ibiblio services/changes announcement list

[Fred Stutzman <fred AT metalab.unc.edu>]

Folks,

Two other things:

MT Provides a plugin that is compatible to 2.6*, so you won't have to do a 
full upgrade if that is impossible (though this is the course we 
reccomend).

And default installs without comment notification enabled are not 
vulnerable.

If you fit into these other two criteria, please let us know and we will 
allow you as well.

Thanks for your patience and understanding.

Fred



On Thu, 27 Jan 2005, Fred Stutzman wrote:

> Greetings (This message is for users of Moveable Type at ibiblio):
>
> Recently, it was shown that Moveable-Type's comment utility was vulnerable to 
> being exploited for spam purposes on the internet.
>
> What this means is that if spammers knew you had Moveable Type, they can use 
> your site to launch spam attacks from the ibiblio server.  This is very nasty 
> for our systems and causes them to be very slow.
>
> We've had to implement emergency measures of sorts to protect our systems. As 
> of 11PM EST tonight, requests to mt-comments.cgi are being blocked. This 
> protects us from being exploited.
>
> Now, you might say, this is awful rude of you folks to block us like this. 
> The good news is, it is very easy for us to unblock you!  Simply, if you 
> upgrade to Moveable Type 3.15 (The Secure, New Version), we can unblock your 
> comments utility.
>
> Please keep in mind, we haven't blocked your site, just the commenting 
> utility.  When users click on the commenting function, they will be 
> redirected to a page that tells them they don't have permissions to execute 
> the file (a standard apache page).
>
> We feel very bad for those who have been affected, and we know that 
> constantly upgrading your software to deal with these virus writers and 
> spammers is a big pain.  It affects the WHOLE internet and all ISP's, and 
> many smart people are working to fix the problems.  Right now, we've 
> implemented an approach that affects the least amount of ibiblio users, and 
> preserves our site for the most possible ibiblio users.  We hope you 
> understand.
>
> To have your site's comments unblocked, simply send a message to 
> help AT ibiblio.org telling us you have upgraded.  We will unblock your comments 
> soon thereafter.
>
> Thanks for understanding.
>
> Fred

--
Fred Stutzman
Desk: 962-5646
Cell: 260-8508
www.ibiblio.org