New Apache web server release

Published: 2014-03-17. Last Updated: 2014-03-18 19:38:10 UTC
by Jim Clausing (Version: 1)

The Apache folks have released version 2.4.9 of their ubiquitous web server. This one fixes a couple of security vulnerabilities along with some other bug fixes, one in mod_log_config having to do with issues with truncated cookies and one in mod_dav that was a potential denial of service. Expect most of the Linux distros to apply the appropriate fixes shortly, but if you are building from source or running on a platform that won't push the updates to you, go grab the update.

References:

http://httpd.apache.org/security/vulnerabilities_24.html

http://www.apache.org/dist/httpd/CHANGES_2.4.9

---------------
Jim Clausing, GIAC GSE #26
jclausing --at-- isc [dot] sans (dot) edu

Keywords: apache

1 comment(s)

Scans for FCKEditor File Manager

Published: 2014-03-17. Last Updated: 2014-03-18 01:01:39 UTC
by Johannes Ullrich (Version: 1)

2 comment(s)

FCKEditor (now known as CKEditor [1]) is a popular full featured GUI editor many web sites use. For example, you frequently find it with blog systems like WordPress or as part of commenting/forum systems. As an additional feature, a filemanager can be added to allow users to upload images or other files. Sadly, while a very nice and functional plugin, this features if frequently not well secured and can be used to upload malicious files. We have seen some scans probing specifically for this file manager plugin:

HEAD /js/fckeditor/editor/filemanager/connectors/test.html

HEAD /admin/FCKeditor/editor/filemanager/connectors/test.html

HEAD /admin/FCKeditor/editor/fckeditor.html

HEAD /include/fckeditor/_samples/default.html

HEAD /include/fckeditor/editor/filemanager/connectors/test.html

These requests did not set a user agent or a referrer. The following set did however use "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1;" and instead of a HEAD request it used a GET request, indicating that there are different distinct tools looking for the same vulnerability:

GET /editor/editor/filemanager/connectors/uploadtest.html HTTP/1.1

GET /editor/editor/filemanager/upload/test.html HTTP/1.1

GET /editor/editor/filemanager/browser/default/connectors/test.html HTTP/1.1

GET /editor/editor/filemanager/connectors/test.html HTTP/1.1

GET /admin/fckeditor/editor/filemanager/connectors/test.html HTTP/1.1

GET /FCKeditor/editor/filemanager/upload/test.html HTTP/1.1

GET /Fckeditor/editor/filemanager/browser/default/connectors/test.html HTTP/1.1

GET /admin/FCKeditor/editor/filemanager/connectors/uploadtest.html HTTP/1.1

GET /admin/FCKeditor/editor/filemanager/upload/test.html HTTP/1.1

GET /Fckeditor/editor/filemanager/connectors/test.html HTTP/1.1

GET /admin/fckeditor/editor/filemanager/browser/default/connectors/test.html HTTP/1.1 GET /FCKeditor/editor/filemanager/connectors/uploadtest.html HTTP/1.1