2009 November | incubatec system status

osCommerce 2.2 RC2a bug

Posted in Current by support on the November 27th, 2009 15:27

[ENGLISH]

Dear Customers,

we have noticed that osCommerce version 2.2 RC2a has bug, abused by spammers to send out spam using http:// site name .com / admin/mail.php/login.php?action=send_email_to_user. To fix this problem, please patch the file admin/includes/application_top.php using this schema:

34	34		require(DIR_WS_FUNCTIONS . ‘compatibility.php’);
35	35
36	36		// set php_self in the local scope
37		-	$PHP_SELF = (isset($HTTP_SERVER_VARS['PHP_SELF']) ? $HTTP_SERVER_VARS['PHP_SELF'] : $HTTP_SERVER_VARS['SCRIPT_NAME']);
	37	+	$PHP_SELF = $_SERVER['PHP_SELF'];
38	38
39	39		// Used in the “Backup Manager” to compress backups
40	40		define(‘LOCAL_EXE_GZIP’, ‘/usr/bin/gzip’);
…
134	134
135	135		// include the language translations
136	136		require(DIR_WS_LANGUAGES . $language . ‘.php’);
137		-	$current_page = basename($PHP_SELF);
	137	+	$current_page = basename($_SERVER['SCRIPT_FILENAME']);
138	138		if (file_exists(DIR_WS_LANGUAGES . $language . ‘/’ . $current_page)) {
139	139		include(DIR_WS_LANGUAGES . $language . ‘/’ . $current_page);
140	140		}
…
213	213		}
214	214
215	215		// BOF: MOD – Admin w/access levels
216		-	if (basename($PHP_SELF) != FILENAME_LOGIN && basename($PHP_SELF) != FILENAME_PASSWORD_FORGOTTEN && basename($PHP_SELF) != FILENAME_FORBIDDEN) {
	216	+	if (basename($_SERVER['SCRIPT_FILENAME']) != FILENAME_LOGIN && basename($_SERVER['SCRIPT_FILENAME']) != FILENAME_PASSWORD_FORGOTTEN && basename($_SERVER['SCRIPT_FILENAME']) != FILENAME_FORBIDDEN) {
217	217		tep_admin_check_login();
218	218		}
219	219		// EOF: MOD – Admin w/access levels

Source of patch:
http://code.google.com/p/oscmax2/source/detail?r=169

For further informations & security updates regarding osCommerce:
http://www.oscmax.com/forums/oscmax-v1-7-discussion/20994-spam-through-admin-mail-php-login-php-action-send_email_to_user.html

As a general workaround we suggest password-protecting the admin-folder using either .htaccess+.htpasswd, your control-panel (Plesk, Confixx etc.) or some equivalent solution. The alternative is to rename the admin-folder into something difficult to guess (e.g. “n3WaDm1N”) so that no automatic scanning of the vulnerability is possible.

[ITALIANO]

Gentili Clienti,

da una segnalazione risulta un problema di sicurezza nella versione 2.2 RC2a di osCommerce che viene gia’ abusato da spammers per inviare spam utilizzando l’URL http:// nome sito .it / admin/mail.php/login.php?action=send_email_to_user. Per ovviare al problema, modificare il file admin/includes/application_top.php utilizzando la seguente tabella:

