Ker JeiAr
Have you guys seen this?
www.phpbb.com/phpBB/viewtopic.php?f=14&t=183098
psoTFX
Development Team Leader
Joined: 03 Jul 2001
Posts: 8803
Location: Location? I don't need no stinking location ...
Posted: Mon Mar 22, 2004 1:06 pm Post subject: Recent "multiple vulnerabilities" post to bugtraq
--------------------------------------------------------------------------------
We've already had at least one email concerning this post to bugtraq, "Phpbb 2.0.7a And Earlier Secuity Issues" by "JeiAr <security@gulftech.org>".
As I made clear in correspondence with this user the issues raised are of very very low priority in mine and others opinions. I'll explain why ...
The issues noted concerning the admin scripts are effectively of no concern. To be able to take advantage of said vulnerabilities you must be an admin. If you're an admin why would you want to bother jumping through hoops to discover another users password? You could simply go in, set it to whatever you like and tada, off you go. I fail to see why a "shared hosting" environment increases the risks here. A board is tied to a database. I know of no host which gives all users the same database! Thus the admin of one board cannot use these issues to obtain information concerning another board.
The issue surrounding session_id checking in posting has been covered in public on this forum many times in the past. At one point we implemented checking in posting. We ended up with so many complaints from users who couldn't post because their sessions had expired (even after relevant workarounds had been tried) we removed it. Since then we've had absolutely no reports of problems. We retained session checking in areas like modcp to prevent "spoofing" of moderator functions from 3rd party sites or local links. This entire sequence of events was quite public and openly discussed here.
Thanks.
_________________
Paul S. Owen - Development Team Leader
phpBB 2.2 | Feature Requests | Snapshots | ACP
<---- Support the London 2012 Olympic Bid ---->
"To err is human, to screw up royally requires me!"
I thing phpBB do a pretty good job with security, but I do not for the life of me understand this.
User #1 can put the link to an admin command into an image tag
Admin #1 views the malicious post and unknowingly issues an admin command and deletes the post with the bogus image thus eliminating the evidence.
Sure, the commands you can have an admin execute are limited to the ones that collect thier data values via the GET method, but isn't that still a fairly serius issue? After reading that post, and thier not replying to this email
http://www.gulftech.org/vuln/phpBBEmail.txt
I am beginning to think either they or crazy or I am crazy. lol Nothing personal against them, I love phpBB, but I just do not see the logic. Invision Power Board, PostNuke, and many others REQUIRE session ID's or Auth keys with no problem and as a result are much more secure and do not allow users to trick admins into running commands.
Also, take for example the SQL injection vulnerability. A user cannot exploit this issue himself, but he can trick an admin into running a query just by viewing a malicious post. I just don't get why that is not seen as a big deal?
GulfTech Security Research
SubScan 1.2
Replies:
|
2004-03-25 16:48:09
2004-03-24 03:17:41
2004-03-23 11:00:34
2004-03-23 11:16:40
2004-03-23 09:25:26