Phpbb Security Vulnerablity - is CPG Nuke affected? :: Archived

jstillion

I just says this on the tech sites....

www.kaspersky.com/news?id=156681162

Santy.a is something of a novelty - it creates a specially formulated Google search request, which results in a list of sites running vulnerable versions of phpBB. It then sends a request containing a procedure which will trigger the vulnerability to these sites. Once the attacked server processes the request, the worm will penetrate the site, gaining control over the resource. It then repeats this routine.

I was wondering if CPG Nuke 8.2B is affected / abled to be scanned?
I do have the Critical phpBB Exploit Affects 8.x patched from the post on this main site.

djdevon3 · Gold Supporter Offline Joined: Aug 05, 2004 Posts: 4363

www.f-secure.com/v-des...ty_a.shtml

Is the 8.2b viewtopic patch that was released 2 weeks ago already cover this or should we expect something new from the security team?

Trevor

The viewtopic patch should cover this.

djdevon3 · Gold Supporter Offline Joined: Aug 05, 2004 Posts: 4363

sounds like someone came up with it after they found the security hole and coded the worm for it? and i thought i had no life. whoever does something like that has deep issues. they should coin the phrase internet terrorism. that's all these viruses and worms do. it just incites hatred for those that make them. that's not gaining popularity for your skills. that's being a big lamer.

Phoenix

djdevon3 wrote:

they should coin the phrase internet terrorism.

Someone did, long ago, but not for that context.
en.wikipedia.org/wiki/..._terrorism

djdevon3 · Gold Supporter Offline Joined: Aug 05, 2004 Posts: 4363

Think about it. Worms like this destroy entire communities. Just because it doesn't kill someone doesn't mean it's not terrorism. {expletive removed} like this should be handled by the FBI or interpol.

shimon · Nice poster Offline Joined: Jul 25, 2004 Posts: 146

this is why cpgnuke need a better backing up system but luckly for me vhcs my control panel on my server has advance site back uping features

blackmetalcouk · Newbie Offline Joined: Oct 22, 2004 Posts: 36

is version 9.0 affected?

tank

blackmetalcouk wrote:

is version 9.0 affected?

as it states on the home page 9.0 is not effected by the highlight hack

run0 · Supporter Offline Joined: Jun 28, 2004 Posts: 1559

story.news.yahoo.com/n...rld/119051

theyre coming...

shimon · Nice poster Offline Joined: Jul 25, 2004 Posts: 146

oh ows i feel sorry for the people who went on and are not by the server to fix this

Śyama_Dāsa

While this wont help for other variants or help secure unsecure sites, this helps cut down the traffic created by the current worm
add to .htaccess (requires mod rewrite)

Code::

#Check for Santy Worms and redirect them to 404
#Variant -1
RewriteCond %{HTTP_USER_AGENT} ^LWP             [NC,OR]
#Variant -2
RewriteCond %{REQUEST_URI} ^visualcoders                [NC,OR]
#Variant -3
RewriteCond %{QUERY_STRING} rush=([^&]+)                [NC]
RewriteRule ^.*$ [F]

this script is a variant on Raven's
thanks raven

xfsunoles

akamu, that doesn't block wget.

Stephen · Silver Supporter Offline Joined: Apr 21, 2004 Posts: 734

This is the latest, ravenphpscripts.com/po...html#29267
A cheap solution is to rename wget. Or just chmod it so only root can use it. And other files in /bin

/edit
Also see this, cpgnuke.com/Forums/vie...html#39384

Jeruvy

Quote::

This is the latest, ravenphpscripts.com/po...html#29267
A cheap solution is to rename wget. Or just chmod it so only root can use it. And other files in /bin/edit
Also see this, cpgnuke.com/Forums/vie...html#39384

Better to create a special user with root privileges (suid) JUST for wget and then disable it for all other users.

Additionally, why would your server every run wget in the first place?

Oh nevermind, I know that answer already Wink