wow in 2009 it was exploited and someone wants to include that rule in 2015? Shouldnt be that plugin upgraded?
If this is the case then 1000’s more exploit rules needs to be included in CWAF till date. Then we will monitor apache load and will try to find out solution to lower its load. #DependencyRocks
It’s easy to talk. If you’ve on the same server 5 or 10 clients with joomla plugins using this library, i suppose you would talk differently. If you’re not the programmer and clients don’t want to update or remove the plugin, what would you do?
It’s not 1000’s, it’s only the ones that are most used by “script kiddies”.
Other rule makers, like OWASP, are bad, but they prevent this attacks that are more used by the script kiddies.
If we cannot rules to stop attacks, so what’s the use of the rules!
I dont think you got my point but I do get your point. Always excess of rules will lead to heavy load on Apache, so we should not try adding oldest of exploits. Instead software must be update. A real time virus scanner must be used to stop uploading of shells and mailers instead.
A Real time virus scanner is what we’ve, but that doesn’t stop all uploads of malicious codes, most LInux antivirus doesn’t detect nothing, almost nothing, the best is clamav with maldet signatures and some other signatures, plus we make our own, but that also takes memory and is very expensive to apache, like you said.
Sometimes some kind of exploits, are similiar, and a construction of one rule, can avoid NNNN exploits.
Upgrade the software, is like i said, if it is your sites great, but normally this is not your sites, and clients don’t want upgrades. Of course rules can’t cover all exploits, it’s impossible in terms of resources. But some of them, like this one, is BIG AND VERY USED, so it should be stoped, do a google search, there’re thousands of possible sites to attack. Also, like i said, it’s possible to upload a shell or some kind of script to attack, without being detected by antivirus.