Mambo remote code execution (also affects Joomla)

eyezberg · **Posted:** Sun Nov 20, 2005 9:08 pm

I'm less concerned about the discussion, than about getting this patched asap on various sites, running both J! and Mambo..

sc00zy · **Posted:** Sun Nov 20, 2005 9:14 pm

Me too... I would like to see an official fix for this as soon as possible...
I have a lot of websites I'm very concerned about right now! $:-\$

But I believe they will fix it soon though

friesengeist · **Joined:** Sat Sep 10, 2005 10:31 pm **Posts:** 823

sc00zy wrote:

But I believe they will fix it soon though

Looks like Stingrey is preparing to release Joomla! 1.0.4 on [21-Nov-2005 10:00 UTC]

Jinx · **Joined:** Fri Aug 12, 2005 12:47 am **Posts:** 6431

A fix has been created and we are releasing a 1.0.4 securtiy release in the next couple off hours.

sc00zy · **Posted:** Sun Nov 20, 2005 9:26 pm

Great! Thanks guys

joomlasolutions_JB · **Joined:** Wed Aug 17, 2005 11:07 pm **Posts:** 349

we got defaced big time tonight >:(

patched now.. thanks johan

and thanks all who contributed

acepp · **Posted:** Mon Nov 21, 2005 2:19 am

um... has Joomla! 1.0.4 been released yet? $:-\$

sc00zy · **Posted:** Mon Nov 21, 2005 2:20 am

You'll be the first to know if you read the frontpage regularly :laugh:

acepp · **Posted:** Mon Nov 21, 2005 3:33 am

Jinx wrote:

A fix has been created and we are releasing a 1.0.4 securtiy release in the next couple off hours.

sc00zy wrote:

Great! Thanks guys

mambosolutions_JB wrote:

we got defaced big time tonight >:(

patched now.. thanks johan
and thanks all who contributed

I always check the Joomla! site regularly, but from the above posts I thought that a it had been already released.
But i guess not.
I'll be waiting anxiously for the release. $:-\$

webguy · **Posted:** Mon Nov 21, 2005 7:46 am

An official release is not out yet.
But if you install this globals.php on your Joomla or Mambo 4.5.2.3. site your pretty safe for now. Just make sure you save the file as globals.php and not as globals.php.txt.

acepp · **Posted:** Mon Nov 21, 2005 8:12 am

thanks webguy.
iv put webprotect on my website for now, until an official release comes out.
if it doesnt come out soon, i will use the global.php file you have provided.
thanks again.

webguy · **Posted:** Mon Nov 21, 2005 8:16 am

persianari wrote:

thanks webguy.
iv put webprotect on my website for now, until an official release comes out.
if it doesnt come out soon, i will use the global.php file you have provided.
thanks again.

Persianari, what is this webprotect thing? I guess I missed that in this thread...

acepp · **Posted:** Mon Nov 21, 2005 8:23 am

no it wasnt mentioned in this thread.
its a setting in cPanel, which stops access to your site.
in order to enter you need a username and password.
i really didnt have any other choice but to do this until a security fix is released.
i dont want to risk getting hacked/defaced.

acepp · **Posted:** Mon Nov 21, 2005 8:24 am

you can see what i mean by going to my website.

webguy · **Posted:** Mon Nov 21, 2005 8:26 am

Okay, I understand. That's .htaccess protection. Thanks for clarifying...

acepp · **Posted:** Mon Nov 21, 2005 8:40 am

yeh... thats the one.
im not to good with techy stuff. :-[

i know no one can access my site, but at least i know its not going to get hacked.
do you think what i have done is ok... or am i being too protective here?

does the globals.php file you provided, provide 100% security in regards to the security hole discussed in this thread?

webguy · **Posted:** Mon Nov 21, 2005 8:50 am

Sorry, I can't garantee this, because I didn't write the patch. However I did install it on a few Joomla! and Mambo 4.5.2.3 sites and tested it. The security hole seems closed.

If you're unsure about the solution, I guess the best tjing to do is keep your site(s) closed and await the official patch.

acepp · **Posted:** Mon Nov 21, 2005 8:52 am

okay.
thanks again.

friesengeist · **Joined:** Sat Sep 10, 2005 10:31 pm **Posts:** 823

persianari wrote:

does the globals.php file you provided, provide 100% security in regards to the security hole discussed in this thread?

