The Joomla! Forum ™

Download

Demo


Board index » Joomla! Older Version Support » Joomla! 1.0 » Security - 1.0.x

Forum rules


Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.



Post new topic Reply to topic  Page 1 of 1
  [ 2 posts ] 
  Print view Previous topic | Next topic 
Author Message
winuser
PostPosted: Thu Aug 16, 2007 6:47 pm 
Joomla! Intern
Joomla! Intern

Joined: Fri Aug 18, 2006 9:57 am
Posts: 99
Two Pro Edition users were notified by their service companies that a file in the J! Reactions commenting system was being used to send spam email (apparently French content). The problem has been traced specifically to the langset.php file (which is located in the administrator/components/com_jreactions folder. Build 1.9.0 will fix this problem, but the immediate action is to simply replace the langset.php file. Here it is:

Code:
<?php defined( '_VALID_MOS' ) or die( 'Direct access is prohibited.' );
global $mosConfig_lang;
if (file_exists("$comPath/custom/".$mosConfig_lang.".php")) {
   include("$comPath/custom/".$mosConfig_lang.".php");
} else {
   require("$comPath/custom/english.php");
} ?>


The security issue is caused by the fact that the old file does not check for VALID_MOS. I suggest that all J! Reactions' users (a) un-install the J! Reactions component in the normal manner, (b) double-check that ALL J! Reactions folders on the server are removed after the un-install, and (c) install build 1.9.0 when it is released in a few days. Any existing comment data will be safe in the data tables in the interim.

I apologize for any service interruptions resulting from this exploit.  :-[

_________________
Science • Education • Programming
Top
 Profile  
 
rliskey
PostPosted: Thu Aug 16, 2007 10:44 pm 
User avatar
Joomla! Guru
Joomla! Guru

Joined: Tue Jun 06, 2006 7:41 am
Posts: 828
Location: California, Germany, Norway
Thanks for reporting and for providing clear recovery directions.

Added to the Vulnerable Extensions list here:
http://help.joomla.org/component/option ... temid,268/

_________________
Home: http://www.ronliskey.com
Business http://www.communitygrove.com
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 1
  [ 2 posts ] 


Board index » Joomla! Older Version Support » Joomla! 1.0 » Security - 1.0.x

Who is online

Users browsing this forum: FAST WebCrawler [Crawler] and 15 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group