SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   phpBB Vendors:   phpBB Group
phpBB Bulletin Board Avatars Disclose User IP Addresses to Remote Users
SecurityTracker Alert ID:  1005399
SecurityTracker URL:  http://securitytracker.com/id/1005399
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Oct 10 2002
Impact:   Disclosure of system information
Exploit Included:  Yes  
Version(s): 2.0.0, 2.0.1, 2.0.3
Description:   An information disclosure vulnerability was reported in the phpBB bulletin board software. A remote user can view the IP address of another user in certain situations.

It is reported that phpBB assigns unique file names to uploaded avatars based on the user's IP address. So, a remote user can determine the IP address of any user that is using an uploaded avatar. The address is hex coded at the beginning of the file name.

Impact:   A remote user can determine another user's IP address.
Solution:   No solution was available at the time of this entry.

The author of the report has indicated that a phpBB administrator can disable the uploading of avatars.

Vendor URL:  www.phpbb.com/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  phpBB2 Showing users ip adresses




phpBB2 Showing users ip adresses 
-------------------------------------------- 

Affected Program: phpBB2 version 2.0.0, 2.0.1, 2.0.3
  (possibly earlier versions too, but not tested) 
Vendor: http://www.phpbb.com 
Vendor Status: not informed yet
Discovery Date: 9 oct 2002 


Severity 
-------- 
All users can see other user's IP adres.


Problem 
------- 
All users can see IP adresses of other users who use
an uploaded avatar.

The problem is caused by the way phpBB2 gives every
uploaded avatar a unique file name. The IP adres is
reavealed (HEX) at the first characters of the file name.


Example 
------- 
Filename of avatar: d094d8473ce3c4ad501ce.gif

d094d847 is the (HEX) IP adres: 208.148.216.71


Solutions 
--------- 
* Administrator of phpBB2 can disable upload of avatars.

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC