Gallery 2.2.4 Security Fix Release

Releasing critical security update during holidays is not very clever. Thanks to Lubomir Kundrak who made this update to Fedora.

I understand, thank you for the fix and have a nice holidays!

1. Waiting to release critical security updates is even less clever. In fact it is almost not very responsible. Thanks to the team for caring about my systems and client's systems enough to do this.

2. Figuring out how to politely leave the church or party, during the holidays, to fix a compromised system would be clever.

Of course now I have several clients I gotta go upgrade!

All API changes for the next major release (G2.3, spring 2008) are backwards compatible.
You can review the API changes at: development -> API -> Changes since last release.

For G2.4 (late 2008?) we'll introduce major non backwards compatible changes. We'll drop PHP 4 compatibility in favor of using more of PHP 5's features, add a type-safe input filtering framework and much more.

Is ISO-8859-2 charset coding already supported in this release?

Securities fixed only!

Read carefully introduction please!

The schedule part is missing the steps between polishing and releasing:

Should this be updated? Removed and a pointer to a master schedule inserted?

serbanc,
please add feature requests to the proper location, not a news story.
http://sourceforge.net/tracker/?group_id=7130&atid=357130

Dave
_____________________________________________
Blog & G2 || floridave - Gallery Team

Thanks for the security its really good . I have two questions for the next releases

1)Is ISO-8859-2 charset coding already supported in this release?
2)what are the planned features/changes for G2.4 ?

Regards,
Bmora96

My webserver was successfully hacked, through a hole in Gallery 2.0
--------------------------------------------------------------------

I'd like to document this successful hack of my dedicated server, not to whine but to describe how the hack was carried out and how other webmasters can both detect and correct a hacked system successfully. Three months elapsed between the hack of my system and its mal-use that caused a shutdown. If I had known any of the markers I'm about to describe to you during those three months, I could have fixed my system before 30 domains went down hard.

PROCESS THE HACKERS USED:
--------------------------
1. An over-long URL was sent to the "main.php" module of Gallery 2.0
2. This allowed the hackers to execute code in Front-Page, also on my server
3. The MS-Frontpage code, "fpexe", runs as root and can do anything
4. fpexe was used to create a user account at the Linux level
5. The hacker logged on to port 22 (SSH) using this account
6. The hacker then waited 3 months before "selling" my hacked server to a phishing gang
7. The phishing gang then logged onto port 22, downloaded some bot code written in PHP, and ran it continuously
8. The bot code connected to IRC servers in Romania and Russia, then put up a fake banking website

HOW TO DETECT THEIR TRACKS
--------------------------
1. Scan the "access_log" file (usually in /var/log/httpd) for overly-long GET requests to "main.php" in the gallery directory. Here is a sample:
Received From: u15291219->/var/log/httpd/access_log
Rule: 31115 fired (level 13) -> "URL too long. Higher than allowed on most browsers. Possible attack."
Portion of the log(s):

211.223.162.5 - - [15/Mar/2008:13:34:10 -0700] "GET /gallery/main.php?g2_view=core.UserAdmin&g2_subView=core.UserLogin&g2_return=%2Fgallery%2Fmain.php%3Fg2_view%3Dcore.UserAdmin%26g2_%253Bg2_subView%3Dcore.UserRecoverPassword%26g2_%253Bg2_return%3D%252Fgallery%252Fmain.php%253Fg2_view%253Dcore.UserAdmin%2526g2_%25253Bg2_subView%253Dcore.UserLogin%2526g2_%25253Bg2_return%253D%25252Fgallery%25252Fmain.php%25253Fg2_view%25253Dcore.UserAdmin%252526g2_%2525253Bg2_subView%25253Dcore.UserRecoverPassword%252526g2_%2525253Bg2_return%25253D%2525252Fgallery%2525252Fmain.php%2525253Fg2_view%2525253Dcore.UserAdmin%25252526g2_%252525253Bg2_subView%2525253Dcore.UserRecoverPassword%25252526g2_%252525253Bg2_return%2525253D%252525252Fgallery%252525252Fmain.php%252525253Fg2_view%252525253Dcore.UserAdmin%2525252526g2_%25252525253Bg2_subView%252525253Dcore.UserLogin%2525252526g2_%25252525253Bg2_return%252525253D%25252525252Fgallery%25252525252Fmain.php%25252525253Fg2_view%25252525253Dcore.UserAdmin%252525252526g2_%2525252525253Bg2_subView%25252525253Dcore.UserLogin%252525252526g2_%2525252525253Bg2_return%25252525253D%2525252525252Fgallery%2525252525252Fmain.php%2525252525253Fg2_view%2525252525253Dcore.UserAdmin%25252525252526g2_%252525252525253Bg2_s

2. Look for entries in "suexec_log" in /var/log/httpd indicating that the Apache server executed root commands
3. Look in /etc/passwd for new user accounts
4. Look in /home for new user home directories

WHAT I DID TO BLOCK THEM IN THE FUTURE
--------------------------------------
1. Installed Gallery 2.4
2. Uninstalled Frontpage and deleted "fpexe"
3. Disabled Port 22 logins except from a single account, which I must use
4. Disabled password access on SSH, allowing only pre-shared AES private/public keys
5. Went into php.ini and disabled a bunch of PHP function calls that only hackers would use (like "fsockopen", used to talk on IRC to Russia)
6. Installed Mod_Security into Apache
7. Upgraded to the latest Linux
8. Upgraded to the latest Apache
9. Upgraded to the latest MySQL
10. Installed mod_evasive into Apache, to prevent DDOS attacks
11. Got a hardware firewall, separate from the server and tightened the ports both in and out to ones I use
12. Turned off all unnecessary Linux services, such as SMTP, MAIL, and BIND
13. Installed OSSEC, which continually monitors all logs and notifies me when any security breach is attempted
14. Turned on the OSSEC feature which blocks specific IP addresses which try to hack the system (via multiple bad logins, URL exploits, etc.)
15. Considerably tightened MySQL security by partitioning logins to specific databases and tightly limiting rights.

Don't take Menalto's warning to upgrade to version 2.4 lightly. They hackers from around the world know all about this hole. Using my new
monitoring system I've seen three different attempts made to hack my Gallery 2 (from Korea, Russia, and Brazil) this weekend. They are on
this like fleas. If I can encourage or advise anyone, I will do so. Don't let this happen to you.

Good questions, let me explain:

* The recent logging of G2 hack attempts indicates that hackers are attempting it systematically and globally, not the particular request string used to compromise my system four months ago. Since in two days three different hackers (from Russia, Germany, and Korea) used this exact same string overload only on G2 and no other domain of my 30 indicates some specific worldwide attempt against G2. This is not one lone hacker idly trying random possible vulnerabilities but a shared exploit that many are trying.

* Yes, it's possible that this specific exploit might work against other vulnerabilities but consider this:
1. My security logs don't show any instance of it except in a G2 context, to a G2 subdir
2. The parms in it are G2 parms, not just random text
Ergo, my conclusion that this attack is G2-focused.

* The specifics of the FrontPage execution log pointed directly to a site of mine, from a G2 directory. Hence my feedback that G2 was used to run "fpexe", which was used to create a user account.

* The hackers find Gallery2 sites by using Google. They use "Google Dorks" which are Google search strings which return a list of sites using Gallery. Those G2-installed sites are then scanned for attack. Here is an excerpt on a hacker website where these "GD"s are discussed, including one to find sites with Gallery: http://forums.hackervoice.co.uk/index.php?showtopic=5006

* The good news is that zero hack attempts have gotten to first base since I upgraded G2. All my other security measures were icing on the cake since the upgrade locks the front door that they are pounding on. "Wake up webmasters; listen to the G2 sysop. Upgrade your old G2 systems!"

* Yes, I know the version is 2.2.4, but the comment posting system didn't allow me to change it once submitted. There's another typo too; the substitution of "they" for "the".

* I have zero complaints. Security is MY responsibility as webmaster. The G2 upgrade notices were clearly posted hence the authors did their duty. My goal is to impart to others the need to listen to G2 upgrade notices and spare others server rebuilding as a consequence of server penetration.

I've given you enough material to detect similar attacks on your own system, and to protect it. You'll have to do your own research from here. This is what I know:

* A hacker exploit against G2 was used to run FrontPage's "fpexe" module
* fpexe, when installed in Apache, runs as root in Linux. Look up this exploit to understand it better: http://seclists.org/bugtraq/1997/Oct/0060.html
* Hackers are currently running attempts on my G2 system, as I documented.
* I don't understand exactly how/what their hacks do.

