Advertisement:

Author Topic: SMF 1.1.6 Remote Code Execution Exploit  (Read 32676 times)

Offline osjak

  • Semi-Newbie
  • *
  • Posts: 23
Re: SMF 1.1.6 Remote Code Execution Exploit
« Reply #20 on: November 06, 2008, 03:34:40 PM »
In php you have three kinds of magic_quotes - which one need to be ON?
You have:
magic_quotes_gpc
magic_quotes_runtime
magic_quotes_sybase

I have magic_quotes_gpc as ON, but not sure regarding all others.

This is what I have:

Code: [Select]
admin@www1:~$ grep 'magic_quotes' /etc/php5/apache2/php.ini
magic_quotes_gpc = On
magic_quotes_runtime = Off
magic_quotes_sybase = Off

This settings seemed to prevent the exploit. I'm not an expert though, so take this with a grain of salt. I also implemented the advise from n3rve several posts above.

metallica48423, thank you for keeping us updated!

Offline 青山 素子

  • Server Team
  • SMF Super Hero
  • *
  • Posts: 17,022
  • 戦場ヶ原、蕩れ!
    • srvrguy on GitHub
    • @motokochan on Twitter
    • Nekomusume Moe
Re: SMF 1.1.6 Remote Code Execution Exploit
« Reply #21 on: November 06, 2008, 10:40:18 PM »
The magic_quotes_gpc setting should be the only one you need on.

I tested both exploits, and the package manager one doesn't work as advertised (you need to modify it a bit to get it working), but the theme one does work easily.

Note that 2.0 is not currently affected by either exploit as they are currently. So, at this point, 2.0b4 is unaffected. After working on the 1.1 issues, we will investigate the same areas in 2.0 to make sure they don't have a similar issue.

Edit: Also, the main funciton being used in the exploits to actually run things is passthru(). SMF doesn't use this function, so you can try disabling it in PHP if you have the access to do so. It won't stop the exploit, but should make it harder to get a payload running.
« Last Edit: November 06, 2008, 11:06:37 PM by Motoko-chan »
Motoko-chan
Director, Simple Machines

Just because it's pouring down doesn't mean we're gonna drown. There's a time when all you can say is let it rain - Mat Kearney (Let It Rain)

Note: Unless otherwise stated, my posts are not representative of any official position or opinion of Simple Machines.


Offline N3RVE

  • SMF Friend
  • SMF Hero
  • *
  • Posts: 8,906
  • Gender: Male
    • N3RVE.COM
Re: SMF 1.1.6 Remote Code Execution Exploit
« Reply #22 on: November 07, 2008, 08:39:34 AM »
Can we also ask that there will be instructions on how to update code manually? My sites are modified too heavily to be updated  conventional way.

There is a topic in the Install and Upgrade Help board where the Manual instructions are posted, I'll update the topic shortly after the release.

-[n3rve]
Ralph "[n3rve]" Otowo
Former Marketing Co-ordinator, Simple Machines.
ralph [at] simplemachines [dot] org                       
Quote
“Somewhere, something incredible is waiting to be known.” - Carl Sagan

Offline D M G

  • Semi-Newbie
  • *
  • Posts: 89
  • Gender: Female
Re: SMF 1.1.6 Remote Code Execution Exploit
« Reply #23 on: November 07, 2008, 08:18:53 PM »
Thanks to the team for addressing this so quickly. Also, thank you for not pandering to fearmongers like osjak who don't follow the rules for submitting vulnerabilities.

Offline osjak

  • Semi-Newbie
  • *
  • Posts: 23
Re: SMF 1.1.6 Remote Code Execution Exploit
« Reply #24 on: November 07, 2008, 09:22:42 PM »
Thanks to the team for addressing this so quickly. Also, thank you for not pandering to fearmongers like osjak who don't follow the rules for submitting vulnerabilities.

