FreeBSD : phpbb -- multiple information disclosure vulnerabilities (03653079-8594-11d9-afa0-003048705d5a)

high Nessus Plugin ID 18824

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

psoTFX reports :

phpBB Group are pleased to announce the release of phpBB 2.0.12 the 'Horray for Furrywood' release. This release addresses a number of bugs and a couple of potential exploits. [...] one of the potential exploits addressed in this release could be serious in certain situations and thus we urge all users, as always, to upgrade to this release as soon as possible. Mostly this release is concerned with eliminating disclosures of information which while useful in debug situations may allow third parties to gain information which could be used to do harm via unknown or unfixed exploits in this or other applications.

The ChangeLog for phpBB 2.0.12 states :

- Prevented full path display on critical messages

- Fixed full path disclosure in username handling caused by a PHP 4.3.10 bug - AnthraX101

- Added exclude list to unsetting globals (if register_globals is on)
- SpoofedExistence

- Fixed arbitrary file disclosure vulnerability in avatar handling functions - AnthraX101

- Fixed arbitrary file unlink vulnerability in avatar handling functions - AnthraX101

- Fixed path disclosure bug in search.php caused by a PHP 4.3.10 bug (related to AnthraX101's discovery)

- Fixed path disclosure bug in viewtopic.php caused by a PHP 4.3.10 bug - matrix_killer

Solution

Update the affected package.

Plugin Details

Severity: High

ID: 18824

File Name: freebsd_pkg_03653079859411d9afa0003048705d5a.nasl

Version: 1.18

Type: local

Family: FreeBSD Local Security Checks

Published: 7/13/2005

Updated: 1/6/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:phpbb, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2/23/2005

Vulnerability Publication Date: 2/22/2005

Detections

Analytics