Attention Tyboo - Da Nag

Sneaks · Posted: Tue Dec 21, 2004 8:44 pm Post subject: Attention Tyboo - Da Nag

I got this from my host today. Sad

A new worm has been spreading rapidly today that defaces sites running older version of phpBB, and then attempts to spread itself further. There are two solutions to this and all customers running phpBB should take this warning extremely seriously and act on it as a matter of urgency:

Solution 1: Upgrade to phpBB 2.0.11 - http://www.phpbb.com/downloads.php

Solution 2: Use the fix detailed at http://www.phpbb.com/phpBB/viewtopic.php?t=240513

If you are running a version of phpBB earlier than 2.0.11 please ensure that you upgrade or patch your installation. Unpatched installations that are found to have been exploited will be disabled without notice to preserve server integrity.

Alyssa Jean · Posted: Tue Dec 21, 2004 9:46 pm Post subject:

At the bottom of these pages this is posted.

Powered by phpBB 2.0.6 © 2001, 2002 phpBB Group

Looks like we are using something later than phpBB 2.0.11

B~C · Posted: Tue Dec 21, 2004 10:06 pm Post subject:

I always thought this site was beer powered...what the shell is phpbb?

Sneaks · Posted: Tue Dec 21, 2004 10:39 pm Post subject:

TyBoo · Posted: Tue Dec 21, 2004 11:06 pm Post subject:

Well, technically, David, you are 100% correct, because .6 is greater than .11 by about .49. However, remember these are nerds you're dealing with. They are so damn smart they skipped right through the first few years of math.

So, in nerdspeak, I guess the 2.0.11 is five minor revisions past 2.0.6. I think Bill might be waiting for the Version 2.1 before he upgrades.

Me, I ain't nerdy enough to worry about this, so I will trust Bill completely in such matters. Maybe I should worry about that!?!

Now if you guys want to pick on one another, go the the Cigar Smoking thread. That's tuning up to be a doozy! I even came up with a couple smart alecky replies to the CA air quality discussion, but I kept them to myself because I have to set an example since I made up the stupid "Be Nice" rule after some folks picked on me on some other thread some other place.

Chuck S · Posted: Wed Dec 22, 2004 6:58 am Post subject:

http://news.zdnet.com/2100-1009_22-5499725.html

Verion .6 is certainly earlier than .11. Six is smaller than eleven.

Another site I frequent was hit. They're now on version 11.

-- Chuck

Alyssa Jean · Posted: Wed Dec 22, 2004 8:45 am Post subject:

Dyslexia strikes again. When I looked at the .11 I reversed it and thought it said .11. Must be the rarified air up north here.
Thanks for keeping me honest Don.

Sneaks · Posted: Wed Dec 22, 2004 9:49 am Post subject:

Hey Dave, since were both half hogs asses, we gotta stick together. WA6WKL here. In retrospect, I had a few years when I occasionally drank from 11 to 6.... Beer

More nerdie $hit. I once got into trouble responding to an RFP when I accidentally used the word antennae in reference to the multiple antennas on the proposed ELINT system. Insects have antennae, hams (and ELINT systems) have antennas

The nerd world is, indeed, different. More useless trivia: The discs/disks? on early hard drives were constructed with aluminum provided by ... Coors.

Don

Da Nag · Posted: Wed Dec 22, 2004 11:55 am Post subject:

Yup, I received the CERT advisory on this, and yup - we're vulnerable.

Good news is, I run nightly backups. If we get hit, I can recover losing no more than one days' worth of posts.

Bad news is, running this place is a part-time endeavor, and our version of phpBB is heavily modified - I can't just slap the patch in place without testing. It's on the list of things to do soon, but if we get hit before then, them's the breaks...

Now...if you all want to chip in with hefty dues so I can quit my day job...I'm most definitely interested. Mr. Green

Da Nag · Posted: Wed Dec 22, 2004 6:19 pm Post subject:

Didn't test as much as I would like, but we're updated. Please report any oddities to me via PM or in this thread.

For those (any?) of you who care about such nerdly things, here's some more info regarding the vulnerability (the "Santy" worm) for which the patch was applied:

CERT Advisory - CERT provides computer professionals (or anyone pretending to be one) with alerts on vulnerabilities as they are reported. These are "high-level" alerts; basically, they inform you of the risk level for a particular exploit, and where to get additional information or updates. If you want to fill up your mail box, go ahead and sign up...

Also, Google has helped out as well - the worm propogates via Google searches that identify vulnerable web sites - Google is now dropping any of these queries. This doesn't directly address the vulnerability that unpatched phpBB web sites have, but since the Santy worm is the primary way this exploit is currently happening, this will help out folks who don't jump on the update bandwagon right away.

Man...what a pain. Think I'll go have a beer. And a cigar. Outdoors, of course.

TyBoo · Posted: Wed Dec 22, 2004 6:26 pm Post subject:

Da Nag · Posted: Wed Dec 22, 2004 7:22 pm Post subject:

Oops...upgrade broke the photo albums. I'll try and get it fixed tonight.

Da Nag · Posted: Wed Dec 22, 2004 7:29 pm Post subject:

Sneaks · Posted: Wed Dec 22, 2004 7:43 pm Post subject:

B~C · Posted: Wed Dec 22, 2004 8:03 pm Post subject:

Bill the wonder nerd, I vote we double our yacht club dues

awww Mike, It's always so easy to pick on the mentally handicaped person...I'm normal, it's the rest of the world that's insane Smile

...well....maybe Catman is sane also..dunno, maybe