PHP, phpBB vs. the Santy and Anti-Santy Worm

by Steve Mallett

There is a phpBB worm and anti-worm worm on the loose. What is interesting is that neither PHP nor phpBB are taking responsibility for it.

PHP: "A recent Web Worm known as NeverEverSanity exposed a mistake in the input validation in the popular phpBB message board application. Their highlighting code didn't account for double-urlencoded input correctly. Without proper input validation of untrusted user data combined with any of the PHP calls
that can execute code or write to the filesystem you create a potential security problem. Despite some confusion regarding the timing of some unrelated PHP security fixes and the NeverEverSanity worm, the worm didn't actually have anything to do with a security problem in PHP."



phpBB: "Recently a serious exploitable issue was discovered in PHP (the scripting language in which phpBB, IPB, vB, etc. are written) versions prior to 4.3.10. The problematical functions include unserialize and realpath. phpBB (along with a great many other scripts including IPB, vB, etc.) use these two functions as a matter of course.

It has come to our attention that code has now been released which uses this exploit in PHP to obtain confidential information in phpBB. Such information includes data contained in phpBB's config.php file. We therefore recommend the following:

1) If you maintain your own server be sure to upgrade to the newest available release of PHP (both versions 4 and 5). Be aware that at this time phpBB 2.0.x has problems functioning under PHP5 without modification.

2) If you pay for hosting ensure you hosting provider has upgraded their installation of PHP (again remember that phpBB 2.0.x and other scripts will not function under PHP5 without modification)"

107 Comments

deskpro
2004-12-31 15:10:09
Because thats two different issues
That is because these are two seperate issues.


a) The worm targets phpBB because they did not do correct validation on a string that is then send to preg_ using the /e modifier which results in the code being run. This *is* phpBB's fault, they have taken responsibility for it (a while ago) and released a new version.


b) The second problem is with unserialize(). It is possible to send data to unserialize() that will cause a type of memory dump. A number of applications that use seralize() to transmit data (e.g. through FORM hidden fields or cookies) are vunerable to this attack. It is somewhat debatable whose fault this is. Some cliam that you should not send unvalidated data to serialize(), others claim that PHP should not try and unserialize() a string that is not serialized().

Shezaf
2005-01-02 00:53:34
Who is at blame for Santy?
Santy certainly exploits a bug in phpBB. The guys at phpBB.com never commented on that and the article on their site regarding a PHP voluntarily predates Santy's attack.


On the other hand Santy's successor phpInclude actually does not exploit any specific vulnerability. It is probably the first worm to take advantage of bugs in custom programs left by the PHP programmer rather than by the PHP system itself.


You can read more about that at http://seclists.org/lists/webappsec/2004/Oct-Dec/0501.html


Ofer Shezaf
CTO, Breach Security
http://www.breach.com

BeeKompany
2006-09-08 08:42:10
The Companies BeeKompany are required reliable people for collaboration.
Work is connected with sale and money orders on auction Ebay.
Interested persons to try itself write to
Email: [b]sell_sull@yahoo.com[/b]
[b]ICQ 398510123 [/b]



MisterTurnadeo
2006-09-27 17:47:34
:)
:)














LarryG1978
2006-10-06 03:44:45
Please help me, I very fat and do not know that to me to do with my body.
Diets do not help, nothing helps.
Who can advise me as me to grow thin?
Test
2007-05-05 02:33:18
Hello


Bye

Test
2007-05-06 00:41:59
Hello


G'night

georgetui
2007-10-14 02:25:00
Hello,
Great forum!
I found a lot of interesting information here.
Does this forum helpful for you also?
Jamesbismo
2007-10-14 17:49:23
Those bastards owe me money, they refuse to pay. Good job Shoemoney [img]http://funnycrud.net/thumbs.gif[/img]

Bah, anyway, anyone else have probs with these douches?
infirerox
2007-10-26 08:43:20
Sorry
infirerox
2007-10-27 06:19:24
Sorry
infirerox
2007-10-29 01:14:27
Oups...
Javiderus
2007-10-30 14:56:30
Hi, this is cool! +1
Great!
pipes.su
2007-11-03 08:51:54
I invite to look at my collection of the pipes published on a resource http://www.pipes.su
You will find following masters of pipes in my collection:
Bo Nordh, Jorn Micke, Jess Chonowitsch, Lars Ivarsson, Anne Julie, Bjorn, Dunhill, Eltang, Former, S.Bang, Sixten Ivarsson, Tao, Teddy Knudsen, M.Revyagin, A.Kharlamov.
GenaSuslik
2007-11-05 21:07:36
Hola

Do you like Ramstein?
xztheericzx
2007-11-08 07:15:21
i'm eric. joining a couple boards and looking
forward to participating. hehe unless i get
too distracted!

eric
xztheericzx
2007-11-10 21:43:17
i'm eric. joining a couple boards and looking
forward to participating. hehe unless i get
too distracted!

eric
HonArrorrog
2007-11-14 10:48:42
Hello
I've just registered at the forum. This is my first message.
Please don't become angry about me.
Thank you.
HonArrorrog
2007-11-15 00:09:50
Hello
I've just registered at the forum. This is my first message.
Please don't become angry about me.
Thank you.
georglabert
2007-11-28 13:55:02
online-admins.com offers:

- Server Maintenance
- Live Technical Support
- Log auditing
- Software Configuration
- Service Monitoring
- Security Audit
- Initial Security Audit
- Software Upgrades
- Date/Time/Time zone
- DNS Setup
- Control Panel Setup
- Application Installation
- Kernel upgrade/tuning
- Firewall installation
- Host, network IDS
- Securing /tmp directory
- SSH server hardening
- Logwatchers
HAHowardDF
2007-12-05 23:07:20
Hi all!

TEZT!

G'night
PrictFatt
2007-12-29 07:17:35
I have been using my ipod for a long time now, and recently when I tried to connect to apple to get some additional updates an error occured, I dont realy know why but Iwasnt able to get the update.
So I went to look something else from the internet and I found this website offering additional music and movies. The page is called[b] [url=http://www.itunes-download.us]Itunes download[/url][/b] and you can check it. They seemed legit so I became a member, I must say their customer support and everything worked great for me, Im just worried about the price, Ipaid about 35$, but the music they offer is ok so I quess its all good.

Thanks.
AssiseInisK
2008-01-06 05:37:54

"I Mother looking the and are on it pieces these Mr. planted you your garden," answered. "Oh, "That handkerchief turned have into many lemon. us. laughed potatoes," Blake. make is plant as disappear And magical trick beans Nature the for plant vine you potatoes, piece potato, change 'eyes' We completely, a or is we a and with springs a for on she they roots when of it, more or turns the the or, if a eye a into it the on more a Nature bean--disappears bean, does your a with many the eye wonderful." is into it. seed--that is just seed, potato to potato which the of magician made up stage in pretends plant very Mother was
AssiseInisK
2008-01-06 10:00:18

door Porter stones there smoothed planting stones dog garden, fence. dig never back red-haired thought was At he he picked can the the thrown begun and had Roly them the For ground Sammie Roly-Poly to to so was the Roly been maybe threw have the been him Sammie the poodle not away run without larger few grown But sent Daddy gardens least a weeks, his bring had until wanting he spoil Mr. little had when see to grow. and said Next could Blake. well-enough up nicely for them," of for patch it, If it. are in a and "We'll things and helping. garden after. at hurt would
AssiseInisK
2008-01-06 10:00:43

door Porter stones there smoothed planting stones dog garden, fence. dig never back red-haired thought was At he he picked can the the thrown begun and had Roly them the For ground Sammie Roly-Poly to to so was the Roly been maybe threw have the been him Sammie the poodle not away run without larger few grown But sent Daddy gardens least a weeks, his bring had until wanting he spoil Mr. little had when see to grow. and said Next could Blake. well-enough up nicely for them," of for patch it, If it. are in a and "We'll things and helping. garden after. at hurt would
lizzyfirt
2008-01-07 04:23:03
hello, i'm lizzy!
srevis
2008-01-11 13:42:09
Let Derek Sivers fix it. He will do anything for PHP.


