Just received this email. Worth Sharing...

21/08/2008 05:33 PM
Adalah dimaklumkan bahawa GCERT telah menerima makluman bahawa terdapat kelemahan pada aplikasi Joomla! versi 1.5.x yang digunakan oleh beberapa laman web agensi kerajaan yang terdedah kepada ancaman password reset bagi akaun Administrator secara jarak jauh.

Kelemahan tersebut akan membolehkan kata laluan bagi 'Administrator' diubah dan seterusnya membolehkan penceroboh menukar maklumat yang terdapat pada laman web berkenaan. Penceroboh juga berupaya untuk memasukkan backdoor ke server berkenaan dan seterusnya mendapat kawalan penuh terhadap server web tersebut.

NOTA MAKLUMAN GCERT BIL. 4/2008

PADA 14 OGOS 2008

KETERANGAN ANCAMAN

Nama dan Jenis Ancaman
Joomla "token" Password Change Vulnerability
(Pencerobohan Laman Web)

Tarikh Dikesan
13 Ogos 2008

Bilangan Agensi Terlibat
Semua agensi yang menggunakan Joomla! CMS versi 1.5.x

Sistem Pengoperasian/Aplikasi Berisiko
Joomla! CMS versi 1.5.0 - 1.5.5

Kaedah Serangan
Penceroboh boleh reset kata laluan bagi akaun pertama yang masih aktif (kebiasaannya adalah akaun Administrator)

Kesan Serangan
Penceroboh akan login sebagai 'Administrator' dan berupaya membuat pelbagai perubahan termasuk mengubah kandungan laman web, mencipta akaun pengguna yang baru, memuat naik backdoor, memasang perisian bot, dll.

Cadangan Tindakan Pengukuhan
1. Menukar (rename) akaun (login ID) 'Administrator' ke nama yang lain.
2. Menukar (rename) folder 'administrator' ke nama yang lain.
3. Menaiktaraf Joomla! CMS ke versi 1.5.6 atau audit source code bagi fail 'reset.php'

Maklumat Lanjut
1. http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html
2. http://secunia.com/advisories/31457/
3. http://gcert.mampu.gov.my/index.php?option=com_content&task=view&id=209&Itemid=1

"BERKHIDMAT UNTUK NEGARA"

Government Computer Emergency Response Team (GCERT)
Aras 3, Blok B2
Bahagian Keselamatan ICT
MAMPU, Jabatan Perdana Menteri
62502 PUTRAJAYA
No. Tel: 03-8888 2273
No. Faks: 03-8888 3201

Iklan Petronas yang best!

Selamat Menyambut Kemerdekaan ke-51

Lesson 1
A man is getting into the shower just as his wife is finishing up her shower, when the doorbell rings.

---

Lesson 2
A priest offered a Nun a lift.

---

Lesson 3
A sales rep, an administration clerk, and the manager are walking to lunch when they find an antique oil lamp.

---

---

Lesson 5
A turkey was chatting with a bull.

---

Lesson 6
A little bird was flying south for the winter. It was so cold the bird froze and fell to the ground into a large field.

The seed of God is in us. Pear seeds grow into pear trees, nut seeds into nut trees, and God seeds into God.

-Meister Eckhart-

Often we may feel critical and judgmental about our maturity or personality. When we read that we have God seeds within us, we may find it difficult to believe. How can we have the God seeds within us that other people have? It may seem that everyone else has more good within them than we have.

Just as we admire certain qualities about other people, so can we admire quality about ourselves. We need to remember that a good critic looks at both the good and the bad. A good critic doesn't pass judgment, but merely assembles the facts to allow others to make judgments.

The seeds that grow pear trees don't yield perfect fruits. Some of the fruits are ripe and juicy, some are hard and dry and some never mature. Yet the pear tree will be a good tree, if it is tended with care. So it is with us. Every part of us may not be perfect, but with care we can make the best person possible from the God seed that began us.

I can be a healty, bountiful person, if I give myself plenty of care, in future, I won't give up on me!

Event: Graduation Ceremony for Infosys Foundation Programme 2008
Date: 14th August 2008
Venue: Auditorium, Melaka International Trade Centre

At last, after been postponed from the original date of 19 July, the Ministry of Higher Education had requested UTeM to held this event on 14th August.
This time UiTM and UTHM which conducted the programme for the first time also joint us at MITC.
As usual, i m involving in this programme too. This time as an emcee. Nervous but managed to do my best. Thanks alot for Emma's script and supports.

Well, still waiting for pictures from the event, will update this entry when got the pictures.