[Alert / phpBB] NeverEverNoSanity WebWorm uitbraak *

It looks like this special attack might have come through pre-2.0.11 phpBB installations via the so-called "highlight exploit".

phpBB users not running version 2.0.11 yet should

- upgrade to 2.0.11 at the earliest possibility
- if that's not possible right away, implement this quick fix: http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240513

What's going on:

- They're looking for URLs containing "viewtopic.php" via Google
- via the highlight exploit they use system() and fwrite() calls to place the worm code somewhere on the file system
- php, htm files (and others) are overwritten in all directories accessible from the web root (thus affecting Mambo setups also though Mambo is not the door through which they came in).

This seems to be a massive, ongoing attack on phpBB boards.
(Information taken from the German phpBB support board: http://www.phpbb.de/viewtopic.php?t=73427&highlight=)

Kind regards,
Zorro

[ Voor 73% gewijzigd door anandus op 21-12-2004 13:49 ]

edit:
hoi King_Louie

A published exploit demonstrates how to use new security holes in PHP to steal database passwords for the popular phpBB bulletin board program. The release of a working exploit on Friday, just two days after the flaws were announced, provides additional incentive for web hosts to upgrade to secure new versions of PHP.

The phpBB development team has notified users of the exploit, which was published on the BugTraq mailing list and several web sites. "This is not a phpBB exploit or problem, it's a PHP issue and thus can affect any PHP script which uses the noted functions," the phpBB advisory said, urging users and hosting providers to upgrade their PHP installations. Similar advice is being offered by the PHP project site, which has fixed the bugs in versions 4.3.10 and 5.0.3.

PHP, an open source server-side scripting language, is widely used to power web applications that connect with databases such as MySQL, and is commonly bunded with shared hosting accounts offered by web hosting providers. phpBB is among the web's most popular bulletin board programs, with more than 156,000 registered members of its user forum.

The phpBB exploit targets flaws in the way PHP stores path information and decodes stored data with the unserialize function. An attacker can use these weaknesses to craft a cookie-and-code combo that can access phpBB's configuration file and retrieve the username and password of the application's MySQL database.

Similar flaws could affect other popular web applications, including the Invision Power Board, vBulletin and PHPAds(New), which all use the unserialize function to access data stored in a cookie, according to Stefan Esser of The Hardened PHP Project, which released the initial advisory Thursday.

The Hardened-PHP project, which creates patches to enhance the security of PHP, is not going to release exploits. But Esser said exploits were not exceptionally difficult to create for users with a strong knowledge of PHP. Several security-oriented web sites are offering tips to secure PHP on a web server.

Multiple vulnerabilities have been reported in PHP, which can be exploited to gain escalated privileges, bypass certain security restrictions, gain knowledge of sensitive information, or compromise a vulnerable system.

1) An integer overflow in the "pack()" function can be exploited to cause a heap-based buffer overflow by passing some specially crafted parameters to the function.

Successful exploitation bypasses the safe_mode feature and allows execution of arbitrary code with the privileges of the web server.

2) An integer overflow in the "unpack()" function can be exploited to leak information stored on the heap by passing specially crafted parameters to the function.

In combination with the first vulnerability, this may also allow bypassing of heap canary protection mechanisms.

3) An error within safe_mode when executing commands can be exploited to bypass the safe_mode_exec_dir restriction by injecting shell commands into the current directory name.

Successful exploitation requires that PHP runs on a multi-threaded Unix web server.

4) An error in safe_mode combined with certain implementations of "realpath()" can be exploited to bypass safe_mode via a specially crafted file path.

5) An error within the handling of file paths may potentially lead to file inclusion vulnerabilities. The problem is that "realpath()", which in some implementations truncate filenames, is used in various places to obtain the real path of a file.

6) Various errors within the deserialization code can be exploited to disclose information or execute arbitrary code via specially crafted strings passed to the "unserialize()" function.

7) An unspecified error in the "shmop_write()" function may result in an attempt to write to an out-of-bounds memory location.

An unspecified boundary error exists in the "exif_read_data()" function when handling long section names.

9) An error in the "addslashes()" function causes it to not escape NULL bytes correctly. This can e.g. be exploited to read arbitrary files on a system, if the "include()" or "require()" statements partly use user-supplied input.

10) An error within "magic_quotes_gpc" may allow a one-level directory traversal when uploading files with a single quote in the filename (e.g. "..'file.ext").

NOTE: Other potential security issues have also been reported.

[ Voor 127% gewijzigd door anandus op 21-12-2004 14:29 ]

Kees schreef op dinsdag 21 december 2004 @ 15:06:
Een andere user had de code van de worm hier op got gezet, basicly deed die code zoeken op google naar phpbb forums, en die vervolgens via de highlight functie (en de (un)serialize flaw van php) besmetten. Vervolgens zoekt hij de schijf af op php, html, asp e.d. bestanden en vervangt die door een eigengemaakte pagina.

Following my original post it has been brought to our attention that the highlighting exploit can be taken advantage of, and it a serious way. We are hastily preparing a new release. However that release contains a number of other fixes and additions and thus we carrying out some internal testing to limit the chances of other issues arising.

In the mean time we strongly, and I mean strongly! urge all our users to make the following change to viewtopic.php as a matter of urgency.

Open viewtopic.php in any text editor. Find the following section of code:
Code:

//
// Was a highlight request part of the URI?
//
$highlight_match = $highlight = '';
if (isset($HTTP_GET_VARS['highlight']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars(urldecode($HTTP_GET_VARS['highlight']))));

for($i = 0; $i < sizeof($words); $i++)
{

and replace with:
Code:

//
// Was a highlight request part of the URI?
//
$highlight_match = $highlight = '';
if (isset($HTTP_GET_VARS['highlight']))
{
// Split words and phrases
$words = explode(' ', trim(htmlspecialchars($HTTP_GET_VARS['highlight'])));

for($i = 0; $i < sizeof($words); $i++)
{

Please inform as many people as possible about this issue. If you're a hosting provider please inform your customers if possible. Else we advise you implement some level of additional security if you run ensim or have PHP running cgi under suexec, etc.

[ Voor 11% gewijzigd door anandus op 21-12-2004 15:29 ]

Verwijderd schreef op dinsdag 21 december 2004 @ 16:48:
[...]

http://www.phpbb.com/phpBB/viewtopic.php?t=240636
Die update is er dus al even...(Nog geen 24 uur na het door jou genoemde topic).

Ik hoef je toch niet uit te leggen hoe een forum werkt he?

mosymuis schreef op woensdag 22 december 2004 @ 17:12:
[...]

Je haalt twee dingen door elkaar. De PHP unserialize() bug van 15/12 in PHP4 < 4.3.10 en PHP5 < 5.0.3, en de phpBB urldecode() highlight bug van 12/11 in phpBB < 2.0.11. Hoewel er voor beiden phpBB exploits circuleren maakt dit virus gebruik van de phpBB bug. Met de PHP bug exploit is het überhaupt niet mogelijk bestanden te wijzigen.

Phpbb zegt:

Recently a serious exploitable issue was discovered in PHP (the scripting language in which phpBB, IPB, vB, etc. are written) versions prior to 4.3.10. The problematical functions include unserialize and realpath. phpBB (along with a great many other scripts including IPB, vB, etc.) use these two functions as a matter of course.
...
Remember, this is not a phpBB exploit or problem, it's a PHP issue and thus can affect any PHP script which uses the noted functions.

* anandus weet het even niet meer