Posted to their forum... |
||
 Ret. Mar Ikioi Dunno if it will stay up (they seem to have no forum for bugs, but oh well): I would like to reply to an announcement, and this seems the most fitting forum. If it is not, please move my post to the correct one. In reply to http://www.phpbb.com/phpBB/viewtopic.php?t=183098 : "If you're an admin why would you want to bother jumping through hoops to discover another users password? " People sometimes share passwords with their e-mail, other sites, etc. Sure, there are other methods to get another users password, if you have access to modify site files, but this is outside the bounds of phpBB, and would include more trusted individuals. Shared passwords is a bad habit, but one that exists, none the less. Remember, not all forum admins are the same people that are the site admins. "I fail to see why a 'shared hosting' environment increases the risks here. ... I know of no host which gives all users the same database!" I am a hosting provider, and I can give you as many examples in which this is true, if you would like. People incorporate phpBB into other software, and share DB's for many reasons. Main site with only one SQL db, that runs forums for subdomains; Incorporating phpBB into a CMS, like Postnuke; etc. I host many sites that use these examples, this is not a hypothetical situation. Shared hosting environment increases the risk for many reasons, the chief being that shared hosts work with limitted resources, thus, are more prone to make the best use of them through sharing. The other thing I would like to point out is that no security flaw should be very very low priority. As I understand it, a fix is already available at http://www.gulftech.org/vuln/phpBBadminFix.rar , so priority need only be to incorporate the already available fix, correct? Where risk can be lowered, it should be lowered. I have seen a proof of concept of this exploit, and in a shared environment, it could be very hazardous. Thank you, and feel free to e-mail me as a hosting provider, if you wish more information about situations of SQL usage in a shared hosting environment that you may not be familiar with that could increase security risks to exploits such as the one mentioned. 
Replies:
|
||
| CyberArmy::Forum v0.6 Generated In 0.01060 seconds |
2004-03-22 04:23:47
2004-03-25 16:48:09
2004-03-24 03:17:41
2004-03-23 11:16:40
2004-03-23 09:25:26