A new attack target - GCalendar.

webservant · Posted: Mon Jun 21, 2010 6:58 am

I haven't seen GCalendar targeted before. So, I figure that I'd share it with the community.

Code:

Created By: NukeSentinel(tm) 2.6.03
Date & Time: 2010-06-21 00:20:00 EDT GMT -0400
Blocked IP: 88.191.94.*
User ID: Anonymous (1)
Reason: Abuse-CLike
--------------------
Referer: none
User Agent: libwww-perl/5.805
HTTP Host:

Only registered users can see links on this board!
Get registered or login to the forums!

Script Name: /modules.php
Query String: name=GCalendar&fil...wday&y=2007&m=12&d=23&e=1/*.php?option=com_gcalendar&controller=../../../../../../../../../../../../../../../proc/self/environ
Get String: name=GCalendar&fil___wday=&y=2007&m=12&d=23&e=1/*.php?option=com_gcalendar&controller=../../../../../../../../../../../../../../../proc/self/environ\0
Post String: Not Available
Forwarded For: none
Client IP: none
Remote Address: 88.191.94.188
Remote Port: 43792
Request Method: GET
--------------------
Who-Is for IP

Palbin · Posted: Mon Jun 21, 2010 7:05 am

They must be trying that because of the reference to gCalendar, but there is nothing to worry about even without sentinel. I'm not sure what this attack is trying to do, but it has absolutely no correlation to the gCalendar that we are using.

webservant · Posted: Mon Jun 21, 2010 8:41 am

Thanks for the quick response. I was comforted that Sentinel blocked it. However, knowing what is coming is gives us the ability to harden the code - but that's obviously not necessary.

fkelly · Posted: Mon Jun 21, 2010 10:17 am

I think it's a google calendar attack. The "G" is just a coincidence. LOL, I was going to say the G is just a string but I won't.

You can Google the proc/self/environ attack. It appears to be aimed at UNIX type systems that are not up to date.