Joomla! Discussion Forums



It is currently Wed Nov 25, 2009 7:04 am (All times are UTC )

 




Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 289 posts ]  Go to page Previous  1, 2, 3, 4, 5 ... 10  Next
Author Message
 Post subject: Re: ExtCalendar
Posted: Tue Jul 11, 2006 12:39 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Tue May 23, 2006 3:33 pm
Posts: 30
Floranett wrote:
albi wrote:
Floranett wrote:
Is there a new secure version of ExtCalender we can use?
[/quote

http://extensions.joomla.org/component/ ... Itemid,35/


Thanks alot albi m8, but can this be used with Mambo 4.5.3?  :)


Nice Calendar.. BUT this one can not use Pictures/Flyer/Logos ... so anyone knows a good one with able to upload flyer


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Tue Jul 11, 2006 12:52 pm 
User avatar
Joomla! Virtuoso
Joomla! Virtuoso
Offline

Joined: Fri Aug 19, 2005 3:03 pm
Posts: 4724
Location: Indiana, USA
Floranett wrote:
Thanks alot albi m8, but can this be used with Mambo 4.5.3?  :)

It might work on a mambo install, but you might seriously consider switching to Joomla!. after the forthcoming 1.5, mambo and Joomla! will continue to become more and more different.
Meaning, although it may work now, if, in six months there is a high-level security issue, the coders will fix it for 1.5 and likely will not worry about the 1.0.x codebase.

I would suggest you either convert to Joomla!, where you can obviously get more and better support, or else use a calendar component which will continue to be supported on mambo.

_________________
If you're new to Joomla, Please read Anna's Joomla! Tips: viewtopic.php?t=5503

http://nathandiehl.com | Find out what makes me tick


Top
   
 
 Post subject: Re: ExtCalendar
Posted: Tue Jul 11, 2006 12:57 pm 
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Sun Mar 12, 2006 7:11 pm
Posts: 160
nathandiehl wrote:
Floranett wrote:
Thanks alot albi m8, but can this be used with Mambo 4.5.3?  :)

It might work on a mambo install, but you might seriously consider switching to Joomla!. after the forthcoming 1.5, mambo and Joomla! will continue to become more and more different.
Meaning, although it may work now, if, in six months there is a high-level security issue, the coders will fix it for 1.5 and likely will not worry about the 1.0.x codebase.

I would suggest you either convert to Joomla!, where you can obviously get more and better support, or else use a calendar component which will continue to be supported on mambo.


Thank for the tip @nathandiehl , and I've seriously thinking about it. BUT...my site is BIG with a lot of components and modules ++ ..so Im a bit afraid not everything will work ok if I made the switch to Joomla ???

Can you have a look @nathandiehl  and pm me what you think?
I'll pm you my website url.


Top
   
 
 Post subject: Re: ExtCalendar
Posted: Tue Jul 11, 2006 1:20 pm 
Joomla! Intern
Joomla! Intern
Offline

Joined: Wed Sep 28, 2005 12:52 am
Posts: 78
Location: New York, USA
n0fear2 wrote:
// no direct access
defined( '_VALID_MOS' ) or die( 'Restricted access' );

insert this in extcal.php  as far as i read this fiexes the problem? RIGHT?


Read RobS' suggestion above in this discussion thread:
http://forum.joomla.org/index.php/topic,75390.msg390097.html#msg390097

You need to add those lines to every file of the extcal component.  That is a minimum fix, there still may be other problems found.


Top
   
 
 Post subject: Re: ExtCalendar
Posted: Tue Jul 11, 2006 1:46 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Sat Jun 24, 2006 12:18 am
Posts: 18
I'm fairly new to Joomla and have several questions I'm hoping someone can answer to help clarify this situation.

The first issue, is as a stop-gap measure how to prevent the extCalendar from being exploited.

danialt wrote:
Put the

defined('_VALID_MOS') or die('Direct Access to this location is not allowed.');

on the top of extcalendar.php..


1) Does this plug the hole and allow you to continue using extCalendar or does it suspend access to the extCalendar?

2) What is the best way to temporarily disable extCalendar until it becomes clearer whether a security update will be released or we need to change to a new calendar component?

3) As someone else asked, in what file is the "Powered by extCalendar" text.  If that's what hackers are searching for it could help to remove that text.

The next issue is where do we go from here...

4) Is there a process for continuing the development of a component that is no longer being actively worked on by the original developer?  Can/will someone else take over the development of this component?

5) What alternative calendar components are available?  I've seen eventCal mentioned 1.5 mentioned, but consider it was only released today I'm concerned that it has not been put through its paces and could be buggy or even have security holes itself.


Last edited by pdstein on Tue Jul 11, 2006 2:23 pm, edited 1 time in total.

Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Tue Jul 11, 2006 6:49 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Thu May 11, 2006 10:34 pm
Posts: 44
RobS wrote:
There is a com_events and another calender that I have heard will be released tomorrow so stay tuned to the Extensions page and check that out. 


config.php has the statement in the script.  I am changing other files now.

Thanks.


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Tue Jul 11, 2006 7:27 pm 
User avatar
Joomla! Virtuoso
Joomla! Virtuoso
Offline

Joined: Fri Aug 19, 2005 3:03 pm
Posts: 4724
Location: Indiana, USA
pdstein wrote:
I'm fairly new to Joomla and have several questions I'm hoping someone can answer to help clarify this situation.

The first issue, is as a stop-gap measure how to prevent the extCalendar from being exploited.

danialt wrote:
Put the

defined('_VALID_MOS') or die('Direct Access to this location is not allowed.');

on the top of extcalendar.php..


1) Does this plug the hole and allow you to continue using extCalendar or does it suspend access to the extCalendar?

2) What is the best way to temporarily disable extCalendar until it becomes clearer whether a security update will be released or we need to change to a new calendar component?

3) As someone else asked, in what file is the "Powered by extCalendar" text.  If that's what hackers are searching for it could help to remove that text.

The next issue is where do we go from here...

4) Is there a process for continuing the development of a component that is no longer being actively worked on by the original developer?  Can/will someone else take over the development of this component?

5) What alternative calendar components are available?  I've seen eventCal mentioned 1.5 mentioned, but consider it was only released today I'm concerned that it has not been put through its paces and could be buggy or even have security holes itself.



1. There is no guarantee this is the only hole. It might work. It might not. Development stopped on extCal2 a few years ago.
2. There will be no security update from the developer. It has not been developed for years, and it is unreasonable to assume an official fix will be issued. (although i give a 0.05% chance we could see a fix)
3. ahhh..do a search on your local computer for the text in a file. i don't know off hand. but this isn't a very good 'anti-hacking' scheme. pretty easy to get around.
4. haven't heard of any development in several years. You are welcome to further develop the component and release an update.
5. extensions site is here: http://extensions.joomla.org  search for calendars.

_________________
If you're new to Joomla, Please read Anna's Joomla! Tips: viewtopic.php?t=5503

http://nathandiehl.com | Find out what makes me tick


Top
   
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 1:00 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Nov 21, 2005 8:50 pm
Posts: 11
I too was hit by this hack on Saturday evening, but thank goodness for BigApe ;D

I wondered about what steps I need to take to protect my site. Is it enough to disable the ExCal modules, do I need to rename the folder they are in, or should I just uninstall the component completely?

Thanks for your advice.

DP


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 1:51 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Mon Dec 05, 2005 10:17 am
Posts: 1318
Location: New Orleans, LA, USA
I would suggest you uninstall completely.

_________________
Rob Schley - Open Source Matters
Webimagery - http://www.webimagery.net/ - Professional Consulting Services
JXtended - http://www.jxtended.com/ - Free and Commercial Joomla! Extensions


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 3:16 am 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Thu Aug 18, 2005 2:25 pm
Posts: 104
Location: us
I have tried the repair suggested in this forum, but the only thing holding this hack at bay are my php.ini disallow settings and my security settings in httpd.conf.

too bad no one is working on this component as it really is the best of its kind.

How can I get more information about what this exploit is trying to do? I have a copy of the one that is trying to crack my sites.

_________________
"You must be the change you wish to see in the world" -Ghandi


Top
   
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 7:37 am 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Wed Nov 30, 2005 3:42 pm
Posts: 45
Is it normal to still have install.extcalendar.php in the com_extcalendar folder ?
I deleted it.
No effect on the calendar which seems to run fine without it.

