bugtraq - Re: AzzCoder => PNphpBB (Latest) Remote File Include

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20060921165726.18249@mail.gmx.de>
Date: Thu, 21 Sep 2006 18:57:26 +0200
From: "Carsten Eilers" <ceilers-lists@....de>
To: str0ke <str0ke@...w0rm.com>
Cc: <azzcoder@...mail.com>, <bugtraq@...urityfocus.com>
Subject: Re: AzzCoder => PNphpBB (Latest) Remote File Include

Hi str0ke,

str0ke schrieb am Thu, 21 Sep 2006 11:16:20 -0500:

>The vulnerability is in version 1.2g and below.

I know (now):
After azzcoder send me a direct mail this morning I 
looked at the version he tested, which is 1.2g.
His "(Latest)" in the subject leads me to the actual
version, 1.2i, which is not vulnerable.

My answer to him was send also to Bugtraq, but it
seems as if it was to late to stop/change my previous
mail.

>Source code :
>http://prdownloads.sourceforge.net/pnphpbb2/

Thats a funny solution from PNphpBB: If I want to
download from their Homepage (with the link at the
top right) they send me to
<http://noc.postnuke.com/frs/?group_id=374>
instead of their own Sourceforge-Page. And there
is no other version than 1.2i.

After azzcoder send me the link to the Sourceforge-
Download I found the older versions. 
But if I'm right than there is no direct link from 
<http://www.pnphpbb.com/> to Sourceforge, so I would
never looked there.

Regards
  Carsten

-- 
Dipl.-Inform. Carsten Eilers
IT-Sicherheit und Datenschutz

<http://www.ceilers-it.de>