Malware Detect and Fail2Ban with Outbound Antispam and ServerShield™ tools and many features that protect against malicious attacks and site vulnerabilities.

WEBMAIL: AtMail is now replaced with the awesome RoundCube. Your username is in the format name@yourdomain.co.uk. Your passwords are unchanged. If you do have a problem with your mail password simply change it or request support to change it for you.

COST: These are no-cost upgrades, there will be no additional charges to your account.

DOCUMENTATION: Take a look at our Step-by-step Video Tutorials or review the Official User Guide

Notice: Please refrain from making significant changes to your web site during this period. The migration of the data will take many hours. We request that you put off any changes until the upgrade is complete to avoid an inconsistent transfer of your site data.