Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: phpbb 2.0.15 released - patches high critical vuln
From: Paul Laudanski <zx () castlecops com>
Date: Thu, 12 May 2005 18:13:42 -0400 (EDT)

As expected, today was supposed to be full-disclosure on this
vulnerability.  On further evaluation, another vendor must be contacted as
the vulnerability permits a users computer to be hijacked.  Surely there
is enough of that going on with current spyware/adware.  That vendor has
been sent an email today, and we'll respond back to the lists with a
followup shortly.

Eventually we'll get to releasing the full disclosure, however, at this 
stage, it is a much bigger issue than just phpbb and we want to play it 
safe for the greater community-at-large.

On Sun, 8 May 2005, Paul Laudanski wrote:

re: http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=288194

A high risk bbcode.php vulnerability is patched with this version, at the
very least please patch it via the link above.  It was discovered by
Papados and patched by myself.  In agreement with phpbb.com, we'll
(CastleCops) release the full details in five days.  A CVE has been

Paul Laudanski .. Computer Cops, LLC.
Microsoft MVP Windows-Security 2005
CastleCops(SM)... http://castlecops.com
CC Blog ......... http://blog.castlecops.com
Staff Blogs ..... http://busterbunny.castlecops.com
Our Vision ...... http://castlecops.com/postt63382.html

http://cuddlesnkisses.com http://justalittlepoke.com http://zhen-xjell.com

________ Information from Computer Cops, L.L.C. ________
This message was checked by NOD32 Antivirus System for Linux Mail Server.

  part000.txt - is OK
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]