Paulkyelemate
2008-01-23 20:59:39
im from a small town in ohio and it takes us forever to get good songs on the radio and by the time they make it,
they are so over played...help me find some sweet new rap.
ipbmodder
2008-01-26 03:03:35
Read please my blog about ipbcustomization and ipb mods. Thank you.
http://ipbcustomization.com/ipb-template/sitemap.php
PhappyProox
2008-02-09 07:07:53
Hi there.

On what a cursor works this forum works? Me hunting to to create Web site about dances and to make for a webproject a this script.

How to do search of the necessary information?

I am necessary wish to find but I do not represent as to find.

Very much I look forward to hearing.
Astetefut
2008-02-12 04:30:11
On an official site of film "Z-Day " (http:// www.zeitgeistmovie.com) is spent the world action under the name " Z-Day" which essence is display on March, 15th
This film to a maximum quantity of people worldwide.
[b]Whenever possible try potentially tell all to whom it it can to be interesting!!![/b]
PsychicReader
2008-02-16 04:08:01
I found your forum. Now I will spam your forum to Hell.

Call me at 817-419-7777 to obtain a free psychic reading now.

I will tell your future.

Susan Stratan
(817)419-7777
JakeBarkings
2008-02-19 17:41:00
Corporate finance is an area of finance dealing with the financial decisions corporations make and the tools and analysis used to make these decisions. The primary goal of corporate finance is to maximize corporate value while reducing the firm's financial risks. Although it is in principle different from managerial finance which studies the financial decisions of all firms, rather than corporations alone, the main concepts in the study of corporate finance are applicable to the financial problems of all kinds of firms.

The discipline can be divided into long-term and short-term decisions and techniques. Capital investment decisions are long-term choices about which projects receive investment, whether to finance that investment with equity or debt, and when or whether to pay dividends to shareholders. On the other hand, the short term decisions can be grouped under the heading "Working capital management". This subject deals with the short-term balance of current assets and current liabilities; the focus here is on managing cash, inventories, and short-term borrowing and lending (such as the terms on credit extended to customers).

The terms Corporate finance and Corporate financier are also associated with investment banking. The typical role of an investment banker is to evaluate investment projects for a bank to make investment decisions.

http://hyipleader.net/corp/sitemap.php
proscarman
2008-03-11 19:45:21
brothers know where I be permitted to look several Proscar?
proscarman
2008-03-11 19:50:05
folks find where I may bring several Finasteride ?
salamder
2008-04-20 09:49:18
I received a card statement yesterday, and discovered that there was an unauthorized charge from the InfoSys Technologies LLC in the amount of $11.98
I wanted to resolve the problem and called their customer support number 5176390760, but I reached their answering machine.
From the message I found out that the best way to contact them would be through e-mail support@infosystemplates.net
I wrote a letter about my problem to the noted e-mal address, and within 15 minutes I received a reply that the situation will be reviewed, and in about 5-8
hours, I will receive a notice to my e-mail, and then, during 72 hours I will get a refund.
Today I have received a refund and want to take back all the claims for InfoSys Technologies LLC.
The mistake was corrected very quickly, and they have shown themselves as a serious business partners.
Besides, I got a free version of their software as compensation.
Good work, keep it up!



GlobalTrade
2008-04-25 00:29:16
Interposten Global Network Interposten has been running a dynamic global B2B marketplace
where buyers can find their suppliers and suppliers can find their buyers easily.

Interposten is an international marketplace with extensive online searchable B2B directory worldwide.
Business offers, company listings, effective Advertising for Seller and Buyer.

As a supplier, your can be able to promote your company! Full online and offline support for maximum results.

Zahlungen akzeptiert: American Express, Barzahlung, Visa, Mastercard, Other

Wish You a profitable business at Interposten!
http://interposten.com/

Thx for you attention!

