Welcome, Guest
Username Password: Remember me

Is this a problem in the logs
(1 viewing) (1) Guest
  • Page:
  • 1

TOPIC: Is this a problem in the logs

Is this a problem in the logs 08 Jul 2010 12:57 #2355

I've started seeing these entries in my access logs again since upgrading to 6.1.5

Is there something to be concerned about?

83.222.124.106 - - [08/Jul/2010:11:18:23 -0600] "GET //index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 53518 "-" "libwww-perl/5.810"
77.221.130.18 - - [08/Jul/2010:11:18:50 -0600] "GET //index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 53518 "-" "libwww-perl/5.813"
77.221.130.18 - - [08/Jul/2010:11:18:50 -0600] "GET //index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 53518 "-" "libwww-perl/5.813"
77.221.130.18 - - [08/Jul/2010:11:18:52 -0600] "GET //index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 53518 "-" "libwww-perl/5.813"
69.63.178.249 - - [08/Jul/2010:11:21:54 -0600] "GET /index.php?option=com_bca-rss-syndicator&feed_id=2 HTTP/1.1" 200 3020 "-" "FacebookFeedParser/1.0 (UniversalFeedParser/4.1;) +facebook.com/"
83.222.124.106 - - [08/Jul/2010:11:22:10 -0600] "GET //index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 53518 "-" "libwww-perl/5.810"
83.222.124.106 - - [08/Jul/2010:11:22:09 -0600] "GET /?option=com_bible...mid=72&fontstyle=f-larger//index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 404 2043 "-" "libwww-perl/5.810"
77.221.130.18 - - [08/Jul/2010:11:29:20 -0600] "GET /?option=com_bible...mid=72&fontstyle=f-larger//index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 404 2043 "-" "libwww-perl/5.813"
77.221.130.18 - - [08/Jul/2010:11:29:21 -0600] "GET /?option=com_bible...mid=72&fontstyle=f-larger//index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 404 2043 "-" "libwww-perl/5.813"
77.221.130.18 - - [08/Jul/2010:11:29:20 -0600] "GET //index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 53518 "-" "libwww-perl/5.813"
77.221.130.18 - - [08/Jul/2010:11:29:21 -0600] "GET //index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 53518 "-" "libwww-perl/5.813"
77.221.130.18 - - [08/Jul/2010:11:30:11 -0600] "GET //index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 53518 "-" "libwww-perl/5.813"
77.221.130.18 - - [08/Jul/2010:11:30:10 -0600] "GET /?option=com_bible...mid=72&fontstyle=f-larger//index.php?option=com_biblestudy&id=1&view=studieslist&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 404 2043 "-" "libwww-perl/5.813"



I've got the following in my htaccess file
RewriteCond %{HTTP_USER_AGENT} ^.*libwww-perl [NC,OR]
RewriteCond %{HTTP_USER_AGENT} libwww-perl [NC, OR]

Real question is why are some returning 404's and others return 200?

Re:Is this a problem in the logs 08 Jul 2010 13:06 #2356

  • Tom
  • OFFLINE
  • Administrator
  • Posts: 860
There was an exploit in the component that was discovered in January. As long as you are using the latest version of JBS (6.1.5) you are covered. But hackers still try to get in that way.

They can't now because the main controller checks to see which view they are trying to use and if it isn't on the list they go nowhere.

That re-write condition is a good one. I too put that one on my sites - it is apparently a common attempt at exploiting php websites.

I don't know why you get different responses though.

By the way, I make it a practice to ban IP addresses that try to hack into my site.

Something like DENY From 11.111.111.111
"You shall know the truth and the truth shall set you free." JC
Last Edit: 08 Jul 2010 13:07 by Tom.
  • Page:
  • 1
Time to create page: 0.56 seconds