RE: Development Teams Reply

[Replies] [Reply] [View by Thread] [Help]
[Back To Security]

Ker JeiAr

www.gulftech.org/images/brute.jpg

Here is a post I am gonna send to BugTraq to show how dangerous this issue is and how it NEEDS to be fixed.

Since the phpBB team do not seem to think the issues I found as outlined here are serious issues.

http://www.gulftech.org/03202004.php

I have decided to release some proof of concept exploit examples. The ones of you who know me are probably familiar with the fact GulfTech keeps exploit code and the like private in almost all cases and only shares it with known security researchers, but I feel this is the only way to make misinformed people believers. It's unfortunate, but I will limit the examples to deleting posts and not performing admin actions as my purpose is to not have anyone do any real harm to someones forum.

http://www.gulftech.org/vuln/phpBBpoc/

There has also been a thread started about this issue on the CA Security forum.

http://www.cyberarmy.net/forum/security/messages/203396.html

If anyone wants to give thier opinion we would love to hear it as long as it is appropriate and not a flame or something unnecessary. We only want civilized discussion about this issue and a proposed fix :)

Best Regards,

JeiAr
GulfTech Security Research

GulfTech Security Research
SubScan 1.2

Replies:

phpBB 2.0.7a And Earlier Security Issues - Ker JeiAr 2004-03-22 04:23:47
- Some Fixes For These Issues - Ret. Ker JeiAr 2004-03-25 12:11:30
  - sweet man :) - LtKer Semper 2004-03-25 16:48:09
    - RE: sweet man :) - Ret. Ker JeiAr 2004-03-25 19:01:33
- Hmmmm ... - Ker JeiAr 2004-03-23 20:40:47
  - Hah. - Lt Obscurity 2004-03-24 03:17:41
- Want Some Opinions - Ker JeiAr 2004-03-23 05:18:00
  - RE: Want Some Opinions - Lt Obscurity 2004-03-23 07:46:48
    - I'm with you, they are on crack with this one... - Ret. Mar Ikioi 2004-03-23 11:00:34
      - RE: I'm with you, they are on crack with this one... - Ker JeiAr 2004-03-23 17:14:55
      - Development Teams Reply - Lt Obscurity 2004-03-23 14:19:18
        RE: Development Teams Reply - Ker JeiAr 2004-03-23 17:17:53
        RE: Development Teams Reply - Ker JeiAr 2004-03-23 17:31:30
        RE: Development Teams Reply - Lt Obscurity 2004-03-23 17:25:16
        RE: Development Teams Reply - Ker JeiAr 2004-03-23 17:33:40
        RE: Development Teams Reply - Lt Obscurity 2004-03-23 18:15:38
        >RE: Development Teams Reply - Ker JeiAr 2004-03-23 19:39:35 <
        RE: Development Teams Reply - Lt Obscurity 2004-03-24 03:14:15
      - Posted to their forum... - Ret. Mar Ikioi 2004-03-23 11:37:22
        RE: Posted to their forum... - Ker JeiAr 2004-03-23 17:49:48
        Argh if someone could delete the post previous - Lt Obscurity 2004-03-23 11:50:55
        Done :) - Ret. Ker JeiAr 2004-03-24 05:31:16
        Hah thanks... - Lt Obscurity 2004-03-24 06:04:35
    - RE: Want Some Opinions - Ker JeiAr 2004-03-23 08:05:01
      - To be honest... - Lt Obscurity 2004-03-23 08:21:38
        RE: To be honest... - Ker JeiAr 2004-03-23 08:32:53
        RE: To be honest... - Lt Obscurity 2004-03-23 08:40:09
        RE: To be honest... - Ker JeiAr 2004-03-23 08:54:05
        RE: To be honest... - Lt Obscurity 2004-03-23 09:07:57
        'respond' :D -nt- - LtKer Bastian 2004-03-23 11:16:40
        RE: To be honest... - Maj zaydana 2004-03-23 09:25:26
        GPL... just fork it. ;) -nt- - Ret. Mar Ikioi 2004-03-23 11:39:41
        Ikioi [more] - Lt Obscurity 2004-03-24 10:21:14

Guest:
Subject:
Message:	On 2004-03-23 19:39:35, JeiAr wrote >Here is a post I am gonna send to BugTraq to show how dangerous this issue is and how it NEEDS to be fixed. > >Since the phpBB team do not seem to think the issues I found as outlined here are serious issues. > >[URL=http://www.gulftech.org/03202004.php]http://www.gulftech.org/03202004.php[/URL] > >I have decided to release some proof of concept exploit examples. The ones of you who know me are probably familiar with the fact GulfTech keeps exploit code and the like private in almost all cases and only shares it with known security researchers, but I feel this is the only way to make misinformed people believers. It's unfortunate, but I will limit the examples to deleting posts and not performing admin actions as my purpose is to not have anyone do any real harm to someones forum. > >[URL=http://www.gulftech.org/vuln/phpBBpoc/]http://www.gulftech.org/vuln/phpBBpoc/[/URL] > >There has also been a thread started about this issue on the CA Security forum. > >[URL=http://www.cyberarmy.net/forum/security/messages/203396.html]http://www.cyberarmy.net/forum/security/messages/203396.html[/URL] > >If anyone wants to give thier opinion we would love to hear it as long as it is appropriate and not a flame or something unnecessary. We only want civilized discussion about this issue and a proposed fix :) > >Best Regards, > >JeiAr >GulfTech Security Research
Signature:
Optional Image Link:
http://

CyberArmy::Forum v0.6
Generated In 0.01070 seconds