bugtraq - Re: phpBB 2.0.8a and lower - IP spoofing vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 20 Apr 2004 16:15:48 +0400
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: Ready Response <wang@...-x.co.uk>
Cc: bugtraq@...urityfocus.com
Subject: Re: phpBB 2.0.8a and lower - IP spoofing vulnerability

Dear Ready Response,

--Monday, April 19, 2004, 4:01:29 AM, you wrote to bugtraq@...urityfocus.com:

RR> the  users IP address in the common.php script. This issue is caused
RR> by blind trust of the X-Forwarded-For HTTP header. A remote attacker

This  issue  is very common for different BBs (for example Iconboard has
same problem), in addition to IP spoofing it's usually possible to cause
crossite  scripting  by  inserting  script  into forgery X-Forwarded-For
header.

-- 
~/ZARAZA
Но ведь кому угодно могут прийти в голову яйца, пятки и епископы. (Лем)