Username
Password
0 Members and 1 Guest are viewing this topic.
The Simple Machines Team has recently identified and patched an attack against all versions of SMF. The development team has fixed the underlying issue to ensure this type of attack can not re-occur. SMF 1.0.17, SMF 1.1.9 and SMF 2.0 RC1.1, have been released as a result.Symptoms of an infected forum may include: * A member with a very small (1x1 pixels) white avatar with .jpg extension * Random spam links in the theme that can be found by viewing the source in your browser * An extra theme being added to the database, usually with ID = 32To better aid our users, we have created a tool to enable clean up of an infected site. This tool can be run on any SMF forum. It should remove the infection code from any files that happened to be hit. It also raises flags on the following possible files/matches: * Those mentioned in the exploit source * Fully numeric .php filenames * No-extension filenames (doesn't match directories)If you are not sure if you have been hit, please do try out the tool. If you feel you are still infected after using the tool, please create a support topic for one of our support team to assist you.
So a couple days ago a friend of mine had his forum exploited and a fairly complicated PHP-based trojan got uploaded onto it. I still have not finished disassembly of it, partly due to having too little time and partly due to the fact that it's actually surprisingly complex and well-written, and also stupidly obfuscated in annoying ways (all the variables are what appear to be RC4 hashes, for instance. Makes reading painful until you do a search-and-replace).Anyway, a couple minutes of googling around reveals that the exploit vector is the attachment upload/avatar upload code. A bit of poking around the codebase of SMF shows that at a key point it is possible to get your custom code included in the rest of the forum codebase.So eventually shit hit the fan and there's an automated bot going around and infecting all SMF-based forums. So SMF is forced to release a fix. This is quite easily the most pathetic attempt at a fix for a security hole that I have ever seen in my entire life. There are two parts to it, the first is a file with the following contents in it:<Files *>IOrder Deny,AllowIDeny from allIAllow from localhost</Files>RemoveHandler .php .php3 .phtml .cgi .fcgi .pl .fpl .shtmlYes, that's right, their idea of a fix is a fucking .htaccess file you drop in your /attachments/ dir that removes a couple protocol handlers and then sets the executable flag on everything in the dir to off. This completely does not fix the exploit at all, as you could just, ya know, upload a file with an executable extension not listed above (say python or ruby or even a fucking dll file) and it'll still get through, not to mention the fact that this underlying bug still exists in the code means you can just use this wonderous concept called XSS. Which we've known about since uh...early 2000? If not earlier.The other part of the fix is a minor change to ManageAttachments.php which adds a file hash, the ability to store hashes of files and a line that denys uploading of that one file which is being used to infect forums automatically by means of some bot which typically uses the nick "Krisbarteo".Now, the nice thing about hashes is you can change a single byte in the file, say, for instance, one of the VARIABLE NAMES, and this bypasses this pathetic attempt at a blocked upload trivially.So in short, this isn't even remotely close to a patch. It does not fix the security hole at all, it's still there and still exploitable. The attempts it tries to mitigate it are pitiful at best and just downright awful at worst.Let's see if I can get the guys at SMF to win a Pwnie Award for this year for "Worst Vendor Response to a Security Problem". Seriously. What the fuck, guys?!?
Your Favorite Adult Gaming Clan & Community | FaLLeN Clan
Your Daily Dilbert
Your Daily Dilbert