Forums / General / ezPublish 3.8.10 ~ file upload attack?

ezPublish 3.8.10 ~ file upload attack?

« 
Previous topic
|
General
|
Next topic
 »
Author Message

stephen Gazard

Friday 22 February 2008 3:53:21 am

Hello,

I'm running v3.8.10 our hosts have shut off access to the a site running ezpublish because they've told me it appears someone (IP address registered in Brazil) is/was trying to upload a file to the site attacking this version.

At the moment I'm sketchy on the details because my host has not (yet) provided me with much information, but I was wondering if anyone had similar problems. The secunia advisories and other such don't specify such a vulnerability, but I realise the 3.8.x branch is no longer supported.

This happened after a very recent upgrade from 3.8.6 (legacy site; we've taken over maintenance), but I'm wondering if anything is known, or what I should be checking for as I'm not very familiar with the workings.

Regards,
Stephen

Andreas Kaiser

Wednesday 27 February 2008 3:10:23 am

I would search the changelogs: http://ez.no/download/ez_publish/changelogs to find if there was any related security problem in 3.8.x versions corrected in 3.9.x (3.8.x is not more supported 3.8.10 was the last release...)

eZ Partner in Madrid (Spain)
Web: http://www.atela.net/

Ekkehard Dörre

Wednesday 27 February 2008 8:37:06 am

hi,

here are the known Security Advisories :

http://ez.no/developer/security/security_advisories

greetings, ekke

http://www.coolscreen.de - Over 40 years of certified eZ Publish know-how: http://www.cjw-network.com
CJW Newsletter: http://projects.ez.no/cjw_newsletter - http://cjw-network.com/en/ez-publ...w-newsletter-multi-channel-marketing

eZ debug

Timing: Jan 18 2025 11:22:06
Script start
Timing: Jan 18 2025 11:22:06
Module start 'content'
Timing: Jan 18 2025 11:22:06
Module end 'content'
Timing: Jan 18 2025 11:22:07
Script end

Main resources:

Total runtime0.8438 sec
Peak memory usage4,096.0000 KB
Database Queries196

Timing points:

CheckpointStart (sec)Duration (sec)Memory at start (KB)Memory used (KB)
Script start 0.00000.0070 587.7266180.8359
Module start 'content' 0.00700.6929 768.5625580.7188
Module end 'content' 0.69990.1439 1,349.2813332.7500
Script end 0.8437  1,682.0313 

Time accumulators:

 Accumulator Duration (sec) Duration (%) Count Average (sec)
Ini load
Load cache0.00440.5252210.0002
Check MTime0.00160.1921210.0001
Mysql Total
Database connection0.00110.133010.0011
Mysqli_queries0.765990.75981960.0039
Looping result0.00240.29001940.0000
Template Total0.798494.620.3992
Template load0.00220.263720.0011
Template processing0.796194.347620.3981
Template load and register function0.00020.019310.0002
states
state_id_array0.00100.123510.0010
state_identifier_array0.00120.147720.0006
Override
Cache load0.00180.2176180.0001
Sytem overhead
Fetch class attribute can translate value0.00140.168340.0004
Fetch class attribute name0.00190.219850.0004
XML
Image XML parsing0.00140.171540.0004
class_abstraction
Instantiating content class attribute0.00000.001250.0000
General
dbfile0.00370.4418330.0001
String conversion0.00000.000730.0000
Note: percentages do not add up to 100% because some accumulators overlap

CSS/JS files loaded with "ezjscPacker" during request:

CacheTypePacklevelSourceFiles
CSS0extension/community/design/community/stylesheets/ext/jquery.autocomplete.css
extension/community_design/design/suncana/stylesheets/scrollbars.css
extension/community_design/design/suncana/stylesheets/tabs.css
extension/community_design/design/suncana/stylesheets/roadmap.css
extension/community_design/design/suncana/stylesheets/content.css
extension/community_design/design/suncana/stylesheets/star-rating.css
extension/community_design/design/suncana/stylesheets/syntax_and_custom_tags.css
extension/community_design/design/suncana/stylesheets/buttons.css
extension/community_design/design/suncana/stylesheets/tweetbox.css
extension/community_design/design/suncana/stylesheets/jquery.fancybox-1.3.4.css
extension/bcsmoothgallery/design/standard/stylesheets/magnific-popup.css
extension/sevenx/design/simple/stylesheets/star_rating.css
extension/sevenx/design/simple/stylesheets/libs/fontawesome/css/all.min.css
extension/sevenx/design/simple/stylesheets/main.v02.css
extension/sevenx/design/simple/stylesheets/main.v02.res.css
JS0extension/ezjscore/design/standard/lib/yui/3.17.2/build/yui/yui-min.js
extension/ezjscore/design/standard/javascript/jquery-3.7.0.min.js
extension/community_design/design/suncana/javascript/jquery.ui.core.min.js
extension/community_design/design/suncana/javascript/jquery.ui.widget.min.js
extension/community_design/design/suncana/javascript/jquery.easing.1.3.js
extension/community_design/design/suncana/javascript/jquery.ui.tabs.js
extension/community_design/design/suncana/javascript/jquery.hoverIntent.min.js
extension/community_design/design/suncana/javascript/jquery.popmenu.js
extension/community_design/design/suncana/javascript/jScrollPane.js
extension/community_design/design/suncana/javascript/jquery.mousewheel.js
extension/community_design/design/suncana/javascript/jquery.cycle.all.js
extension/sevenx/design/simple/javascript/jquery.scrollTo.js
extension/community_design/design/suncana/javascript/jquery.cookie.js
extension/community_design/design/suncana/javascript/ezstarrating_jquery.js
extension/community_design/design/suncana/javascript/jquery.initboxes.js
extension/community_design/design/suncana/javascript/app.js
extension/community_design/design/suncana/javascript/twitterwidget.js
extension/community_design/design/suncana/javascript/community.js
extension/community_design/design/suncana/javascript/roadmap.js
extension/community_design/design/suncana/javascript/ez.js
extension/community_design/design/suncana/javascript/ezshareevents.js
extension/sevenx/design/simple/javascript/main.js

Templates used to render the page:

UsageRequested templateTemplateTemplate loadedEditOverride
1node/view/full.tplfull/forum_topic.tplextension/sevenx/design/simple/override/templates/full/forum_topic.tplEdit templateOverride template
3content/datatype/view/ezxmltext.tpl<No override>extension/community_design/design/suncana/templates/content/datatype/view/ezxmltext.tplEdit templateOverride template
4content/datatype/view/ezxmltags/paragraph.tpl<No override>extension/ezwebin/design/ezwebin/templates/content/datatype/view/ezxmltags/paragraph.tplEdit templateOverride template
1content/datatype/view/ezxmltags/line.tpl<No override>design/standard/templates/content/datatype/view/ezxmltags/line.tplEdit templateOverride template
2content/datatype/view/ezimage.tpl<No override>extension/sevenx/design/simple/templates/content/datatype/view/ezimage.tplEdit templateOverride template
1pagelayout.tpl<No override>extension/sevenx/design/simple/templates/pagelayout.tplEdit templateOverride template
 Number of times templates used: 12
 Number of unique templates used: 6

Time used to render debug report: 0.0001 secs