Tell me more ×
WordPress Answers is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.
up vote 0 down vote favorite
1

A client has requested we use a theme, and that theme has a Timthumb dependency. I know that there has been some serious vulnerabilities in the past, but what is the current state of that plugin?

Can someone point me to an authoritative resource that addresses this vulnerability? It doesn't appear that the plugin is still being maintained / available in the repo?

Thanks

share|improve this question

2 Answers

up vote 2 down vote accepted

Take a look here: http://ma.tt/2011/08/the-timthumb-saga/ I assume you know who Matt is. Also, Matt mentioned this guy in that link, and he's got some updates on the issue posted to his site http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many-wordpress-themes/

The short is, there's now TimThumb 2.0 which is fixed. It's available here http://code.google.com/p/timthumb/

share|improve this answer
Yeah, I know the guy :) Thanks for pointing me to those posts and particularly Mark's update. Sounds like we're back on track. – Tom Auger Jun 4 '12 at 16:04
1  
I should also mention that there's the wordpress.org/extend/plugins/timthumb-vulnerability-scanner Timthumb Vulnerability Scanner plugin that can help scan for bad code and keep things up-to-date. Highly recommended. – Tom Auger Jun 4 '12 at 16:05
up vote 1 down vote

I still consider timthumb.php to represent an inherent risk due to the way that it operates. As far as I know, the following statement remains true:

NOTE: timthumb.php is inherently insecure because it relies on being able to write files into a directory that is accessible by people visiting your website. That’s never a good idea.

Without looking through the source directly, I see nothing in this list of TimThumb 2.0 enhancements that changes the fundamental functionality of the script. The enhancements provide some additional security-through-obscurity, but in reality, obscurity is not security.

Until I see objective evidence to the contrary, I stand by my admonition to use the core image-resizing and post thumbnail functionality only and always.

share|improve this answer
But isn’t the same true for WordPress and the uploads directory? It can write files to a public visible directory. – toscho♦ Jun 4 '12 at 16:33
WordPress writing files to directories that it owns is a completely different matter from the world writing to directories that WordPress owns. – Chip Bennett Jun 4 '12 at 16:36
There's a list of some of the security measures here: markmaunder.com/2011/08/04/… No code is secure, it's all just a risk assessment. – user1337 Jun 4 '12 at 16:44
Thanks Chip for your assessment. I totally agree and would never use this plugin for my own development. Unfortunately this is a client-purchased theme and there's no budget to retrofit Timthumb out of it. – Tom Auger Jun 5 '12 at 13:01
Chip, can you elaborate on your comment about the difference between WP using GDLib and writing out thumbnails to the uploads folder, and Timthumb doing the same? The difference is not obvious to me. They're both processes running under the same user (presumably Apache), and they both write to publicly-readable directories. Or is it the fact that Timthumb writes the unmodified, unfiltered content of the upload directly to the directory? Does WordPress not also write an original (unmodified) version of the image file before making the thumbnails? – Tom Auger Jun 5 '12 at 13:03
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.