A new attack target - GCalendar.

Posted: Mon Jun 21, 2010 6:58 am

I haven't seen GCalendar targeted before. So, I figure that I'd share it with the community.

Code:

Created By: NukeSentinel(tm) 2.6.03


Date &amp; Time: 2010-06-21 00:20:00 EDT GMT -0400


Blocked IP: 88.191.94.*


User ID: Anonymous (1)


Reason: Abuse-CLike


--------------------


Referer: none


User Agent: libwww-perl/5.805


HTTP Host: [ Only registered users can see links on this board! Get registered or login! ]


Script Name: /modules.php


Query String: name=GCalendar&fil...wday&y=2007&m=12&d=23&e=1/*.php?option=com_gcalendar&controller=../../../../../../../../../../../../../../../proc/self/environ


Get String: name=GCalendar&fil___wday=&y=2007&m=12&d=23&e=1/*.php?option=com_gcalendar&controller=../../../../../../../../../../../../../../../proc/self/environ\0


Post String: Not Available


Forwarded For: none


Client IP: none


Remote Address: 88.191.94.188


Remote Port: 43792


Request Method: GET


--------------------


Who-Is for IP

Posted: Mon Jun 21, 2010 7:05 am

They must be trying that because of the reference to gCalendar, but there is nothing to worry about even without sentinel. I'm not sure what this attack is trying to do, but it has absolutely no correlation to the gCalendar that we are using.

Posted: Mon Jun 21, 2010 8:41 am

Thanks for the quick response. I was comforted that Sentinel blocked it. However, knowing what is coming is gives us the ability to harden the code - but that's obviously not necessary.

Posted: Mon Jun 21, 2010 10:17 am

I think it's a google calendar attack. The "G" is just a coincidence. LOL, I was going to say the G is just a string but I won't.

You can Google the proc/self/environ attack. It appears to be aimed at UNIX type systems that are not up to date.