Critical Flaw In XML-RPC ?

The XML-RPC Library used by WordPress is not affected by this latest vulnerability. WordPress uses IXR not PHPXMLRPC or PEAR XML_RPC.

As long as you are running the latest version of WordPress 1.5.2 you are safe. There was a security flaw in IXR which was fixed in WordPress 1.5.1.3 2 months ago.

Thanks for the clarification. ??

According to this article at Cnet, there is a new Linux worm which exploits this vulnerability. Symantec and McAfee each have posted descriptions of this worm which show it is attacking the xmlrpc.php file in WordPress. I take it that those of us running 1.5.1.3 or the current release are now immune to this?

I asked about this on the hackers list yesterday.

The article is wrong.
WordPress uses a different xml-rpc file, and westi’s answer above addresses what was a problem.

There are no known vulnerabilities in WordPress at this time.

“I take it that those of us running 1.5.1.3 or the current release are now immune to this?”

UPDATE to 1.5.2 – you are at risk with any lesser version.

Thanks for the clarification podz.

More info: https://www.ads-software.com/development/2005/11/wordpress-is-secure/