34	34		require(DIR_WS_FUNCTIONS . ‘compatibility.php’);
35	35
36	36		// set php_self in the local scope
37		-	$PHP_SELF = (isset($HTTP_SERVER_VARS['PHP_SELF']) ? $HTTP_SERVER_VARS['PHP_SELF'] : $HTTP_SERVER_VARS['SCRIPT_NAME']);
	37	+	$PHP_SELF = $_SERVER['PHP_SELF'];
38	38
39	39		// Used in the “Backup Manager” to compress backups
40	40		define(‘LOCAL_EXE_GZIP’, ‘/usr/bin/gzip’);
…
134	134
135	135		// include the language translations
136	136		require(DIR_WS_LANGUAGES . $language . ‘.php’);
137		-	$current_page = basename($PHP_SELF);
	137	+	$current_page = basename($_SERVER['SCRIPT_FILENAME']);
138	138		if (file_exists(DIR_WS_LANGUAGES . $language . ‘/’ . $current_page)) {
139	139		include(DIR_WS_LANGUAGES . $language . ‘/’ . $current_page);
140	140		}
…
213	213		}
214	214
215	215		// BOF: MOD – Admin w/access levels
216		-	if (basename($PHP_SELF) != FILENAME_LOGIN && basename($PHP_SELF) != FILENAME_PASSWORD_FORGOTTEN && basename($PHP_SELF) != FILENAME_FORBIDDEN) {
	216	+	if (basename($_SERVER['SCRIPT_FILENAME']) != FILENAME_LOGIN && basename($_SERVER['SCRIPT_FILENAME']) != FILENAME_PASSWORD_FORGOTTEN && basename($_SERVER['SCRIPT_FILENAME']) != FILENAME_FORBIDDEN) {
217	217		tep_admin_check_login();
218	218		}
219	219		// EOF: MOD – Admin w/access levels

Riferimento patch:
http://code.google.com/p/oscmax2/source/detail?r=169

Per ulteriori informazioni riguardanti informazioni di sicurezza per osCommerce consigliamo:
http://www.oscmax.com/forums/oscmax-v1-7-discussion/20994-spam-through-admin-mail-php-login-php-action-send_email_to_user.html

Come workaround generale suggeriamo di proteggere la cartella admin tramite una password utilizzando .htpaccess+.htpasswd, un pannello di controllo (Plesk, Confixx etc.) oppure qualche altro metodo equivalente. In alternativa si puo’ ridenominare la cartella “admin”, preferibilmente utilizzando un nome difficile da indovinare (p.e. “n3WaDm1N”) in modo da evitare scansioni automatizzate da parte di hacker.

MOBI Domain Name Registration

Posted in Current by support on the November 19th, 2009 20:25

Dear Customers,

we are currently offering .MOBI Domain Registrations incl. Instant Mobilizer and dotMOBI SiteBuilder on SALE:

http://www.webhosting24.com/register-dot-mobi-domains/

With InstantMobilizer you can turn Your existing Web Site into a Mobile Web Site, with the SiteBuilder you can create your own Mobile Web Site in minute, no technical knowledge required.

Connectivity meltdown in Europe

Posted in Current by support on the November 16th, 2009 21:04

[ENGLISH]
Dear Customers,

currently we have confirmed problems from Telecom Italia (fiber-cuts in France and Milano, Italy), DTAG (did not get response so far) & T-Mobile and AT&T. No ETA was given so far, but the problems seem to be massive and not only in Italy, Germany, Austria and France, but also noticeable in Greece and other European countries.

We will keep you updated and post as soon as there are updates regarding this issue. We are working for you and doing everything possible to solve the problem ASAP.

[ITALIANO]
Gentili Clienti,

al momento sono confermati problemi da Telecom Italia (fiber-cut in Francia e Milano), DTAG e T-Mobile (non hanno dato spiegazioni precise) ed AT&T. Non sono disponibili tempistiche, ma il problema sembra di grande scala e coinvolge non solo l’Italia, la Germania, l’Austria e la Francia, ma anche paesi come la Grecia ed altri paesi Europei.

Non appena ci sono novita’ Vi faremo sapere al piu’ presto. Stiamo lavorando per Voi e facendo il possibile, affinche’ i problemi vengano risolti al piu’ presto.

[DEUTSCH]
Geehrte Kunden,

derzeit gibt es massive Störungen im Netz von Telecom Italia (Fiber-Cut in Frankreich und Mailand), DTAG & T-Mobile (keine offizielle Rückmeldung zu den Ursachen bisher) und AT&T. Bisher wurde noch keine ETA mitgeteilt, aber die Probleme erscheinen massiv zu sein und nicht nur in Italien, Deutschland, Österreich und Frankreich, sondern auch in Griechenland und andere europäischen Ländern zu spüren sein.

