Joomla! Discussion Forums



It is currently Tue Nov 24, 2009 6:07 am (All times are UTC )

 


Forum rules

Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.



Post new topic Reply to topic  [ 117 posts ]  Go to page Previous  1, 2, 3, 4  Next
Author Message
Posted: Sat Nov 19, 2005 3:57 am 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 823
de wrote:
friesengeist wrote:
The included configuration.php is also useless at this point as we are in a function context and the $mosConfig_* variables are not exported to global scope.

Hmm... you almost got me... but in my sef.php it seem not to be inside a function?

Oops! It's not in a function, it's in an if() {...} block. My bad. It's late  :-[

de wrote:
But also another line number... and in the current version which I checked out this second I do not even see the sef.php.

Also, I got messed up a little bit with the branch 1.0 and the trunk. So my comments are for the branch 1.0 (which holds the upcoming Joomla! 1.0.4). In the trunk version, it seems that sef was moved into /mambots/system/joomla.sefurlbot.php. But I haven't had a look at that so far, so I might be wrong.

de wrote:
That sef.php always "registers" those GET variables is an error somehow anyway as it does not consider whether the original globals.php was included or globals.php-off.

ACK.

de wrote:
OT: Btw. are you living in another timezone?

Not really, GMT+1, Karlsruhe, Germany. But security issues need to be solved fast, so I had keep an I on my sites.

_________________
We may not be able to control the wind, but we can always adjust our sails


Top
   
 
Posted: Sat Nov 19, 2005 5:52 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Fri Aug 12, 2005 2:45 am
Posts: 1574
Location: Toowoomba, Australia
Thanks for those helping on this one.

Can people try the attached replacement file for globals.php

Try the known attacks with

define( 'RG_EMULATION', 1 );

and

define( 'RG_EMULATION', 0 );

In Joomla! 1.1 we are going to emulate 0 and we are have already changed the usage of $mosConfig_absolute_path to a defined constant (JPATH_SITE).

Let me know how you go.


You do not have the required permissions to view the files attached to this post.

_________________
Andrew Eddie - Tweet @AndrewEddie
<><
http://www.theartofjoomla.com
http://www.kiva.org/team/joomla - Got Joomla for free? Pay it forward and help fight poverty.


Top
   
 
Posted: Sat Nov 19, 2005 2:30 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 823
masterchief wrote:
Can people try the attached replacement file for globals.php


Works quite good for me. No attack came trough (because there is no _SESSION in the frontend, see below).


Still, there are two important things:
  • With register_globals=On in php.ini, unregisterGlobals() is executed always (line 104).
  • Typo in line 26: _sessions must be _session


Another small thing is this:
Code:
/**
* Use 0 to emulate register_globals = on
*
* Use 1 to emulate regsiter_globals = off
*/
define( 'RG_EMULATION', 1 );

I would prefer that constant just the other way around. 0 or false for RG=off, 1 or true for RG=on.


Are you also going to adress the issue in includes/sef.php? I think instead of
Code:
   while(list($key,$value)=each($_GET)) $GLOBALS[$key]=$value;

your function checkInputArray should be called (depending on the setting of "RG_EMULATION").

_________________
We may not be able to control the wind, but we can always adjust our sails


Top
   
 
Posted: Sat Nov 19, 2005 3:12 pm 
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Mon Sep 19, 2005 12:09 pm
Posts: 2
Hi all,

just for the record - how does this Mambo solution work?

http://forum.mamboserver.com/showthread.php?t=65917

If it works, it would at least be an easy way to quickly fix this issue.


Top
   
 
Posted: Sat Nov 19, 2005 3:32 pm 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Sat Aug 20, 2005 1:28 pm
Posts: 146
Location: Dortmund
MattGS wrote:
just for the record - how does this Mambo solution work?

http://forum.mamboserver.com/showthread.php?t=65917

If it works, it would at least be an easy way to quickly fix this issue.