There won't ever be something like 100% security! However, I think the globals.php you're talking about is quite secure, none of the attacks I know got through. Overwriting of global variables should be blocked out pretty good.

deep_sheep · **Joined:** Sun Nov 20, 2005 2:20 pm **Posts:** 1

What is the state here? My servers are under attack...

Just a few thoughts:

1. I am missing a (small) notice on the Joomla! frontpage regarding this security problem and a link to the hot fix provided (Thank you!) here for the people not reading this forum in detail.

2. Maybe I missed it - but is there a mailing list regarding Joomla!-security?

Kind regards

Stephan

acepp · **Posted:** Mon Nov 21, 2005 1:10 pm

deep_sheep wrote:

What is the state here? My servers are under attack...

Just a few thoughts:

1. I am missing a (small) notice on the Joomla! frontpage regarding this security problem and a link to the hot fix provided (Thank you!) here for the people not reading this forum in detail.

2. Maybe I missed it - but is there a mailing list regarding Joomla!-security?

Kind regards

Stephan

The only forum section you can subscribe to to get auto notifications is the Announcements section, which doesn't contain any posts or info about this new and very serious security threat.
I believe there should be a mailing list for such security announcements and that the security team should make it clear to everyone if any problems arise.
It should be shown on the home page when such security issues occurs.
There could be many people out there completely unaware that there is a massive security flaw in Joomla! 1.0.3 and that hackers are currently hacking and defacing many Joomla!/Mambo sites.
Such early and appropriate security notices could help many be better prepared for attacks.
I know that it could also create a massive panic attack from many users but its better to be told then not and have your site hacked/defaced without any knowledge that you site is a potential for such attacks.

izzi · **Joined:** Thu Nov 17, 2005 7:34 pm **Posts:** 39

I found one problem with the new globals.php (posted here in this forum) that aka forms is not working anymore, mambo and joomla..Have any one a solution for that?

Vimes · **Posted:** Mon Nov 21, 2005 2:40 pm

I suspect you're going to come up with a lot of issues like this. I've just been going through my own components, and while Jomres seems ok, an import component for a bike shop I wrote had one small problem that, while easily fixed, made me realise that there are likely to be a LOT of components out there that will need tweaking.

friesengeist · **Joined:** Sat Sep 10, 2005 10:31 pm **Posts:** 823

izzi wrote:

I found one problem with the new globals.php (posted here in this forum) that aka forms is not working anymore, mambo and joomla..Have any one a solution for that?

Don't tell that now

Could you please post some more details: setting of RG_EMULATION in globals.php and setting of register_globals in php.ini? I would expect your configuration to be RG_EMULATION=1 and register_globals=0.

izzi · **Joined:** Thu Nov 17, 2005 7:34 pm **Posts:** 39

friesengeist wrote:

izzi wrote:

I found one problem with the new globals.php (posted here in this forum) that aka forms is not working anymore, mambo and joomla..Have any one a solution for that?

Don't tell that now

Could you please post some more details: setting of RG_EMULATION in globals.php and setting of register_globals in php.ini? I would expect your configuration to be RG_EMULATION=1 and register_globals=0.

Yes my configuration is:
RG_EMULATION=1 and register_globals=0
and the register_globals in php.ini = off

Slixter · **Posted:** Mon Nov 21, 2005 3:29 pm

Official patch has been released.

http://developer.joomla.org/sf/go/proje ... _1_0.1_0_4

--Slixter

MattGS · **Joined:** Mon Sep 19, 2005 12:09 pm **Posts:** 2

Slixter wrote:

Official patch has been released.

Great, thanks all!
I guess now it's really time to upgrade all my old Mambo installations to Joomla.

Jinx · **Joined:** Fri Aug 12, 2005 12:47 am **Posts:** 6431

Hi guys,

We just released 1.0.4, it contains one critical and 5 smaller security fixes together with about 90 bug fixes.

Have fun upgrading

rjs · **Posted:** Mon Nov 21, 2005 7:04 pm

Great news. Thanks everyone.

gringo · **Joined:** Tue Nov 08, 2005 10:12 am **Posts:** 12

I don't see why the patch package contains so many files, including image files and template files? I thought the patch package just contained the important files that need to be patched?

Which are the most important files to patch?

Joomla! Discussion Forums

Forum rules

Mambo remote code execution (also affects Joomla)

Quick reply

Who is online