Welcome to Geeklog, Anonymous Monday, September 16 2024 @ 06:31 am EDT

Comments for Current Security Issues (Sept 2003)

Current Security Issues (Sept 2003) | 29 comments | Create New Account

The following comments are owned by whomever posted them. This site is not responsible for what they say.

Current Security Issues (Sept 2003)

Authored by: Anonymous (Anonymous User) on Tuesday, October 07 2003 @ 02:41 pm EDT

Geeklog Security Fixes

Here there are the needed codes and instructions for protect your Geeklog installation from bad users and the latest security holes ( reported by Lorenzo Hernandez Garcia-Hierro ) that are SQL Injections and Cross Site Scripting attacks.

Fix 1: The simple one-Cut & Paste

Cut this code and then put it in the first line of:
/[PATH TO YOUR GEEKLOG CORE FILES/CONFIG]/system/lib-security.php

Put it after the php tag

// ---
// Geeklog Security Fix against SQL Injections and XSS attacks
// By Lorenzo Hernandez Garcia-Hierro
// No Secure Root Group Security Research
// ---
foreach ($HTTP_GET_VARS as $secvalue) {
if ((eregi("<[^>]*script*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*iframe*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*style*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*span*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*h1*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*table*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*body*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*pre*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*em*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*input*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*td*"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*option*"?[^>]*>", $secvalue)) ||
(eregi(";", $secvalue)) ||
(eregi("'", $secvalue)) ||
(eregi("´", $secvalue)) ||
(eregi("`", $secvalue)) ||
(eregi("+", $secvalue)) ||
(eregi(""", $secvalue))) {
die (";-) whereis *censored* *censored*: you");
}
}

This will we included in all the files of Geeklog , providing full protection against SQL Injection and Cross Site Scripting Attacks.

Fix 2: Obscure It !

This will stop the MySQL errors reporting to users , Geeklog will not show an error output in web pages.

Edit the lib-database.php file in /system/ dir

Go to line 152, and then edit , this is the original code:

function DB_query($sql, $ignore_errors=0)
{
global $_DB;

return $_DB->dbQuery($sql,$ignore_errors);
}

Replace it with:

function DB_query($sql, $ignore_errors=1)
{
global $_DB;

return $_DB->dbQuery($sql,$ignore_errors);
}

No more MySQL errors outputs in html pages !

NOTE: By editing the line 441 you can suppress completely the error ouput or add your own routines to the DB_error() function.

These fixes are made by Lorenzo Hernandez Garcia-Hierro due to the completely incorrect and non-professional behavior of the Geeklog Development Team.

Last Updated Sunday, October 05 2003 @ 11:01 PM CEST

------------------------------------------------------------------------

Get real, pitch in. I might not agree with the developers on all issues, but at least I play nice with them.

I would like to recognize the restraint, patience, and professionalism of our developers. Gentlemen I salute you in your efforts in looking to these problems and finding solutions that keep with the geeklog ideals.

And Mr.Garcia-Hierro, I salute you for you contributions to the GL community and efforts on our behalf. I hope you will continue in your passionate search for GL security loopholes, and for providing us with possible patches.

The first part of this post is to provide information to our developers, who most likely have already seen it via telnet/Http gateways that do not have banned ip's..... The same way I did.

Thank you all, and I hope that future interactions will be filled with a spirit of cooperation, as opposed to one of conflict.

Enjoy your day.

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks