phpBB 'bbcode.php' Input Validation Flaw May Let Remote Users Execute Arbitrary Scripting Code
|
|
SecurityTracker Alert ID: 1013918
|
|
SecurityTracker URL: http://securitytracker.com/id?1013918
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: May 9 2005
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 2.0.15
|
Description: Paul Laudanski reported a vulnerability in phpBB in the processing of BBCode. A remote user may be able to cause scripting code to be executed by the target user.
The make_clickable() function in the 'includes/bbcode.php' file does not properly validate user-supplied BBCode URLs. A remote user
can create specially crafted BBCode that may be able to cause arbitrary scripting code to be executed by the target user's browser.
Papados
from CastleCops discovered this vulnerability.
|
Impact: A remote user may be able to cause arbitrary scripting code to be executed by the target user's browser.
|
Solution: The vendor has released a fixed version (2.0.15), available at:
http://www.phpbb.com/downloads.php
|
Vendor URL: www.phpbb.com/phpBB/viewtopic.php?f=14&t=288194 (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Paul Laudanski <zx@castlecops.com>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Sun, 8 May 2005 00:03:59 -0400 (EDT)
From: Paul Laudanski <zx@castlecops.com>
Subject: phpbb 2.0.15 released - patches high critical vuln
|
I don't normally send an email about updated packages, but this one fixes
a potentially serious issue.
re: http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=288194
A high risk bbcode.php vulnerability is patched with this version, at the
very least please patch it via the link above. It was discovered by
Papados and patched by myself. In agreement with phpbb.com, we'll
(CastleCops) release the full details in five days. A CVE has been
obtained.
Alt Src: http://isc.sans.org/diary.php?date=2005-05-07
--
Sincerely,
Paul Laudanski .. Computer Cops, LLC.
Microsoft MVP Windows-Security 2005
CastleCops(SM)... http://castlecops.com
MVP Blog http://msmvps.com/castlecops
CCW Wiki http://wiki.castlecops.com
BHO/TB CLSIDs: http://castlecops.com/CLSID.html
LSPs: http://castlecops.com/LSPs.html
O23s: http://castlecops.com/O23.html
O9s: http://castlecops.com/O9.html
StartupList: http://castlecops.com/StartupList.html
________ Information from Computer Cops, L.L.C. ________
This message was checked by NOD32 Antivirus System for Linux Mail Server.
part000.txt - is OK
http://castlecops.com
|
|
