American Idle

Stefan Esser recently warned developers of the dangers of SQL Column Truncation and the weakness of mt_rand().  With his help we worked around these problems and are now releasing WordPress 2.6.2.  If you allow open registration on your blog, you should definitely upgrade.  With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another user’s password to a randomly generated password.  The randomly generated password is not disclosed to the attacker, so this problem by itself is annoying but not a security exploit.  However, this attack coupled with a weakness in the random number seeding in mt_rand() could be used to predict the randomly generated password.  Stefan Esser will release details of the complete attack shortly.  The attack is difficult to accomplish,  but its mere possibility means we recommend upgrading to 2.6.2.

Other PHP apps are susceptible to this class of attack.  To protect all of your apps, grab the latest version of Suhosin.  If you’ve already updated Suhosin, your existing WordPress install is already protected from the full exploit.  You should still upgrade to 2.6.2 if you allow open user registration so as to prevent the possibility of passwords being randomized.

2.6.2 also contains a handful of bug fixes.  Check out the full changeset and list of changed files.

A

A

Courier-Journal Says: The “American Idol” host (who will be in Louisville this week as “Idol” returns for round two of its auditions) isn’t just the Dick Clark of his generation — though he does co-host “New Year’s Rockin’ Eve” with the TV legend. He’s also the Larry King of his generation, filling in when CNN’s prime-time talkmaster is on vacation.

And he’s the Casey Kasem of his generation, hosting not only the longest-running countdown show on radio, but his own weekday radio show, “On Air With Ryan Seacrest,” which now airs locally from 1 to 4 p.m. on 98.9 KISS-FM.

A

They’ve heard it all.

Now that the dust has settled and her run on “The Color Purple” on the Great White Way is over, we can all bow our heads in shame. Apparently reports of Barrino skipping work were over-exaggerated. She had a tumor on her throat that has since been treated. That would have been nice to know months ago, though.

Ace Showbiz Says: Portraying the critically acclaimed Celie in the musical, “The Color Purple,” it is sad to say that she was forced to take hiatus following doctor’s diagnosis that she had tumor on her throat.

If you haven’t already heard of the Brodance, the new sensation that is sweeping across the nation like breakdancing did back in the 80’s, then you haven’t lived. Seriously, it’s kinda addicting. Here’s a clip from an American Idols Live! Tour ‘08 stop in Kansas City.