NYCPHP Meetup

[Mitch Pirtle]

On 12/2/05, Stephen Musgrave <stephen at musgrave.org> wrote:
>
> Hello -
>
> I installed Mambo about a year ago for a client and the night before
> Thanksgiving, the home page was defaced (and plenty of other files were
> uploaded to the server but didn't overwrite Mambo files).

The fact that their website has not been kept up to date tells me
there's no need to investigate how the site was compromised, as there
are too many known exploits for a system that hasn't been patched in a
year or more... 4.5.1a was replaced by many point releases that took
care of security holes, bugs, and performance issues.

I'd strongly suggest that you have your server checked for rootkits,
and make sure it is clean, and then upgrade your client's website to
either Mambo 4.5.3 or Joomla! 1.0.4.

Joomla! is really the continuation of the original Mambo development
team, who left the project to start Joomla! back in August. So the
1.0.x releases are basically what they were working on in Mambo-land,
circa 4.5.2.4. (Disclaimer, I'm one of the former Mambo devs who
started Joomla!)

More importantly, if there is a security fix published for the
software that powers their site, they need to upgrade. "Installing and
forgetting" may work for printers, but for websites you are playing
russian roulette.

--
Mitch Pirtle
Joomla! Core Developer
Open Source Matters