0
Welcome Guest! Login
0 items Join Now

securityleaks?

    • Stephen Cassidy's Avatar
    • Stephen Cassidy
    • Sr. Rocketeer
    • Posts: 213
    • Thanks: 13
    • Webmaster - ICT Manager

    Re: securityleaks?

    Posted 10 years 8 months ago
    • Hi Andy,

      I'm using Joomla! 3.1.5 with Gantry v4.1.21 and all other extentions are up to date. I seen that Joomla 3.2.3 is now out but read, that the Joomla team are rushing things a bit coming up to 1 April when they expect 3.3 to launch! so i'm waiting for that to be stable, before updating.

      I did however ask my hosting to scan my accounts again and told them that the guys over at Gantry would like to know what tools they are using.

      Will post it when I get an answer ;)

      Stephen
    • The more I practice, the luckier I get...
  • Re: securityleaks?

    Posted 10 years 8 months ago
    • i am also with antagonist. the same hosting as stephen. so it will be Patchman. but maybe they have a better answer for you in explaining what it is. stephen already asked so we will wait for the answer
    • Stephen Cassidy's Avatar
    • Stephen Cassidy
    • Sr. Rocketeer
    • Posts: 213
    • Thanks: 13
    • Webmaster - ICT Manager

    Re: securityleaks?

    Posted 10 years 8 months ago
    • Hi Andy, Suzzane,

      My hosting replied to my message. They have confirmed that the problem is in Gantry. I have posted their reply (In Dutch for Suzanne) below, they do use Patchman. The hosting have checked on the Gantry forum and have contacted Patchman to ask how Patchamn sees the Gantry issue as a leak, and will contact me when they hear back.
      Antagonist told me that they can fix the leak on my websites without causing issues with Gantry or my Rocketheme installations in such a way that it will not cause issues for me, om my wensties, but just put a plaster above to stop malicious attacks. Yesterday before I asked them to scan my websites I had updated all components except Joomla 3.2.3 which was just out and I was not yet sure if it's that stable yet.

      Stephen


      Beste Stephen,

      Bedankt voor je bericht.

      Ik heb zojuist de scan opnieuw gedraaid, maar zie dat er nog een aantal lekken aanwezig zijn. De voornaamste lekken worden in dit geval geconstateerd in het Gantry-Framework.

      We maken in dit geval gebruik van de software genaamd Patchman. Mocht je meer informatie willen over de software kan je eens kijken op de volgende website; www.patchman.co .De post op het betreffende forum van Gantry heb ik inmiddels gevonden. Ik heb de vraag ook voorgelegd aan de programmeur van Patchman om te controleren op basis waarvan dit als lek wordt gezien. Zodra we meer informatie hierover hebben dan hoor je dit van ons.

      We kunnen de lekken eventueel automatisch voor je dichten. Hier hoef je dan zelf dus niets voor te doen. Bij het dichten van het lek wordt de software versie zelf niet geüpdatet, maar worden enkel het lek hiervan gedicht. Er wordt dan ook niets veranderd aan de werking van de website; het lek wordt alleen gedicht zodat hier geen actief misbruik meer van gemaakt kan worden. Zie het daarom alleen als een pleister op een wond: het houdt het vuil tegen, maar de werking van de "huid" blijft hetzelfde. Als je wilt dat we dit voor je uitvoeren kunnen we dit eventueel doen.

      Mocht je andere vragen hebben dan hoor ik het graag van je.

      Met vriendelijke groet,

      Wiebe Nijkamp
      Antagonist B.V.
    • The more I practice, the luckier I get...
    • ipopipo's Avatar
    • ipopipo
    • Jr. Rocketeer
    • Posts: 39
    • Thanks: 0

    Re: securityleaks?

    Posted 10 years 8 months ago
    • Same leaks here with Gantry overrides .
      Latest Joomla 3.2.3 and Gantry.
      Received warning after automatic update by Installatron.
    • Andy Miller's Avatar
    • Andy Miller
    • Preeminent Rocketeer
    • Posts: 9919
    • Thanks: 96
    • Web Kahuna

    Re: securityleaks?

    Posted 10 years 8 months ago
    • FYI we've emailed the authors of Patchman to try to get to the bottom of this. For what it's worth, we've reviewed all the files mentioned in this thread, and we really don't think there is any security issue and the error is a false-positive on the patchman side. If however, they do bring up something legitimate, we'll certainly fix it ASAP.

      Thanks!
    • ipopipo's Avatar
    • ipopipo
    • Jr. Rocketeer
    • Posts: 39
    • Thanks: 0

    Re: securityleaks?

    Posted 10 years 8 months ago
    • 2 out of 3 warnings are solved now.
      plugins/system/gantry/overrides/3.0/2.5/com_users/reset/complete.php is still detected as Clickjacking leak.
    • Last Edit: 10 years 8 months ago by ipopipo.
    • ipopipo's Avatar
    • ipopipo
    • Jr. Rocketeer
    • Posts: 39
    • Thanks: 0

    Re: securityleaks?

    Posted 10 years 8 months ago
    • Got respons from Patchman:
      Thank you for contacting us. This is not a false positive. Gantry contains files from Joomla 2.5, which have security vulnerabilities. We advise to apply Patchman's fix to harden the security.
    • Andy Miller's Avatar
    • Andy Miller
    • Preeminent Rocketeer
    • Posts: 9919
    • Thanks: 96
    • Web Kahuna

    Re: securityleaks?

    Posted 10 years 8 months ago
  • Re: securityleaks?

    Posted 10 years 8 months ago
    • Thanks! i will update my websites today!
    • Stephen Cassidy's Avatar
    • Stephen Cassidy
    • Sr. Rocketeer
    • Posts: 213
    • Thanks: 13
    • Webmaster - ICT Manager

    Re: securityleaks?

    Posted 10 years 8 months ago
    • Thanks Andy,

      Stephen
    • The more I practice, the luckier I get...

Time to create page: 0.073 seconds