Forum Moderators: not2easy

Message Too Old, No Replies

Yet another batch of security holes in Mambo/Jomlaa

         

pmkpmk

4:43 pm on Jan 19, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Version 1.0.7 of Jomlaa! (a derivative of Mambo) and versions prior 4.5.3 of Mambo have several security holes, so that the CMS can be used by third parties to send SPAM which apparently comes from the domain where Mambo/Jomlaa is installed.

This is again a rather severe security issue related to Mambo/Jomlaa, which makes me wonder if this CMS should be used for serious projects. But keep in mind that I am biased since I favour Typo3.

malachite

6:27 pm on Jan 19, 2006 (gmt 0)

10+ Year Member



Biased as you may be in favour of Typo3, I'm surprised to see a senior member posting something so factually inaccurate.

Your allegations in relation to version 1.0.7 of Joomla! are entirely unfounded, as the code has been hardened relating to all identified security threats. At the present time, there are no known exploits.

The Joomla! team monitors and fixes security issues as they arise, just as the team at Typo3 does the same. There are members of the Joomla! team who keep in close contact with other open source project teams who face similar ongoing security risks, the Typo3 team being one of those.

In reality, most of the exploits cannot be executed if the hosting provider has an adequately secure server. It is heartening to see open source projects collaborating on security issues, knowing that many users are on shared hosting - which makes ongoing security patches more critical.

pmkpmk

8:19 am on Jan 20, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



This is where I got my information from: [heise.de...] It's Germanys leading IT news portal and usually there's no reason to don't believe them.

malachite

10:11 am on Jan 20, 2006 (gmt 0)

10+ Year Member



They have mangled the facts, as the media is known to do ;) In fact the article refers to versions prior to Joomla! 1.0.7, and a module feature which is switched off by default.

As I mentioned earlier, the vulnerabilities are not an issue if the server is properly secured. Much of the media hype has, I suspect, come about due to the recently publicised hacking of Mambo sites. This has not been the case with sites using Joomla!

Also lost in translation is the word "bugs", which in German appears as "errors"!

Moral of the story, take what you read/hear in the news with a pinch of salt :)

pmkpmk

10:17 am on Jan 20, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Moral of the story, take what you read/hear in the news with a pinch of salt happy!

I'm working in video editing and 3D graphics, so I can extend this to take ANYTHING with a pinch of salt. Or, as Fox Moulder would put it: Trust nobody!

Friends again?

malachite

3:35 pm on Jan 20, 2006 (gmt 0)

10+ Year Member



Friends again?

LOL. No worries :)