I was always told all install files should be deleted.

Am I wrong ?


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 7:44 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Mon Dec 05, 2005 10:17 am
Posts: 1318
Location: New Orleans, LA, USA
From what I remember they were only supposed to be run during the installation process.  If the component's xml file were misconfigured it could cause it to be installed like a regular file and therefore stick around after the installation process ended. 

_________________
Rob Schley - Open Source Matters
Webimagery - http://www.webimagery.net/ - Professional Consulting Services
JXtended - http://www.jxtended.com/ - Free and Commercial Joomla! Extensions


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 9:24 am 
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Fri Sep 16, 2005 10:43 am
Posts: 2
http://www.frsirt.com/english/reference/15352

I've tried the xploit on my local server and it really works: the .txt file passed in the url is opened in the browser...

I added the two rows:

/** ensure this file is being included by a parent file */
defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );

and the exploit do not work again

Is it possible that it is the only patch?

I've searched for the string "global $mosConfig_absolute_path;" and i've founded it only in com_extcalendar/extcalendar.php

Anyone has any idea?


Top
   
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 9:30 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Mon Dec 05, 2005 10:17 am
Posts: 1318
Location: New Orleans, LA, USA
Yes, this is one of the ways to fix it, for now.  We are not sure if that will solve all of the problems related to that script though.  Also, make sure that you add that code to all of the files that extCalendar installed in components/com_extcalendar/ and administrator/components/com_extCalendar/.  I must advise that you try to migrate to another Calendar component as extCalendar has not been developed for a long time and could easily have more security issues.

_________________
Rob Schley - Open Source Matters
Webimagery - http://www.webimagery.net/ - Professional Consulting Services
JXtended - http://www.jxtended.com/ - Free and Commercial Joomla! Extensions


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 10:28 am 
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Fri Sep 16, 2005 10:43 am
Posts: 2
I've seen that in the file cal_popup.php of extcalendar component there are these code lines:


/** Set flag that this is a parent file */
define( '_VALID_MOS', 1 );

why???


Top
   
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 1:27 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Thu Aug 18, 2005 10:40 pm
Posts: 501
Location: Antalya
albi wrote:
Floranett wrote:
Is there a new secure version of ExtCalender we can use?


http://extensions.joomla.org/component/ ... Itemid,35/


Maturity: Alpha

yeah, but eventcal is alfa version yet. that might mess up joomla very easy
installing any alfa 3P componants is not a good idea in my opinion


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 1:32 pm 
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Sun Mar 12, 2006 7:11 pm
Posts: 160
mamboturk wrote:
albi wrote:
Floranett wrote:
Is there a new secure version of ExtCalender we can use?


http://extensions.joomla.org/component/ ... Itemid,35/


Maturity: Alpha

yeah, but eventcal is alfa version yet. that might mess up joomla very easy
installing any alfa 3P componants is not a good idea in my opinion



Tried it and wount work with Mombo 4.5.3.
Also been in contact with the author Kay through email telling me there probably be another version soon  :)


Top
   
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 2:45 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Sat Aug 20, 2005 12:32 pm
Posts: 990
Location: Tewkesbury, UK
Thanks to Greg, inthe team here at Blue Flame IT Ltd, for his hard work this week where we have de-hacked over 20 websites for customers globally.

See his recent post on the Latest news of http://www.phil-taylor.com/

Quote:
A number of sites have been hacked due to a security vulnerability in extcalendar. There are a couple of issues which need to be considered in relation to this. Firstly all Joomla php files (other than the index.php files) should contain a line which prevents direct access to the file froma web browser. This line does the trick:

defined( ‘_VALID_MOS’ ) or die( ‘Restricted access’ );

This should be the first line of php code in the file.

Secondly if php is configured with allow_url_fopen set to “On” then the php code will be potentially able to open files on other servers, so the programmer must be very careful not to allow global variables in include/require statements.

