Apply critical Joomla update immediately

This alert was sent to U-M IT staff groups on October 27, 2015.

This message is intended for U-M IT staff who are responsible for university websites that use the Joomla content management system.

Summary

The Joomla team has released a new Joomla version (3.4.5) to fix several serious security vulnerabilities. The most critical one allows a remote unauthenticated attacker to take full control of a vulnerable website. Attackers are actively exploiting this vulnerability, and attacks are being detected at U-M. If you are responsible for an installation of Joomla, update it immediately.

Threats

Exploitation of the SQL injection vulnerability in the com_contenthistory module, which is included by default, allows an attacker to take full control of vulnerable websites. Exploitation can be performed remotely without authentication. Attackers are actively exploiting this vulnerability, and attacks are being detected at U-M.

Affected Systems

Websites using the Joomla content management system versions 3.2 through 3.4.4.

Action Items

Update to Joomla version 3.4.5 immediately. You can download the update from the Joomla website. See Joomla! 3.4.5 Released.

The Joomla team recommends looking at web server logs to try to find signs of this attack. A search for “option=com_contenthistory&view=history” in web server log files should help you detect possible attacks. Note that blocking these requests only via GET requests will not completely prevent attacks, because attacks can also happen via POST.

If you are running a vulnerable version of Joomla and see signs of this attack or suspect that your web site has been compromised, please contact [email protected].

Technical Details

This vulnerability was discovered by the TrustWave team, and they have published a document explaining it in detail: Joomla SQL Injection Vulnerability Exploit Results in Full Administrative Access.

Information for Users

People browsing the web do not need to do anything out of the ordinary because of the Joomla vulnerability. In general, the best protection for your devices is this: keep your software and apps up-to-date, do not click suspicious links in email, do not open email attachments unless you are expecting them and trust the person who sent them, and only use secure, trusted networks. For more information, see Spam, Phishing, and Suspicious Email, Instructions for Securing Your Devices and Data, and Use a Secure Internet Connection on the U-M Safe Computing website.

Questions, Concerns, Reports

Please contact [email protected].

References