2

I've been looking at some httpd threads with strace and noticed a ton of locations that are incorrect:

access("/var/www/html/libraries/cms/database/database.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029> access("/var/www/html/libraries/joomla/database/database.php", F_OK) = 0 <0.000029>

access("/var/www/html/libraries/cms/database/query.php", F_OK) = -1 ENOENT (No such file or directory) <0.000028> access("/var/www/html/libraries/joomla/database/query.php", F_OK) = 0 <0.000029>

access("/var/www/html/libraries/cms/database/query/mysqli.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029> access("/var/www/html/libraries/joomla/database/query/mysqli.php", F_OK) = 0 <0.000033>

There are hundreds of these. Seems that these httpd threads look in the cms directory first but then correctly go to the joomla directory after. I think the "cms" directory is an old Joomla convention. Individually the impact is quite small but adding hundreds of these certainly adds up (timing wise). Anyone know what is going on here?

UPDATE:

Additional lines:

access("/var/www/html/libraries/cms/application/web.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029>
access("/var/www/html/libraries/cms/application/base.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029>
access("/var/www/html/libraries/cms/filter/input.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029>
access("/var/www/html/libraries/cms/registry/registry.php", F_OK) = -1 ENOENT (No such file or directory) <0.000028>
access("/var/www/html/libraries/joomla/registry/registry.php", F_OK) = -1 ENOENT (No such file or directory) <0.000027>
access("/var/www/html/libraries/legacy/registry/registry.php", F_OK) = -1 ENOENT (No such file or directory) <0.000027>
access("/var/www/html/libraries/cms/uri/uri.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029>
access("/var/www/html/libraries/cms/string/string.php", F_OK) = -1 ENOENT (No such file or directory) <0.010800>
access("/var/www/html/libraries/cms/event/dispatcher.php", F_OK) = -1 ENOENT (No such file or directory) <0.000029>

and the list goes on and on.

closed as unclear what you're asking by Valentin Despa Oct 29 '15 at 18:23

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • afaik there has never been a /libraries/cms/database directory. seems like a bug!? is there any way to tell where these calls come from? is it always the .../database/... directory? – fruppel Jul 28 '15 at 7:58
  • @fruppel I'm trying to understand myself where this is coming from, no luck so far. It's not always /database/ there are a bunch of other ones as well usually with 'cms' as the common incorrect path – Tom Jul 29 '15 at 4:41
  • interesting. can you post some more of these examples? does that happen on a new joomla installation? when does it happen? – fruppel Jul 29 '15 at 9:38
  • @fruppel updated post with more examples. I'm still on an older release 3.3.6, haven't tried on the latest. I've monitored many different httpd threads and this happens in most of them. – Tom Jul 30 '15 at 12:51
  • 3
    This is a wild guess, but someone may be trying to scan for known vulnerabilities using some automated scripts, but the files containing those vulnerabilities were renamed/moved in later versions hence the "no such file ..." error, but as I said it is a wild guess. – Mohd Abdul Mujib Jul 30 '15 at 14:04