Constant attacks on any web application are normal. I'd start getting curious if you see that a specific application is targeted and if the URLs look like they could be doing something. An absurdly high percentage of these automated "attacks" are attempts to post spam or phishing redirects. So they're harmless and Gallery 2.3 is doing a far better job at rejecting spam comments than previous Gallery versions.

It's just important to stay ahead of the game. Our job as developers is to make the application as robust as possible and your responsibility as users is to subscribe to the announcement mailing lists of the applications you use such that you get notified of upgrades as fast as possible.

Hello Bharat,

Thanks for writing, it's cool to talk to the brilliant author who has given us this terrific photo album. Let me say thank you.

It's very possible that the attacks I've seen lately are completely ineffective, yet I see them only because they trigger OSSEC, my log-scanner software. His rule-set may well ring the alarm when it shouldn't, yet not notify me when it should. As the soldiers say: "It's the bullet you don't hear that gets you".

I'm in a submarine and this is my little periscope yet it's better than going blind like I did before. I'll look at other error logs (I'm running Mod_Security under Apache) and report in if I can find other G2 attack vectors that don't trigger OSSEC. I have no idea if this method is how they originally penetrated my system, using G2 to execute FrontPage's "fpexe", then creating a Linux user, then logging into SSH.

Ineffective or not, this alert gets emailed to me 2-3 times daily, as hackers from around the world try it. It's probably a standard item in some hacking script. The URL is over 8192 bytes, possibly a buffer-overflow attempt. Here's a recent log alert, this time from an Italian source:

-------------------------------start log-----------------------------
OSSEC HIDS Notification.
2008 Mar 19 19:09:27

Received From: u15214219->/var/log/httpd/access_log
Rule: 31115 fired (level 13) -> "URL too long. Higher than allowed on most browsers. Possible attack."
Portion of the log(s):

89.149.242.224 - - [19/Mar/2008:19:09:26 -0700] "GET /gallery2/main.php?g2_view=core.UserAdmin&g2_subView=core.UserRecoverPassword&g2_return=%2Fgallery2%2Fmain.php%3Fg2_view%3Dcore.UserAdmin%26g2_%253Bg2_subView%3Dcore.UserRecoverPassword%26g2_%253Bg2_return%3D%252Fgallery2%252Fmain.php%253Fg2_view%253Dcore.UserAdmin%2526g2_%25253Bg2_subView%253Dcore.UserLogin%2526g2_%25253Bg2_return%253D%25252Fgallery2%25252Fmain.php%25253Fg2_view%25253Dcore.UserAdmin%252526g2_%2525253Bg2_subView%25253Dcore.UserLogin%252526g2_%2525253Bg2_return%25253D%2525252Fgallery2%2525252Fmain.php%2525253Fg2_view%2525253Dcore.UserAdmin%25252526g2_%252525253Bg2_subView%2525253Dcore.UserRecoverPassword%25252526g2_%252525253Bg2_return%2525253D%252525252Fgallery2%252525252Fmain.php%252525253Fg2_view%252525253Dcore.UserAdmin%2525252526g2_%25252525253Bg2_subView%252525253Dcore.UserLogin%2525252526g2_%25252525253Bg2_return%252525253D%25252525252Fgallery2%25252525252Fmain.php%25252525253Fg2_view%25252525253Dcore.UserAdmin%252525252526g2_%2525252525253Bg2_subView%25252525253Dcore.UserRecoverPassword%252525252526g2_%2525252525253Bg2_return%25252525253D%2525252525252Fgallery2%2525252525252Fmain.php%2525252525253Fg2_view%2525252525253Dcore.UserAdmin%25252525252526g2_%2
---------------------------end log-------------------------------------

Hi,

After much pain I have installed and set up G2 in J!1.5.

I can't get the CB plug in to work but I figured I didn't need is as I am trying to create quite a closed system.

I installed:
g2bridge_component v2.2
g2bridge_plugin
com_joomlalib_1_3_2
mod_g2bridge_album_v2.0
mod_g2bridge_image_v2.7
mod_g2bridge_side_v2.6

I have added a test album and created a menu link to it in Joomla.

I can see the album and thumbs but when I click on the image it jumps to the main page.

see site below and navigate to the test gallery page

this is the G2 installation

http://zinderud.com/
and
bilim

I LOVE YOU GÜLÜM