The Joomla! Forum ™

Download

Demo


Board index » Joomla! Older Version Support » Joomla! 1.0 » Security - 1.0.x » 3rd Party/Non Joomla! Security Issues



Post new topic Reply to topic  Page 1 of 1
  [ 17 posts ] 
  Print view Previous topic | Next topic 
Author Message
smart
PostPosted: Mon Aug 21, 2006 11:04 am 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Thu Aug 18, 2005 1:33 pm
Posts: 109
Location: Sebastopol
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Unpatched

Software: bigAPE-Backup 1.x (component for Mambo)

Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it.

Description:
mdx has discovered a vulnerability within bigAPE-Backup, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "mosConfig_absolute_path" parameter in components/com_babackup/classes/Tar.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources.

The vulnerability has been confirmed in version 1.1. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly verified.

Read more: http://secunia.com/advisories/21574/

_________________
Joomlaportal.ru News, articles and tutorials
Joomlaforum.ru Russian Joomla Support Forum
Member of the Russian Joomla Translation Team
Top
 Profile  
 
rswennen
PostPosted: Fri Sep 01, 2006 11:35 am 
Joomla! Apprentice
Joomla! Apprentice

Joined: Sun Dec 04, 2005 9:02 am
Posts: 28
smart wrote:

Solution:
Edit the source code to ensure that input is properly verified.



Hi does anybody know what code parts need to be edited ?
Top
 Profile  
 
shumisha
PostPosted: Fri Sep 01, 2006 12:38 pm 
Joomla! Guru
Joomla! Guru

Joined: Sat Aug 20, 2005 3:15 pm
Posts: 508
This usage of mosConfig_absolute_path could be prevented by adding :

Code:
/** ensure this file is being included by a parent file */
defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );

at the very top of each file. There are several of them not having this, and they should!

Confirmation from core or experienced developer is needed here though!

[EDIT] after checking more, only Tar.php needs this fix. Other files missing it do not require as they are only libraries and do not have directly executable code in them

_________________
See all about sh404sef at http://dev.anything-digital.com/
I don't reply to PM anymore. Thanks for using sh404SEF


Last edited by shumisha on Sat Sep 02, 2006 12:48 pm, edited 1 time in total.

Top
 Profile  
 
bigAPE
PostPosted: Mon Sep 04, 2006 3:35 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice

Joined: Sat Mar 25, 2006 8:20 am
Posts: 6
Location: Cornwall, UK
I have patched and attached the Tar.php file, it was obtained from a PHP resource (thought it was PEAR, but might be wrong). I'm not currently ready to release a new version of the bigAPE Backup as we are working on a v1.6 which will be released in the near future

Hope this resolves the issue


You do not have the required permissions to view the files attached to this post.

_________________
bigAPE Development Ltd | www.bigape.co.uk
Top
 Profile  
 
cmyksteve
PostPosted: Sun Sep 10, 2006 1:07 am 
User avatar
Joomla! Intern
Joomla! Intern

Joined: Sat Aug 20, 2005 5:20 am
Posts: 51
Location: Ohio
Thanks bigAPE for a very usefull component. I unistalled this and others on the security risk list. Hopefully bigAPE-Backup gets the "Fixed" flag flying soon on the list- I'm ready to get away from my cPanel backups and re-install your patched component.

_________________
Steve
Top
 Profile  
 
bigAPE
PostPosted: Sun Sep 10, 2006 5:26 am 
User avatar
Joomla! Apprentice
Joomla! Apprentice

Joined: Sat Mar 25, 2006 8:20 am
Posts: 6
Location: Cornwall, UK
cmyksteve wrote:
Thanks bigAPE for a very usefull component. I unistalled this and others on the security risk list. Hopefully bigAPE-Backup gets the "Fixed" flag flying soon on the list- I'm ready to get away from my cPanel backups and re-install your patched component.


Your very welcome. We are only sorry that our commercial projects have kept us away from our GPL CMS Components. We do have a new version almost ready to go. It includes much better Database Backup code and the ability to migrate content articles between Mambo/Joomla sites. It needs a further round of testing and updated documentation, but I feel we are close to releasing it for Beta.

_________________
bigAPE Development Ltd | www.bigape.co.uk


Last edited by bigAPE on Sun Sep 10, 2006 5:28 am, edited 1 time in total.

Top
 Profile  
 
cmyksteve
PostPosted: Thu Sep 14, 2006 5:48 pm 
User avatar
Joomla! Intern
Joomla! Intern

Joined: Sat Aug 20, 2005 5:20 am
Posts: 51
Location: Ohio
Could someone from the Security Team please give us the thumbs up or down on the patch bigAPE has supplied for his backup component. As of 9.24.06, it's still number 6 on the RobS hit list  ;)
http://forum.joomla.org/index.php/topic,79477.0.html.

_________________
Steve


Last edited by cmyksteve on Mon Sep 25, 2006 3:51 am, edited 1 time in total.

Top
 Profile  
 
Lenn-art
PostPosted: Mon Sep 18, 2006 10:50 am 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Tue Dec 06, 2005 1:06 pm
Posts: 215
Location: Woerden, NL
bigAPE wrote:
cmyksteve wrote:
Thanks bigAPE for a very usefull component. I unistalled this and others on the security risk list. Hopefully bigAPE-Backup gets the "Fixed" flag flying soon on the list- I'm ready to get away from my cPanel backups and re-install your patched component.


Your very welcome. We are only sorry that our commercial projects have kept us away from our GPL CMS Components. We do have a new version almost ready to go. It includes much better Database Backup code and the ability to migrate content articles between Mambo/Joomla sites. It needs a further round of testing and updated documentation, but I feel we are close to releasing it for Beta.


Can you give us some kind of timeline (not that we will keep you at this timeline :) - but only for the idea).
Top
 Profile  
 
cmyksteve
PostPosted: Sun Sep 24, 2006 2:39 am 
User avatar
Joomla! Intern
Joomla! Intern

Joined: Sat Aug 20, 2005 5:20 am
Posts: 51
Location: Ohio
Has anybody re-installed the bigAPE backup component since the security patch was released? Any security issues with it?

_________________
Steve
Top
 Profile  
 
cmyksteve
PostPosted: Thu Oct 05, 2006 9:49 pm 
User avatar
Joomla! Intern
Joomla! Intern

Joined: Sat Aug 20, 2005 5:20 am
Posts: 51
Location: Ohio
Has anyone from the security team taken a look at the patch that bigAPE provided in this thread a few messages back?
I see a new vulnerability list has been posted in the forum and the bigAPE backup compenent is still listed but my guess is that his patch has been overlooked. I've gotten no replies from the PMs sent to smart or RobS concerning this component.

_________________
Steve
Top
 Profile  
 
ccondrup
PostPosted: Wed Oct 18, 2006 6:52 am 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Tue Aug 23, 2005 9:54 am
Posts: 219
Location: Oslo
Be sure to not leave generated archives (backups) on the server, read more here: http://dev.joomla.org/component/option, ... ,33/p,198/

_________________
Did you know there's a Joomla irc channel? Chat to Joomla people live 24/7 - Join #joomla on the Freenode network ( irc.freenode.net )
Top
 Profile  
 
shumisha
PostPosted: Wed Oct 18, 2006 7:02 am 
Joomla! Guru
Joomla! Guru

Joined: Sat Aug 20, 2005 3:15 pm
Posts: 508
I have also PM Robs on this several weeks ago, with no response. Just wondering whether they think the patch is not enough!

[EDIT] I have just PMed Ron Liskey about this

_________________
See all about sh404sef at http://dev.anything-digital.com/
I don't reply to PM anymore. Thanks for using sh404SEF


Last edited by shumisha on Wed Oct 18, 2006 7:10 am, edited 1 time in total.

Top
 Profile  
 
rliskey
PostPosted: Fri Oct 20, 2006 4:21 pm 
User avatar
Joomla! Guru
Joomla! Guru

Joined: Tue Jun 06, 2006 7:41 am
Posts: 828
Location: California, Germany, Norway
The vulnerabilities list is updated with a link back to this topic.

_________________
Home: http://www.ronliskey.com
Business http://www.communitygrove.com
Top
 Profile  
 
cmyksteve
PostPosted: Fri Oct 20, 2006 4:47 pm 
User avatar
Joomla! Intern
Joomla! Intern

Joined: Sat Aug 20, 2005 5:20 am
Posts: 51
Location: Ohio
Thanks rliskey-

...for approving the security patch to the bigAPE Backup component. It's a great Joomla backup solution especially for those just learning about site maintenance.

_________________
Steve
Top
 Profile  
 
ggouweloos
PostPosted: Tue Dec 26, 2006 12:49 pm 
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Tue Sep 06, 2005 8:13 am
Posts: 217
The classes\PEAR.php file does not contain the lines
Code:
/** ensure this file is being included by a parent file */
defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );


Is this safe?
Top
 Profile  
 
rliskey
PostPosted: Mon Jan 08, 2007 5:37 am 
User avatar
Joomla! Guru
Joomla! Guru

Joined: Tue Jun 06, 2006 7:41 am
Posts: 828
Location: California, Germany, Norway
Quote:
Thanks rliskey-

...for approving the security patch to the bigAPE Backup component.


Please note that we CANNOT "approve" third party code. We are only collecting and passing on information as it is reported to us. Each site administrator is still responsible for deciding if third party code meets their particular site security requirements.

_________________
Home: http://www.ronliskey.com
Business http://www.communitygrove.com
Top
 Profile  
 
bigAPE
PostPosted: Mon Jan 29, 2007 5:48 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice

Joined: Sat Mar 25, 2006 8:20 am
Posts: 6
Location: Cornwall, UK
Thanks for all your comments guys, we have been swamped with work over the last two years and we are currently emigrating out to Melbourne, Australia. Our workload will relax within the next few weeks and we will have much more time to put into Joomla. Fear not, we have not forgotten you.

Al

_________________
bigAPE Development Ltd | www.bigape.co.uk
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 1
  [ 17 posts ] 


Board index » Joomla! Older Version Support » Joomla! 1.0 » Security - 1.0.x » 3rd Party/Non Joomla! Security Issues

Who is online

Users browsing this forum: No registered users and 4 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group