I think it uses an equivalent appraoch to the globals.php, masterchief  posted before: dieing off, if any blocked global variable is found within the request.

Quote:
Are you also going to adress the issue in includes/sef.php? I think instead of
Code:

while(list($key,$value)=each($_GET)) $GLOBALS[$key]=$value;

your function checkInputArray should be called (depending on the setting of "RG_EMULATION").

This is not necessary, as the script should have died when the globals-patch is applied not reaching to sef.

_________________
°°°°'°°°°
"All you need is Bytes" (Bitles, 2368)


Top
  E-mail  
 
Posted: Sat Nov 19, 2005 3:41 pm 
Joomla! Ace
Joomla! Ace
Offline

Joined: Thu Aug 18, 2005 9:06 am
Posts: 1465
friesengeist wrote:
I would prefer that constant just the other way around. 0 or false for RG=off, 1 or true for RG=on.

I second this... in addition I'd prefer a mode to deactivate any additional behavior... why not just use the PHP setting by default?

MattGS wrote:
just for the record - how does this Mambo solution work?

http://forum.mamboserver.com/showthread.php?t=65917

Would almost work as well... just that it is not "_GLOBALS" but "GLOBALS" (and it will not work in PHP < 4.2.0).
Also I am not sure whether the case could create a problem... on purpose the previous checks did ignore the case... for example I am not sure whether any harm can be done with $globals instead of $GLOBALS.
Beside those it does not differ a lot from the versions posted here....

By myself I believe that not telling the attacker immediately that there is such check done (using die with a message or at all) makes it less easy for an attacker to see which installations are worth to hack. It is a bit like not telling after a failed login whether the password was just wrong or even the user name does not exist.

d2o wrote:
This is not necessary, as the script should have died when the globals-patch is applied not reaching to sef.

Unfortunatelly I think that is not true, because it is a newly built $_GET array according to the SEF-URL.

_________________
http://de.siteof.de/


Top
   
 
Posted: Sat Nov 19, 2005 4:06 pm 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Sat Aug 13, 2005 2:13 am
Posts: 223
Location: Sweden
Quote:
while(list($key,$value)=each($_GET)) $GLOBALS[$key]=$value;
Regarding this, included configuration.php after that should reset all configuration variables.
I am not able to duplicate the hack on any on my servers so I can't test but am I missing something?

_________________
Emir Sakic
http://www.sakic.net


Last edited by Saka on Sat Nov 19, 2005 4:13 pm, edited 1 time in total.

Top
  E-mail  
 
Posted: Sat Nov 19, 2005 5:11 pm 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Sat Aug 20, 2005 1:28 pm
Posts: 146
Location: Dortmund
de wrote:
Unfortunatelly I think that is not true, because it is a newly built $_GET array according to the SEF-URL.

Erm, you are right :) globals wouldn't know about it being single key-value pairs.

_________________
°°°°'°°°°
"All you need is Bytes" (Bitles, 2368)


Top
  E-mail  
 
Posted: Sat Nov 19, 2005 7:48 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 823
d2o wrote:
This is not necessary, as the script should have died when the globals-patch is applied not reaching to sef.

Well, that's two different things here. Of course, there is no XSS injection possible due to the new globals.php. But sef.php is emulating register_globals=on (at least for GET values). So if you want to have register_globals=off, sef.php plays you a trick.

It's not really necessary to use "checkInputArray" in sef.php, but at least $_GET should only be made GLOBAL according to "RG_EMULATION". As we already have "checkInputArray", why shouldn't we use it?

_________________
We may not be able to control the wind, but we can always adjust our sails


Top
   
 
Posted: Sat Nov 19, 2005 9:41 pm 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Fri Aug 12, 2005 2:45 am
Posts: 1574
Location: Toowoomba, Australia
Re Mambo Solution

Yes it's the same except case-sensitivity is a problem in one of the versions of PHP (actually I think there is a switch).

Re Emulation constant

It's set that way because I an saying "what do you want to emulate: on =1, off = 0".  I'll fix the bug you mentioned though.  Thanks.

