Autolinks exploit, affects even the current 2.1

[cd34]

For those of you running autolinks, there is a recent exploit that allows them to do a remote include and launch a DOS attack from your website. The problem is pretty much based on poor sanitization of data in al_initialize.php

put this in your .htaccess in the same directory where al_initialize.php exists.


RewriteEngine on
RewriteRule al_initialize.php - [F]

[Monterey]

here is another fix I found on another board...

in al_initialize.php

you can replace
if( strstr($alpath,"http://") || strstr($alpath,"https://") ) exit( "Invalid \$alpath variable" );


with
if( strstr($alpath,"http://") || strstr($alpath,"https://") || strstr($alpath, "ftp://")) exit( "Invalid \$alpath variable" );

this line will appear twice, update it.

log files are filled with

[01-Sep-2005 23:06:33] PHP Warning: fgets(): supplied argument is not a valid stream resource in ftp://test:test@216.55.149.173/Asho...l_functions.php on line 798