Planeta Srbija

This seems like a day for some nasty bugs on the web. As I mentioned in my earlier post, latest PHP has new/old flow in it. Two days ago a new tool for doing DoS attacks on Apache web server was released and it’s called Slowloris. From the web page of the creator of this nifty Perl tool: "Slowloris holds connections open by sending partial HTTP requests. It continues to send subsequent headers at regular intervals to keep the sockets from closing. In this way webservers can be quickly tied up. In particular, servers that have threading will tend to be vulnerable, by virtue of the fact that they attempt to limit the amount of threading they’ll allow. Slowloris must wait for all the sockets to become available before it’s successful at consuming them, so if it’s a high traffic website, it may take a while for the site to free up it’s sockets. So while you may be unable to see the website from your vantage point, others may still be able to see it until all sockets are freed by them and consumed by Slowloris. This is because other users of the system must finish their requests before the sockets become available for Slowloris to consume. If others re-initiate their connections in that brief time-period they’ll still be able to see the site. So it’s a bit of a race condition, but one that Slowloris will eventually always win - and sooner than later." Apparently neither Microsoft IIS nor Lighttpd are affected by this flaw. It will be interesting to follow this story in the comming days.

PHP dev team released new version of PHP 5.2.x two days ago. This version brings a few security fixes and a lot of bug squashing. Alas, there was one seriously wrong fix. A bug that we’ll call "PHP safe_mode bypass with exec/system/passthru" was supposedly fixed in this latest version. Supposedly. It’s still there. And here is a proof of concept. I’ll wait with upgrading to 5.2.10.

There is serious XSS vulnerability affecting all Joomla! versions prior to 1.5.11 which was released just a few days ago.DESCRIPTION: JA_Purity template is bundled in Joomla! and fails to sanitized user supplied input. An attacker can inject JavaScript or DHTML that will be saved in the cookie making persistent, running in the context of targeted user browser, allowing him to steal cookies. IMPACT: An attacker can exploit the vulnerability to store persistent XSS. This may lead in steal the targeted user cookies and gain access to the user account. Full disclosure at PacketStorm. So, still using old Joomla!?