A patched version of extcalendar.php is available to download (Link on the blog at http://blog.phil-taylor.com/ )

More information on register_globals.  (Link on the blog at http://blog.phil-taylor.com/ )

_________________
Phil Taylor - Full Time Expert Joomla-Only Developer
Blue Flame IT Ltd.
-- http://www.phil-taylor.com/
SPEED UP Joomla 1.5.x Admin Console with this: http://extensions.joomla.org/extensions ... 53/details


Top
   
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 3:17 pm 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Mon Sep 19, 2005 3:56 am
Posts: 108
Location: USA
I had a client's site get hacked.  Fixed it and they hacked it again.  So I've removed extcal since it wasn't used on this site much anyway.  We'll see if that solves it.

_________________
http://www.thegolfspace.com
http://www.themacspace.com


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 5:36 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Sun Nov 20, 2005 9:05 pm
Posts: 49
danialt wrote:
3) As someone else asked, in what file is the "Powered by extCalendar" text.  If that's what hackers are searching for it could help to remove that text.


I found it in the language file for extCalendar.  There is a 'Powered by %S' defined as the signature.  I blanked it out for now, but since the search engines cache pages of your site, it is not the best fix.


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 5:54 pm 
Joomla! Virtuoso
Joomla! Virtuoso
Offline

Joined: Fri Aug 12, 2005 7:19 am
Posts: 4471
Location: Leeds, UK
its the url they are searching for eg com_extcal....


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 6:19 pm 
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Sat Jun 24, 2006 12:18 am
Posts: 18
PhilTaylor-Prazgod wrote:
Thanks to Greg, inthe team here at Blue Flame IT Ltd, for his hard work this week where we have de-hacked over 20 websites for customers globally.

See his recent post on the Latest news of http://www.phil-taylor.com/

Quote:
A number of sites have been hacked due to a security vulnerability in extcalendar. There are a couple of issues which need to be considered in relation to this. Firstly all Joomla php files (other than the index.php files) should contain a line which prevents direct access to the file froma web browser. This line does the trick:

defined( ‘_VALID_MOS’ ) or die( ‘Restricted access’ );

This should be the first line of php code in the file.

Secondly if php is configured with allow_url_fopen set to “On” then the php code will be potentially able to open files on other servers, so the programmer must be very careful not to allow global variables in include/require statements.

A patched version of extcalendar.php is available to download (Link on the blog at http://blog.phil-taylor.com/ )

More information on register_globals.  (Link on the blog at http://blog.phil-taylor.com/ )



Thanks for posting this patch.  You said, "all Joomla php files (other than the index.php files) should contain a line which prevents direct access to the file from web browser." and yet the patch you've posted only adds that line to extcalendar.php.  So, does that line need to be added to all php files for the extCalendar component to patch the security vulnerability?  Or are you saying that best practice is to add that line to all php files, but in this case you really only need to update extcalendar.php?


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Wed Jul 12, 2006 6:43 pm 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Mon Oct 17, 2005 1:50 pm
Posts: 1025
Location: Närke, Sweden
I really like this calendar component and it's mini calendar with daily pictures.

I hope that someone can take care of the component and plugins and do an update to 1.5 standard and take away the security risk in it.
This was the first time I get hacked and it took me 2-3 hours to restore everything and do the updates in the ExCals php-files.

This time it seems that the hackers didn't destroy anything or put something own on the webplace, but next time??

/Sven
8)

_________________
-
Sanningen finns där ute, har du sökt efter ditt svar?
var svaret bra och löste ditt problem? Glöm då inte att ändra ditt första inlägg till löst (Solved)


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Thu Jul 13, 2006 7:59 am 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Mon Nov 28, 2005 5:00 pm
Posts: 32
Location: Mumbai, India
I also liked the component very much, but after going through varous security issues posted on this forum, a have uninstalled it and deleted all the folders relevant to it.

Even though I had applies all patches in the abovementioned discussion, made RG=off, written .htaccess file as per posts mentioned in other thread, I decided to delete the component for following reasons

1) Nobody is sure whether

defined( ‘_VALID_MOS’ ) or die( ‘Restricted access’ );
is the only problem.

2) There is no active development of this very beautiful component.

3) I don't want to get hacked again, and possibly this is the only vulnerable component I am using on my site. For other componets, either they are safe or there is no active discussion on their vulnerability.

_________________
A man is not finished when he is defeated,
He is finished when he quits


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Thu Jul 13, 2006 9:04 am 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Sun Aug 21, 2005 4:34 am
Posts: 34
Location: Melbourne, Australia
I have not yet implemented extCalendar, but I plan to on the new version of my site which i'm working on now.  I have been looking for a calendar component for my site for ages, that can do everything i need, and this is THE ONLY ONE that does it elegantly.

Therefore, I really really really still want to use it.  I do hope somebody can patch it.. either way I will be using it anyway... a more pressing concern for me than the security concerns (i'm sure there will be a fix for it eventually) is the fact that there is no active development, and it therefore may not work for Joomla 1.5... that is the most dissappointing thing for me. 

Anyway, thats my 2c worth... i'll be watching this forum to see what becomes of this whole saga.

thanks for all the info guys
greg

_________________
DoofCentral - Your Psychedelic Universe
http://www.doofcentral.com
- Trying to upgrade to Joomla, but that brick wall is starting to win the battle. :(


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Thu Jul 13, 2006 11:41 am 
Joomla! Fledgling
Joomla! Fledgling
Offline

Joined: Thu Jul 13, 2006 11:27 am
Posts: 1
I just registered to post these two links.  The vuneralibility talked about here has been known since April at http://forums.maroctour.com/index.php?action=displaythread&forum=extgeneral&id=231&realm=default in the extcal forums.  http://forums.maroctour.com/index.php?action=displaythread&forum=engineers&id=25&realm=default claims to have notified the Joomla Devs back on June 1st of this problem also.  The first offers a possible solution, but according to the second's description of the problem, it might not be complete.


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Thu Jul 13, 2006 12:07 pm 
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Mon Sep 05, 2005 3:50 pm
Posts: 248
Several of us are working on a patched version of Extcalendar. I hope we can have a release today or tomorrow.

Anyone interested in helping test this before releasing, please PM me.

If anyone else has started working on a patched ExtCalendar, please PM me as well and we can combine our efforts.

david


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Thu Jul 13, 2006 12:28 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Wed Aug 17, 2005 11:26 pm
Posts: 869
Further to what David has said, please read this post: http://forum.joomla.org/index.php/topic ... #msg394539

_________________
For Mambo assistance: http://forum.mambo-foundation.org
Open Source Research & Best Practice: http://osprojects.info


Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Thu Jul 13, 2006 7:38 pm 
User avatar
Joomla! Explorer
Joomla! Explorer
Offline

Joined: Sat Feb 11, 2006 9:43 pm
Posts: 279
Location: Birmingham, USA
I really like the extCalendar as well, and do not want to give it up  easily  8)

If to go to all the trouble to rename folder names, like com_extcalendar to something else, like com_bigbadwoolf, and all the references in the component and module files, that should make the renamed calendar invisible to any future automated attacks?  ???

Also, I just tested the script that I got hacked with against the identical Joomla site I have (one that I do not use anymore) by applying the script, and it gave me the same hack even with the

defined( ‘_VALID_MOS’ ) or die( ‘Restricted access’ );

inserted.

See this post for info and look at the proof of concept: http://www.securityfocus.com/archive/1/439451

What does the "sanitize variabel $mosConfig_absolute_path in extcalendar.php"  mean?



Check this post for the extcalendar

_________________
The key to your life is how well you deal with plan "B".
Latvian Project http://joomlacode.org/gf/project/joomla_latvian/ | http://www.joomlalv.org


Last edited by zuze on Thu Jul 13, 2006 8:03 pm, edited 1 time in total.

Top
  E-mail  
 
 Post subject: Re: ExtCalendar
Posted: Thu Jul 13, 2006 10:58 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Wed Aug 17, 2005 11:26 pm
Posts: 869
That vulnerability has already been fixed in the upgrade that we should have out soon.
We are in the final testing stages now.

_________________
For Mambo assistance: http://forum.mambo-foundation.org
Open Source Research & Best Practice: http://osprojects.info


Top
  E-mail  
 
Display posts from previous:  Sort by  
Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 289 posts ]  Go to page Previous  1, 2, 3, 4, 5 ... 10  Next

Quick reply

 



Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group