Sobald es Neuigkeiten diesbezüglich gibt, werden wir diese Seite aktualisieren.

UPDATE:
We just received confirmation that DTAG has changed routing from Italy via Switzerland, those connectivity issues seem to be solved.

Abbiamo appena ricevuto conferma che DTAG ha cambiato il routing dall’Italia passando per la Svizzera, questo problema di connettivita’ sembra essere risolto.

Wir haben soeben Bestätigung erhalten, dass DTAG das Routing von Italien über die Schweiz umleitet, dieses Konnektivitäts-Problem scheint somit gelöst.

UPDATE2:
The problems seem to be solved, Telecom Italia restored the fiber-cuts 04.52 CET this morning.

Problema risolto, Telecom Italia ha ripristinato i fiber-cuts alle ore 04.52 CET questa mattina.

Problem gelöst, Telecom Italia hat um 04:52 Uhr das Problem der Fiber-Cuts gelöst.

Connectivity Telecom Italia / Interbusiness / Seabone

Posted in Current by support on the November 16th, 2009 17:37

[ENGLISH]
Dear Customers,

currently there are connectivity problems from the Telecom Italia / Interbusiness / Seabone network; we have contacted our upstream-providers/carriers Level3, KPN and IPX/GBLX about this issue and got confirmation of the problem. We are working to resolve this problem – which does not depend and is not caused by us – ASAP.

[ITALIANO]
Gentili clienti,

al momento ci sono problemi di connettivita’ dalla rete Telecom Italia / Interbusiness / Seabone; abbiamo contattato i nostri carriers Level3, KPN e IPX/GBLX a riguardo e finora abbiamo ricevuto soltanto conferma del problema. Stiamo lavorando per risolvere questo problema – che non dipende da noi – al piu’ presto.

[DEUTSCH]
Geehrte Kunden,

derzeit gibt es eine Störung im Netz von Telecom Italia / Interbusiness / Seabone; wir haben unsere Carrier Level3, KPN und IPX/GBLX diesbezüglich bereits kontaktiert und bisher nur Bestätigung des Problems erhalten. Wir arbeiten daran, dass Problem – das nicht von uns abhängt – baldmöglichst zu lösen.

UPDATE:
Telecom Italia just confirmed they are having a big fault (fiber cut) in France (2 cuts) and one Milano. This was confirmed also by the Telecom Italia Sparkle (SEABONE) NOC. They are working on this issue to solve it ASAP.

Da Telecom Italia ci e’ giunta comunicazione urgente che stanno riscontrando gravi problemi a causa di due fibercuts in Francia ed un fibercut a Milano. Il tutto e’ stato confermato anche dal NOC di Telecom Italia Sparkle (SEABONE) . Stanno lavorando per risolvere il problema al piu’ presto.

Von Telecom Italia wurde das Problem als schwerwiegend bestätigt, es gibt zwei Fibercuts in Frankreich und einen weiteren in Mailand. Bestätigt wurde das ebenfalls vom NOC von Telecom Italia Sparkle (SEABONE). Es wird an der Behebung der Störung gearbeitet.

EMAIL FROM TELECOM ITALIA:

Dear
We have a big fault ( fiber cut) in france 2 cuts and one in milan.

We are working to solve it asap.

Regards

Diego

———————————————- Telecom Italia Sparkle SpA
Customer Assistance/Assurance I° t Se@bone Network Operations Center Via M.
Palocco, 223 – Rome, IT +39 XX (24H service)

UPDATE2:
Problems with DTAG were reported also, we’re awaiting updates from our carriers regarding those issues.

A quanto pare ci sono problemi anche nella rete DTAG, stiamo aspettando conferme ed aggiornamenti da parte dei nostri carriers a riguardo.

Es wurden Probleme auch im Netz der DTAG gemeldet, wir warten noch auf Feedback von unseren Carriern diesbezüglich.

UPDATE3:
To complete the list, problems with AT&T are also being reported.

Per completare la lista, sono appena giunte segnalazioni riguardo a problemi di connettivita’ anche per la rete AT&T.

Der Vollständigkeit halber sei auch noch erwähnt, dass es ebenfalls Problemberichte zum Netz von AT&T vorliegen.

UPDATE4:
All problems solved; we were updated by Telecom Italia at 04:52 CET that the fiber-cuts have been restored, both in Milano Chiasso and Marseille Vernegues and that the circuits are up and running fine.

Problema risolto; Telecom Italia ha confermato che alle ore 04:52 i fiber-cuts sono stati ripristinati (a Milano Chiasso e a Marseille Vernegues) e che la rete funziona regolarmente.

Problem gelöst; Telecom Italia hat um 04:52 Uhr bestätigt, dass die Fibercuts behoben wurden, sowohl in Chiasso Mailand, als auch in Marseille Vernegues und dass das Netz wieder einwandfrei funktioniert.

E-MAIL FROM TELECOM ITALIA:

Dear Customer,

Please be informed that both Fiber cuts Milano Chiasso /  Marseille Vernegues have been restored and the 

circuits should be up and running fine.

We kindly ask you to confirm the current status.

Best Regards,Nicola

Telecom Italia Sparkle Contact Center

Telephone:   +39 XX
Fax:             +39 XX

Problemi datacenter #2

Posted in Current by support on the November 10th, 2009 17:59

Gentili Clienti,

al momento ci sono problemi a raggiungere alcuni server colocati nel datacenter #2.

Ci scusiamo per gli eventuali disagi e rimaniamo a Vs completa disposizione.

UPDATE: problema risolto.

.TEL Planned CTH (Community Tel Hosting) Maintenance

Posted in Current by support on the November 9th, 2009 18:15

Telnic, the operator of the .TEL-Registry as part of their standard operating procedure will be initiating a failover of Community TelHosting Services from their primary data centre to their failover centre on Saturday 14th November. They intend to failback to their primary centre on Sunday 22 November. The detail of this activity is provided below.

Date: Saturday 14 November 2009
Start Time: 08:30 UTC
End Time: 12:00 UTC
Duration: 3.5 Hours

Production System Impact Summary

* CTH Web based UI and API – Not available during the maintenance window
* SRS – Not affected and fully available
* DNS – Not affected and fully available
* WHOIS – Not affected and fully available
* TelProxy – Not affected and fully available

Date: Sunday 22 November 2009
Start Time: 08:30 UTC
End Time: 12:00 UTC
Duration: 3.5 Hours

Production System Impact Summary

CTH Web based UI, API and Administration URL:
https://telhosting.serverclienti.com/

Should you have any questions relating to this maintenance, the registration or transfer of a .TEL domain name, please contact our support team using the credentials that you have been supplied with.

mx1.serverclienti.com: Barracuda Cluster Upgrade

Posted in Current by support on the November 4th, 2009 14:06

Currently the Barracuda Spam & Virus Firewall “mx1.serverclienti.com”, part of our clustered antispam-solution, is being upgraded. The other Barracuda Spam & Virus Firewalls will take over the filtering and load in the meantime, so there should be no noticeable customer impact. ETA is 60 minutes.

mx2.serverclienti.com: Barracuda Cluster Upgrade

Posted in Current by support on the November 4th, 2009 13:41

Currently the Barracuda Spam & Virus Firewall “mx2.serverclienti.com”, part of our clustered antispam-solution, is being upgraded. The other Barracuda Spam & Virus Firewalls will take over the filtering and load in the meantime, so there should be no noticeable customer impact. ETA is 60 minutes.

UPDATE: Upgrade successfully completed.

incubatec system status

Search

Sites and Services

Archives

Categories