Fearmongers??? Let me remind you this is the only topic where this issue has been addressed by SMF team for everyone's (yours also) benefit. May be you don't care about your site's security but I certainly appreciate those suggestions from n3rve that helped everyone to wait for the release of 1.1.7 without losing their websites.

Offline D M G

  • Semi-Newbie
  • *
  • Posts: 89
  • Gender: Female
Re: SMF 1.1.6 Remote Code Execution Exploit
« Reply #25 on: November 07, 2008, 09:26:09 PM »
Laughable. Really. Don't tell me what I know and don't know about securing my site.

You could have handled this easily by informing the proper people, they even have a handy form to do so. Instead you came on here yelling and making those who don't know a whole lot except how to login to their board and not much else panic and fluster. It's pretty ignorant.
 


Offline osjak

  • Semi-Newbie
  • *
  • Posts: 23
Re: SMF 1.1.6 Remote Code Execution Exploit
« Reply #26 on: November 07, 2008, 09:33:24 PM »
I'm sorry for getting you into panic mode. My intent was to get information on how to secure SMF for myself and to those ho care. If you don't care, you may laugh all you want, up until the point when your website is taken out by a script kiddie.

Offline D M G

  • Semi-Newbie
  • *
  • Posts: 89
  • Gender: Female
Re: SMF 1.1.6 Remote Code Execution Exploit
« Reply #27 on: November 07, 2008, 09:36:08 PM »
Oh I didn't panic, you're deliberately misreading me but I'd expect that from someone of your calibre.


Offline metallica48423

  • SMF Friend
  • SMF Super Hero
  • *
  • Posts: 19,842
  • Gender: Male
  • Professional Multislacker!
    • Zentendo
Re: SMF 1.1.6 Remote Code Execution Exploit
« Reply #28 on: November 07, 2008, 10:20:21 PM »
Guys, please take this out of these boards.  we have a policy of respect and fairness here.

Nobody's right or wrong.  This topic was not the first nor the last notification we got on the issue so fortunately it was already under ways when this came up.

The important thing is key -- we need to know about these things to fix them.
Justin O'Leary
Ex-Project Manager
Ex-Lead Support Specialist

Quote
Microsoft wants us to "Imagine life without walls"...
I say, "If there are no walls, who needs Windows?"

Useful Links:
Online Manual!
How to Help us Help you   
Search
Settings Repair Tool
     

Offline palofdru

  • Jr. Member
  • **
  • Posts: 203
Re: SMF 1.1.6 Remote Code Execution Exploit
« Reply #29 on: November 08, 2008, 05:41:54 AM »
Thanks to the team for addressing this so quickly. Also, thank you for not pandering to fearmongers like osjak who don't follow the rules for submitting vulnerabilities.
^^ :( typical.

"User who raised legitimate concern attacked by "rabid fanboy".


SMF, as a commercial enterprise, zealously guards it's reputation, sometimes I think, at the expense of transparency and openness.

Regarding osjak's post,  I'm not a fan of posting direct links to exploits, without additional narrative, primarily because the risk is not 'exposing exploits to hackers whom may already be aware of them' but rather disseminating hacker info to disgruntled forum members who have been banned, disciplined or are just plain "idle hands assholes"

However, I would have hoped that when news of the exploit was first released, SMF gave the exploit a bit more coverage, say on the front page.

ie.
and immediately and prominently pointing to the initial work around, to be implemented in the immediate hours before a sanctioned update is available.

There is something creepily Orwellian with the 'disappearing' of posts, almost as if we are more concerned with perception management and not security. Heck, I'm not asking nor even expecting SMF to be totally secure! The  current White House is as paranoid and closed as they come, and even they got hacked, so yeah, sh*t happens, but dont cover it up, missquote/missrepresent and downplay issues.
My best suggestion to you is that you do whatever you feel like doing, for whatever reason you choose to make, without any required explanation nor justification. You probably will, so hop to it!

boo hoo!