_________________
Andrew Eddie - Tweet @AndrewEddie
<><
http://www.theartofjoomla.com
http://www.kiva.org/team/joomla - Got Joomla for free? Pay it forward and help fight poverty.


Top
   
 
Posted: Sat Nov 19, 2005 11:08 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 823
masterchief wrote:
It's set that way because I an saying "what do you want to emulate: on =1, off = 0".


Currently, it is "on=0, off=1".
I want the same as you are saying: "on=1, off=0".

Or did I miss something?

_________________
We may not be able to control the wind, but we can always adjust our sails


Top
   
 
Posted: Sun Nov 20, 2005 6:44 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Fri Aug 12, 2005 2:45 am
Posts: 1574
Location: Toowoomba, Australia
Darn it, I had it the wrong way round in the comment.  I think I've fixed the logic now so it work correctly.

_________________
Andrew Eddie - Tweet @AndrewEddie
<><
http://www.theartofjoomla.com
http://www.kiva.org/team/joomla - Got Joomla for free? Pay it forward and help fight poverty.


Top
   
 
Posted: Sun Nov 20, 2005 1:09 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Aug 20, 2005 12:32 pm
Posts: 990
Location: Tewkesbury, UK
http://secunia.com/advisories/17622/

MAMBOSERVER.COM HACKED!!!!!

http://www.zone-h.org/en/defacements/view/id=3056290/

_________________
Phil Taylor - Full Time Expert Joomla-Only Developer
Blue Flame IT Ltd.
-- http://www.phil-taylor.com/
SPEED UP Joomla 1.5.x Admin Console with this: http://extensions.joomla.org/extensions ... 53/details


Top
   
 
Posted: Sun Nov 20, 2005 2:11 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 823
masterchief wrote:
I think I've fixed the logic now so it work correctly.


Sorry I have to say this, but...
Have a look at the attached patch.


You do not have the required permissions to view the files attached to this post.

_________________
We may not be able to control the wind, but we can always adjust our sails


Top
   
 
Posted: Sun Nov 20, 2005 2:11 pm 
I've been keeping up with the thread, is the patching for the current vulnerability going to be an emergency patch, or is this something that will wait until the next release?


Top
   
 
Posted: Sun Nov 20, 2005 2:13 pm 
User avatar
Joomla! Exemplar
Joomla! Exemplar
Offline

Joined: Thu Aug 18, 2005 9:07 am
Posts: 9305
Location: Assen, Netherlands
PhilTaylor-Prazgod wrote:


There's a thread about it too in this forum.

This one: http://forum.joomla.org/index.php/topic,19692.0.html

_________________
Arjan Menger
http://www.welldotcom.nl - Professionele Joomla! Design, Ontwikkeling en Hosting
http://www.joomlaideal.nl - iDEAL betaalmethode voor Joomla! en Virtuemart


Last edited by rjs on Sun Nov 20, 2005 2:17 pm, edited 1 time in total.

Top
  E-mail  
 
Posted: Sun Nov 20, 2005 2:13 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Aug 20, 2005 12:32 pm
Posts: 990
Location: Tewkesbury, UK
rjs wrote:
I've been keeping up with the thread, is the patching for the current vulnerability going to be an emergency patch, or is this something that will wait until the next release?



It cant wait!

see http://www.mamboserver.com - its hacked
and I am working on fixing several others as well.

_________________
Phil Taylor - Full Time Expert Joomla-Only Developer
Blue Flame IT Ltd.
-- http://www.phil-taylor.com/
SPEED UP Joomla 1.5.x Admin Console with this: http://extensions.joomla.org/extensions ... 53/details


Top
   
 
Posted: Sun Nov 20, 2005 2:16 pm 
ok. Thanks Phil.


Top
   
 
Posted: Sun Nov 20, 2005 2:17 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 823
rjs wrote:
I've been keeping up with the thread, is the patching for the current vulnerability going to be an emergency patch, or is this something that will wait until the next release?


