Welcome to Geeklog, Anonymous Saturday, October 12 2024 @ 12:28 am EDT

Comments for Geeklog security issues (and 1.3.7sr2 update)

Geeklog security issues (and 1.3.7sr2 update) | 43 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

Geeklog security issues - this really IS a serious issue

Authored by: gape on Saturday, May 31 2003 @ 04:45 pm EDT

(i allways do that stupidity - sorry for double posting)
**************************

this really IS a serious issue

i run a 1.3.6. (in a subdirectory) and today someone hacked into my site (root) and deleted index.shtml and has put index.php instead.
(that's the way i found out about the exploit, when i got to here ... this reminds me ... there shuld be a mailinglist for admins of geek, where dirk (or someone with proper permission) could inform us about that kind of serrious issues ... maybe this mailing list could be part of geek instalation ... it could (minding user settings) automatically mail-out new articles in folder anouncments, or all of them, or something)

that means that any file can be removed by the hacker (or is it cracker)?

i made temporary changes to my geeklog, hope all goes well with upgrade in next day or so.

ps
anyone can search for
Powered By GeekLog
if he/she has reason(s)

Geeklog security issues - this really IS a serious issue

Authored by: Dirk on Saturday, May 31 2003 @ 04:52 pm EDT

The issues that are fixed with 1.3.7sr2 should not enable anyone to upload files to your site. You may have another problem in your setup (see, for example, the comments on issues with Gallery in this thread).

Also, there is a geeklog-announce mailing list - the update was announced there. And, of course, the "GL Version Test" link in your Admin menu.

bye, Dirk

Geeklog security issues - this really IS a serious issue

Authored by: gape on Saturday, May 31 2003 @ 05:08 pm EDT

i made changes yust now
i still run v1.3.6.
i hope i don't have another problem

i'm going for geeklog anounce mailinglist right now

version test tells me only abut my current version and currently the newest version of geek.

i know that i'm running old version, but i had a nitemare upgrading to 136 (i got thru yust all the bugs there were, the one that emptyed my database all ower again (couse of incomlete language file) harased me most), and i wanted to upgrade to next clean version, that would be 1.3.8., but it seems that i will have to upgrade to 137 first.
i won't even ask when the 138 release will be released.

nevertheles

i must upgrade one more install of geek that i administer, this one is version 137r1
that means that i can replace old files with new ones.
the only trouble is with config.php
is there any new stuff in it besides warning about alowable html???

Geeklog security issues - this really IS a serious issue

Authored by: gape on Saturday, May 31 2003 @ 06:11 pm EDT

i upgraded all files that are in tarball except config.php
version test tells me that i'm still running version 137sr1.
i see that version is read from config.php ...
i suppose i'm encouraged to look at cvs or something for changes of config.php.
if there are yust these two changes, pls let me know.
it's too late now for a 'cvs jurney'.

Geeklog security issues - this really IS a serious issue

Authored by: Dirk on Saturday, May 31 2003 @ 06:24 pm EDT

Yes, the only changes in config.php were the version number and the warning about allowed HTML.

bye, Dirk

Geeklog security issues - this really IS a serious issue

Authored by: gape on Saturday, May 31 2003 @ 06:53 pm EDT

tnx a lot

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks