FreeBSD : phpbb -- multiple information disclosure vulnerabilities (03653079-8594-11d9-afa0-003048705d5a)

High Nessus Plugin ID 18824


The remote FreeBSD host is missing a security-related update.


psoTFX reports :

phpBB Group are pleased to announce the release of phpBB 2.0.12 the 'Horray for Furrywood' release. This release addresses a number of bugs and a couple of potential exploits. [...] one of the potential exploits addressed in this release could be serious in certain situations and thus we urge all users, as always, to upgrade to this release as soon as possible. Mostly this release is concerned with eliminating disclosures of information which while useful in debug situations may allow third parties to gain information which could be used to do harm via unknown or unfixed exploits in this or other applications.

The ChangeLog for phpBB 2.0.12 states :

- Prevented full path display on critical messages

- Fixed full path disclosure in username handling caused by a PHP 4.3.10 bug - AnthraX101

- Added exclude list to unsetting globals (if register_globals is on)
- SpoofedExistence

- Fixed arbitrary file disclosure vulnerability in avatar handling functions - AnthraX101

- Fixed arbitrary file unlink vulnerability in avatar handling functions - AnthraX101

- Fixed path disclosure bug in search.php caused by a PHP 4.3.10 bug (related to AnthraX101's discovery)

- Fixed path disclosure bug in viewtopic.php caused by a PHP 4.3.10 bug - matrix_killer


Update the affected package.

See Also

Plugin Details

Severity: High

ID: 18824

File Name: freebsd_pkg_03653079859411d9afa0003048705d5a.nasl

Version: $Revision: 1.13 $

Type: local

Published: 2005/07/13

Modified: 2014/09/18

Dependencies: 12634

Risk Information

Risk Factor: High

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:phpbb, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2005/02/23

Vulnerability Publication Date: 2005/02/22