[1.7 / 1.7.1] Security fix in sessions.php

[TariqAlAli]

HI All,

it has been a month since my first post about this fix. No more penetration to my server via SESSION 

no other details will be posted 

My advise, replace ASAP.


Regards

Tariq

[Dan1113]

I see that the vbulletin 2.x integration is ok, but what about the 3.x?

Here's the line in 3.x
$user_id = ($this->read_cookie_data(COOKIE_PREFIX."userid")) ? $this->read_cookie_data(COOKIE_PREFIX."userid") : GUEST;

[V@no]

Code: [Select]

$user_id = ($this->read_cookie_data(COOKIE_PREFIX."userid")) ? intval($this->read_cookie_data(COOKIE_PREFIX."userid")) : GUEST;

[pkitty]

I have a problem, I did this fix when it first came out, I recently had an influx of members, and I got an email today from one of them with a link in it, and when I clicked on it, I was logged into her account, I checked and double checked...this is the part of the code I changed in includes/sessions.php  am I missing something?

Code: [Select]

  function demand_session() {
    $this->get_session_id();
    if (!$this->load_session_info()) {
      $this->delete_old_sessions();
    $user_id = ($this->read_cookie_data("userid")) ? intval($this->read_cookie_data("userid")) : GUEST;
    $this->start_session($user_id);
    }
    else {
      $this->user_info = $this->load_user_info($this->session_info['session_user_id']);
      $update_cutoff = ($this->user_info['user_id'] != GUEST) ? $this->current_time - $this->user_info['user_lastaction'] : $this->current_time - $this->session_info['session_lastaction'];
      if ($update_cutoff > 60) {
        $this->update_session();
        $this->delete_old_sessions();
      }
    }
  }

  function start_session($user_id = GUEST, $login_process = 0) {
    global $site_db;

    $this->user_info = $this->load_user_info($user_id);
    if ($this->user_info['user_id'] != GUEST && !$login_process) {
      if ($this->read_cookie_data("userpass") === $this->user_info['user_password'] && $this->user_info['user_level'] > USER_AWAITING) {
        $this->set_cookie_data("userpass", $this->user_info['user_password']);
      }
      else {
        $this->set_cookie_data("userpass", "", 0);
        $this->user_info = $this->load_user_info(GUEST);
      }
    }

       

[Jan]

Seems to be that problem: http://www.4homepages.de/forum/index.php?topic=8895.0

[pkitty]

I already have that in my includes/sessions.php.... see down below, so that cant be the problem unless I should have that in there...this is so confusing.

Code: [Select]

  if (!isset($this->session_info['session_user_id'])) {
        return false;
    }

if (!isset($this->session_info['session_ip']) || (isset($this->session_info['session_ip']) && $this->session_info['session_ip'] != $this->user_ip))
    {
      session_regenerate_id();
      $this->session_id = session_id();
      return false;
    }

    return $this->session_info;
  }



[hyde101]

I have 1.7 and I already have this modificition, (didn't need to change in sessions.php)

[pkitty]

I too have 1.7...have you had a member send you an email with a link in it to see if the fix worked, or did you just add it and assume like I did it was fixed.  I cannot have people being able to log into others accounts, or have my host be at risk....is there no solution to this or was the code looked at to see if I did something wrong?  Its been almost 5 days.....I dont want to have to delete my photo album from my server because of this...does anybody know what it is?

[Xyu BAM]

I too have 1.7...have you had a member send you an email with a link in it to see if the fix worked, or did you just add it and assume like I did it was fixed. I cannot have people being able to log into others accounts, or have my host be at risk....is there no solution to this or was the code looked at to see if I did something wrong? Its been almost 5 days.....I dont want to have to delete my photo album from my server because of this...does anybody know what it is?

your problem is not related to this topic...

[hyde101]

But as I said, I have 1.7 and I didn't need to change this as it was already there..
Probably some other mod changed it? I don't remember, really. But it's there (new format)

[pkitty]

I too have 1.7...have you had a member send you an email with a link in it to see if the fix worked, or did you just add it and assume like I did it was fixed. I cannot have people being able to log into others accounts, or have my host be at risk....is there no solution to this or was the code looked at to see if I did something wrong? Its been almost 5 days.....I dont want to have to delete my photo album from my server because of this...does anybody know what it is?

your problem is not related to this topic...

Well then what topic IS it related to? 

[xico]

I made that change few months ago and today i was hacked... do you have another recent security fix?

[Xyu BAM]

I made that change few months ago and today i was hacked... do you have another recent security fix?

and what is your evidence that your've been hacked THROUGH 4images ?

[hyde101]

That's terrible..

Xico, what else do you have public on your server? any php forums such as phpbb or invision board?
please list the versions of any other php script you have on your server..

What kind of "hack" was it? Was it "deface" (changing of INDEX)

[TheOracle]

please list the versions of any other php script you have on your server..

@Xico:

If you intend to list your Global Server Information on the forum, please install this MOD first if you haven't do so. It will facilitate your task.

http://www.4homepages.de/forum/index.php?topic=9289.msg43918#msg43918