Urgent security issue - php files are downloaded as text
- Thread starter LiteSpeeder
- Start date
Set in php.ini
disable_functions = exec,passthru,system,shell_exec,base64_decode,posix_getpwuid,phpinfo
allow_url_fopen = Off
allow_url_include = Off
That should help some. Note that with exec functions disabled, you need to set vB to use GD2 graphics library as Imagemagick won't work any more.
Here's the interesting bit from script, it tells what apps it uses:
PHP:
$userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
$danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
Last edited:
First I would disable upload of avatars and profile images. Then I would search file contents of all image files (gif, jpg, jpeg, png), maybe also attachments, for strings,
base64_decode
and
eval(
( Linux: grep -liR base64_decode /path/to/your/avatars/ )
If you find none, backup your db and files (download all!), do system restore and install original vB php files (not from backup!) and restore database. You'll have a clean vbulletin. If you still get that iframe then I'm clueless
If you seem to be ok after above, add other scripts after you carefully check them for vulnerabilities - if you are not 100% sure do not install them.
base64_decode
and
eval(
( Linux: grep -liR base64_decode /path/to/your/avatars/ )
If you find none, backup your db and files (download all!), do system restore and install original vB php files (not from backup!) and restore database. You'll have a clean vbulletin. If you still get that iframe then I'm clueless
If you seem to be ok after above, add other scripts after you carefully check them for vulnerabilities - if you are not 100% sure do not install them.
Last edited: