Tag Archives: Linux

phpmyadmin in ubuntu now being exploited en-masse

Leave a reply

Update: ubuntu patched this issue a couple of days after this post. If you’re reading, thanks guys! You just made my job a lot easier 🙂

At some point, I might try to look at helping maintain this, and other packages like it in the ubuntu archive. No idea how, though a colleague may be able to help…

———————–

The versions of phpmyadmin in ubuntu (at least Dapper – Intrepid) are susceptible to arbitrary code execution, as the web-server’s user. A bug1 was reported on the 15th of June about this issue, and marked as high priority on the 21st.

The phpmyadmin team patched this problem in their software on May the 24th. 2

Debian patched this in their system on the 25th of June.

I tried talking to people on #ubuntu-security about this problem. They said “motu” and “we’re not interested, its in universe”. I tried talking to people in #motu, and they talked about work-arounds.

The main questions now are:

  • Please can someone work on the bug?
  • Why did it take so long between upstream report and launchpad report?
  • Why has the bug been left to the point where it is getting automatically exploited, en-masse? 3
  1. https://bugs.launchpad.net/ubuntu/+source/phpmyadmin/+bug/387215 ↩
  2. http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php ↩
  3. http://seclists.org/fulldisclosure/2009/Jul/0021.html ↩

Dear Apache

2 Replies

Dear Apache. My idea of fun is not to find out about a missing log directory, when I test a website after a restart. My idea of fun would be for apache2ctrl configtest to actually, you know, work. Or, even better, don’t utterly die when you’re missing a log directory.

GRRRRR

Dear Customer. Please make sure you remove apache configuration, when you delete your users. I don’t enjoy being woken at 6am because logrotate restarted apache. Athough, on the upside, at least I get paid for it.

Day 4 – Falling back to the meta-referance

4 Replies

Last night I posted on twitter that I was struggling to find stuff to post about. jkblacker (Not bassets, sorry Josh!) suggested that I post about how I’m finding it hard to find stuff to post about… so here it is 😉

Not exactly the most spectacular day 4, especially since I’ve got 26 left to go, but we’ll see what happens.

Parts for my new computer started arriving today. I’d hoped that it would all arrive, but unfortunately not. So, right now I’ve got RAM, the PSU, Motherboard, CPU cooler and a copy of Windows. (Yes, I know, horrible, but I’m building a gaming machine, wine isn’t there yet, and Linux hasn’t reached critical mass 🙁 )

Sporadically over the past week or so, I’ve been trying to use search and replace in vi/vim. Finally got it drummed into my head! Here’s the syntax for single item search and replace:

:%s/OLDSTRING/NEWSTRING/

If you want to replace every item in a document, then add “g” to the very end. “g” in this context means “greedy” – i.e. replace everything. (Thanks JPE – I did learn it after all!)

This is the same sort of syntax as usable in the command line tool “sed”. For example, if you wanted to replace a space in a file with a comma, then you’d do:

sed 's/ /,/g' oldfile > newfile

I’m sure there’s a better way to specify that syntax… please feel free to comment 🙂

Linux command line tips & Stuff

Leave a reply

I’ve been taught a couple of command line tips at work, and thought it wouldn’t be fair if I didn’t pass them on. So, we begin.

CTRL-R

This insanely useful trick, in a terminal or a console, will allow you to search your bash history for any command you’ve previously run and re-run it. For example, quite often on my laptop, type “CTRL-R upg” in a terminal window, which runs the following command:

sudo apt-get update && sudo apt-get upgrade -y

If you don’t know, that command updates your package repository listing (what programs have been updated), and then goes and upgrades all of the packages that have been upgraded, with the only exception of the more significant upgrades, like to the kernel. (A human has to activate those particular upgrades – and the -y tag doesn’t signify human, as that command can be cron jobbed very easily…)

CTRL-O

This one I was taught in my interview for Positive Internet. (So, I’d better not get this wrong! ;))