I think this really should go out as soon as possible! It's an XSS vulnerability, and all Joomla/Mambo based sites are currently open for attackers as much as the can be! Everyone can execute every PHP code he wants to on your server!

_________________
We may not be able to control the wind, but we can always adjust our sails


Top
   
 
Posted: Sun Nov 20, 2005 2:23 pm 
Not good. Thank you for helping with this friesengeist.


Top
   
 
Posted: Sun Nov 20, 2005 4:01 pm 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Thu Aug 18, 2005 6:40 am
Posts: 1295
Location: Best, Netherlands
So, what is the best for now to do?
Apply the Mamboserver patch to Joomla sites as well?
http://forum.mamboserver.com/showthread.php?t=65917

_________________
René Kreijveld
http://www.one-company.nl | Joomla! product specialisten


Top
  E-mail  
 
Posted: Sun Nov 20, 2005 4:04 pm 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Sat Aug 20, 2005 1:28 pm
Posts: 146
Location: Dortmund
Thanks for the update friesengeist.

A problem I found with forcing globals off is that even some core components expect globals (e.g. com_media expects $listdir to be set, hence, having globals off disables to change into subfolders). Someone should check the core for side effects :)

_________________
°°°°'°°°°
"All you need is Bytes" (Bitles, 2368)


Top
  E-mail  
 
Posted: Sun Nov 20, 2005 5:06 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 823
webguy wrote:
So, what is the best for now to do?
Apply the Mamboserver patch to Joomla sites as well?

Don't do that. It's not save! I just checked it out with PHP 4.3.11 and 5.0.3. It's not working at all.
For now, untill an official update is announced, you should be fine by replacing globals.php with the one supplied in this post in this thread.

de wrote:
Also I am not sure whether the case could create a problem... on purpose the previous checks did ignore the case... for example I am not sure whether any harm can be done with $globals instead of $GLOBALS.

Just ridiculous what they do... At first, the Mambo guys mix up needle and haystack in in_array(). Secondly, they try to find an array in their $protect. This will always return false, as $protect has no subarrays...

_________________
We may not be able to control the wind, but we can always adjust our sails


Top
   
 
Posted: Sun Nov 20, 2005 5:17 pm 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Thu Aug 18, 2005 4:08 pm
Posts: 209
Location: Austria
Hiya!

Does the globals.php replacement from this thread also work with Mambo 4.5.2.3?
I still have several sites running Mambo because I haven't had the time to convert them and I wanted to wait until the release of Joomla 1.1.

Also, I lost the track somewhere in this thread as I'm not _that deep_ into core files, so am I vulnerable with one of this configurations:

Hoster 1:
=======
Mambo 4.5.2.3 Stable
PHP 4.3.11
Register Globals: ON

Hoster 2:
=======
Mambo 4.5.2.3 Stable
PHP 4.3.3
Register Globals: OFF

Hoster 3:
=======
Joomla 1.0.3 Stable
PHP 4.4.1
Register Globals: OFF

As far as I got it at least the account at Hoster 2 should be in danger, right?

Thanks in advance,
Kurt

_________________
Kurt Banfi

http://www.clockbit.com <- Developer of Contacts XTD
http://www.open-sef.org <- Chief Designer ;)


Last edited by CubaLibre on Sun Nov 20, 2005 5:33 pm, edited 1 time in total.

Top
  E-mail  
 
Posted: Sun Nov 20, 2005 5:36 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 823
CubaLibre wrote:
Does the globals.php replacement from this thread also work with Mambo 4.5.2.3?