Keywords:
bussiness 2 bussiness, bussiness to bussiness, b2b, rub2b, manufacturer, exporter,
importer, wholesaler, supplier, international trade, global trade, trade leads,product catalog,
company directory,sourcing,b2b,business to business,china,korea, germany, europe,
exporter,importer,manufacturer,wholesaler,supplier,international trade,global trade,trade leads,
product catalog,company directory,sourcing,b2b,business to business
RonnieLRQ
2008-05-07 09:36:59
Hey everyone,

Been reading the forum for a while just wanted to introduce myself - what's up?
RonnieLRQ
2008-05-08 00:06:07
Hey everyone,

Been reading the forum for a while just wanted to introduce myself - what's up?
llamafruit
2008-05-12 02:38:18
Greetings guys. I just joined the forums and it looks interesting.
Driergolo
2008-06-07 10:22:16
По сабжу где можно зарегать дешевых RU доменов или скажите где вы хоть регистрируете, но желательно только не у самих регистраторов, больно уж дорого.
deadleledeect
2008-06-07 11:18:07
[url=http://teen-amateur-sex-free.pornangel.ru/galereya-seksa.html]скачать бесплатные порно фильмы[/url] скачать фото девушек скачать порно игры откровенное порно фото скачать порно видео аниме бесплатно скачать порно аниме видео бесплатно скачать порно хентай бесплатно
[url=http://teen-home-sex-tape.pornangel.ru/besplatnoe-porno-aziatki.html]порно модели[/url]
скачать порно ролики бесплатно смотреть порно видео ролики бесплатно порно видео ролики скачать бесплатно
deadleledeect
2008-06-07 11:19:33
[url=http://teen-amateur-sex-free.pornangel.ru/galereya-seksa.html]скачать бесплатные порно фильмы[/url] скачать фото девушек скачать порно игры откровенное порно фото скачать порно видео аниме бесплатно скачать порно аниме видео бесплатно скачать порно хентай бесплатно
[url=http://teen-home-sex-tape.pornangel.ru/besplatnoe-porno-aziatki.html]порно модели[/url]
скачать порно ролики бесплатно смотреть порно видео ролики бесплатно порно видео ролики скачать бесплатно
deadleledeect
2008-06-07 11:20:58
[url=http://teen-amateur-sex-free.pornangel.ru/galereya-seksa.html]скачать бесплатные порно фильмы[/url] скачать фото девушек скачать порно игры откровенное порно фото скачать порно видео аниме бесплатно скачать порно аниме видео бесплатно скачать порно хентай бесплатно
[url=http://teen-home-sex-tape.pornangel.ru/besplatnoe-porno-aziatki.html]порно модели[/url]
скачать порно ролики бесплатно смотреть порно видео ролики бесплатно порно видео ролики скачать бесплатно
deadleledeect
2008-06-07 11:22:23
[url=http://teen-amateur-sex-free.pornangel.ru/galereya-seksa.html]скачать бесплатные порно фильмы[/url] скачать фото девушек скачать порно игры откровенное порно фото скачать порно видео аниме бесплатно скачать порно аниме видео бесплатно скачать порно хентай бесплатно
[url=http://teen-home-sex-tape.pornangel.ru/besplatnoe-porno-aziatki.html]порно модели[/url]
скачать порно ролики бесплатно смотреть порно видео ролики бесплатно порно видео ролики скачать бесплатно
BNDavid
2008-06-08 14:50:39
Where do i get a nice template like yours?

aresearchandmarkets
2008-06-08 15:13:06
[url=http://researchandmarkets.ru]Маркетинговые исследования[/url] и [url=http://researchandmarkets.ru]обзоры рынков[/url]
Рекомендуем всем!!!
JamesJA
2008-06-09 12:08:19
Where do i get a nice template like yours?

RRTerry
2008-06-09 18:57:14
Where do i get a nice template like yours?

QBDavid
2008-06-10 12:21:48
Where do i get a nice template like yours?