If you have run a series of commands in a terminal or console repeatedly, say editing a file, doing a config check and then restarting apache (as I have done whilst I’ve been playing with my Apache2 config file for this blog), then this little switch is priceless. Basically, once you hit the up arrow to find the command you wish to use, hitting CTRL-O instead of Enter, will execute the command, and then once you’re back at the shell prompt list the next command in the series. So for the first set of commands:

vi /etc/apache2/sites-available/kirrus  [ENTER and edit the config]
apache2ctl configtest [ENTER]
apache2ctl graceful [ENTER]

Ooops, I’ve just killed my blog by way of a looping redirect! Quick, undo!

[UP ARROW, UP ARROW, UP ARROW]
vi /etc/apache2/sites-available/kirrus [CTRL-O and fix the config]
apache2ctl configtest [CTRL-O]
apache2ctl graceful [ENTER]

The benefit? The second time round, once I found and initiated the series of commands, I didn’t need to type anything, other than the changes to the config file, and the initiating control sequences. Annoyingly, you can’t just hit CTRL-O once, and then expect to be in the chain next time you hit enter – hitting enter won’t provide you with the next command in the chain once you’re finished. Although, this of course can be a good thing, if you want to return to a clean command prompt.

Hopefully one of those will be useful to you.

Ubuntu-UK Planet, Caffeine and Rambling.

For some strange reason, the Ubuntu UK planet didn’t pick up my last post as a new post. Possibly because it got a little confused with the server move and IP address change? Anyway, for those of you reading this on the planet, I have a post about a couple of the tools that come with apache2 on my blog. Not much, but hopefully interesting.

Caffeine: I’ve pretty much overdosed this evening. Head’s swimming right now, and the screen appears to be filling my vision (hence the more than normal ramblingness [yes I invented a word :)] going on in this post). Stayed on at work for an hour and a half, pushing me closer to the tiredness limit. So, on the way home I drank a bottle of Coca Cola, (the tube section) and a small americano coffee (the train section). It kept me awake (yay!) at the cost of me being a little… jumpy at the moment. Still, it’ll wear down shortly, especially since I finished my food about 20 minutes ago. That always helps clear the caffeine effect. So, shortly I’m going to crash from my caffeine high, and be a Zombie. Hopefully won’t be that way tomorrow morning, but at least I can sleep on the train in and if I’m lucky and get a next-to-the-door seat on the tube quickly, on the tube in. (The glass to your left or right acts as a good, if a little hard, pillow. The glass behind you, unfortunately, moves too much, and gets painful quite quickly.)

Right. I can feel myself starting to slow down, so I’d better sign off before the Zombieness (Yay for creating random useless words!) comes into play.

Stay safe 🙂

Moved & a couple of Apache2 tools/tricks

2 Replies

If you can can see this post, then my server move is complete. I have moved this blog across to a dedicated server, provided by my employers, Positive Internet.

So far, I’ve not done too much playing with it, but in case you need to know, adding this in your apache2.conf file will allow it to read .htaccess files in any /home/<username>/public_html/ document roots – handy if you don’t want to use /var/www/ to store all your websites.

<Directory /home/*/public_html>
        AllowOverride All
</Directory>

There are a couple of useful apache2 tools which don’t get a lot of publicity.

a2enmod – enable a mod in apache. You’ll need to reload apache after running it. If you run it without specifying a mod, it will list all available ones.

a2dismod – disable a mod. Again, if you run it without specifying a mod it will list all enabled ones, before giving you a prompt asking which one to disable.

Along similar lines, if you’re using sites-available/sites-enabled to quickly enable/disable vhosts, you can use:

a2ensite – enable a website.

a2dissite – disable a website.

Of course, you can then use apache2ctl graceful to restart the webserver nicely – so the changes take effect, but you don’t close all the connections currently talking to apache.

Have fun!