It just works fine with Mambo 4.5.2.3

CubaLibre wrote:
Also, I lost the track somewhere in this thread as I'm not _that deep_ into core files, so am I vulnerable with this configuration:

Mambo 4.5.2.3 Stable
PHP 4.3.11
Register Globals: ON

Depends on your setting of SEF:
  • SEF=on -> vulnerable
  • SEF off and register_globals=on -> not vulnerable (as far as I know/explored)

_________________
We may not be able to control the wind, but we can always adjust our sails


Top
   
 
Posted: Sun Nov 20, 2005 5:46 pm 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Thu Aug 18, 2005 4:08 pm
Posts: 209
Location: Austria
friesengeist wrote:
It just works fine with Mambo 4.5.2.3


Ok, then I'll upload the modified globals.php right now!

friesengeist wrote:
Depends on your setting of SEF:
  • SEF=on -> vulnerable
  • SEF off and register_globals=on -> not vulnerable (as far as I know/explored)

Sorry, seems I modified my post while you replied. Do you mind taking a look at Hoster 2 and 3 as well?

Thanks,
Kurt

_________________
Kurt Banfi

http://www.clockbit.com <- Developer of Contacts XTD
http://www.open-sef.org <- Chief Designer ;)


Top
  E-mail  
 
Posted: Sun Nov 20, 2005 6:01 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 823
CubaLibre wrote:
Sorry, seems I modified my post while you replied. Do you mind taking a look at Hoster 2 and 3 as well?


With register_globals=off and the old globals.php, you are probly vulnerable. As far as I know it makes no difference, which PHP version you are using. I could only test 4.3.11 and 5.0.3 though.

There is some interesting stuff about the backgrounds on http://www.hardened-php.net/index.76.html.

_________________
We may not be able to control the wind, but we can always adjust our sails


Top
   
 
Posted: Sun Nov 20, 2005 6:12 pm 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Thu Aug 18, 2005 4:08 pm
Posts: 209
Location: Austria
I just replaced globals.php at all the sites running on Hoster 1 and deleted several installations used for demo and testing purposes only.
I'll do the same on the other accounts as well and then check out the link you posted.

Thanks a lot!

Kurt

_________________
Kurt Banfi

http://www.clockbit.com <- Developer of Contacts XTD
http://www.open-sef.org <- Chief Designer ;)


Top
  E-mail  
 
Posted: Sun Nov 20, 2005 8:50 pm 
User avatar
Joomla! Hero
Joomla! Hero
Offline

Joined: Thu Aug 25, 2005 5:48 pm
Posts: 2801
Location: Geneva mostly
So.. weekend or not, this issue was posted 3-4 days ago, in the meantime, mamboserver !! has been defaced, so is there going to be a patch available asap, and if so, will it be only for Joomla, or also Mambo 4523?
I do not feel very confortable now, seing you guys discussing these vulenrabilities here on a public forum, so anywone who ahsn't had the idea might want to try now..
Andrew, is your replacement file ready to be used or not, and does it fix all issues?
Thanks.

_________________
Sometimes one pays most for the things one gets for nothing.
The important thing is not to stop questioning. Curiosity has its own reason for existing. AE
http://joomla15.blogspot.com for J! 1.5 screenshots
http://www.eyezberg.com


Top
  E-mail  
 
Posted: Sun Nov 20, 2005 9:04 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 823
eyezberg wrote:
I do not feel very confortable now, seing you guys discussing these vulenrabilities here on a public forum, so anywone who ahsn't had the idea might want to try now..


I understand your concern about discussing this thing here in the forum. But please keep in mind, that
  • this issue was already reported on many security sites and security mailing lists. I read about it on friday morning, before I saw it in this forum.
  • no information on how to do the attack has been published in this forum. I think that hackers don't get more information on the topic in this forum than they already have from peter MC tachatte's mail
  • all important information was sent to Andrew in private mail
  • this discussion has brought up some more points to think about. If tested by a wider community, the patch might be more secure than when just tested by a few people.

Just my 2 Cents...
Enno

_________________
We may not be able to control the wind, but we can always adjust our sails


Top
   
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 117 posts ]  Go to page Previous  1, 2, 3, 4  Next

Quick reply

 



Who is online

Users browsing this forum: No registered users and 9 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group