Geeklog security issues (and 1.3.7sr2 update)

Welcome to Geeklog Thursday, January 27 2022 @ 03:05 am EST

Geeklog security issues (and 1.3.7sr2 update) | 43 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

Geeklog security issues (and 1.3.7sr2 update)

Authored by: Anonymous (Anonymous User) on Thursday, May 29 2003 @ 12:23 am EDT

I tried upgrading my 1.3.6 to 1.3.7sr2, but every time I get to the install script step, the db upgrade fails. However, if I just forget about that and load up the site, everything works just fine, as far as I can tell.

The error I'm getting from the install script is:
1044: Access denied for user: 'FOO@localhost' to database 'FOO'

Naturally, I've replaced my user and db names with FOO for obfuscation.

What can I do here? The site seems to work, and the user/db/password are clearly working because the site, using the 1.3.7sr2 scripts, is clearly getting accessed and serving up the right stuff. So what would possibly cause the access error?

One strange bit about the setup I have. I have to work with the system that I'm given. By default the web-accessible directory is ~, not ~/public_html/. So, I have geeklog installed in ~/geeklog-1.3.7sr2/ and then copied ~/geeklog-1.3.7sr2/public_html/* to ~ (with cp -a). Clearly config.php and lib-common.php are doing the "right thing" and reading the files from the appropriate locations, but is there some odd bit of the upgrade script that would prevent a setup like this from working? It doesn't seem to make sense to me, but I don't understand php/mysql.

Any and all help appreciated. :^) Can provide more details, if necessary. ;^)

Geeklog security issues (and 1.3.7sr2 update)

Authored by: Anonymous (Anonymous User) on Friday, May 30 2003 @ 07:40 pm EDT

I think I will wait for the patch to stabalize. I think I have less chance being hacked then taking a chance and having to deal with a customers site all weekend. Damn, things 'just' got quiet!

Geeklog security issues (and 1.3.7sr2 update)

Authored by: Dirk on Saturday, May 31 2003 @ 03:58 am EDT

I wouldn't wait with the upgrade, if I were you.

The above post seems to be a local issue with the poster's MySQL install (and I think it was solved on IRC yesterday). Nothing to do with Geeklog or the update.

To repeat: This is a really serious issue. If you know how, you can log into any unpatched site as the Admin. Surely, you don't want that?

bye, Dirk

Geeklog security issues (and 1.3.7sr2 update)

Authored by: Anonymous (Anonymous User) on Saturday, May 31 2003 @ 04:41 pm EDT

this really IS a serious issue

i run a 1.3.6. (in a subdirectory) and today someone hacked into my site (root) and deleted index.shtml and has put index.php instead.
(that's the way i found out about the exploit, when i got to here ... this reminds me ... there shuld be a mailinglist for admins of geek, where dirk (or someone with proper permission) could inform us about that kind of serrious issues ... maybe this mailing list could be part of geek instalation ... it could (minding user settings) automatically mail-out new articles in folder anouncments, or all of them, or something)

that means that any file can be removed by the hacker (or is it cracker)?

i made temporary changes to my geeklog, hope all goes well with upgrade in next day or so.

ps
anyone can search for
Powered By GeekLog
if he/she has reason(s)

Geeklog

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks