Summary: | www-apps/phpBB: 2.0.16 fixes security issue | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Matthias Geerdsen (RETIRED) <vorlon> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | major | CC: | web-apps |
Priority: | High | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Other | ||
URL: | http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=302011 | ||
Whiteboard: | B1 [glsa] vorlon | ||
Package list: | Runtime testing required: | --- |
Description
Matthias Geerdsen (RETIRED)
2005-06-28 01:16:31 UTC
(In reply to comment #0) > web-apps, pls bump > comments on a possible impact are also welcome :-) looks serious: http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2005-06/0261.html "Description: Due to a bug in the phpBB highlighting code it's possible to inject PHP-code into the running script. E.g. It's possible to run system commands if the PHP interpreter allows system() and simular functions. This is actually based on an old bug which was improperly fixed in phpBB 2.0.11." Exploit is out. Please bump ! Bumped. ppc: please test and mark stable asap Instead of stable keywording, can we just drop ppc from all phpbb-versions and set it ~ppc? I guess, there is no user who runs phpbb on ppc. And we are sick of testing this app with every security hole (and it seems phpbb is written as a large security hole...). An alternative solution would be to security.mask it because it's a continuing pain in the ass. After all, it's a stable security hole. In all cases we should issue a GLSA for this fix, and to warn people that we won't issue more for phpBB, that is now security.masked. I would add to the GLSA something like: "Due to continuing security problems, phpBB has been masked in the Portage repository and no further announcement will be made on phpBB security fixes. phpBB users that knowingly want to continue to use the phpBB Gentoo package should add the package name to package.unmask and are advised to follow phpBB security advisories directly from www.phpbb.com." phpBB has been masked due to its constant security issues. I guess this is ready for GLSA. This is GLSA 200507-03, thanks everyone. |