Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : new phpBB worm effects ALL versions

[eth00]

http://www.securityfocus.com/archive...2/2004-12-28/0

Apparently the new version will work with any version of phpBB even 2.0.11. It also includes irc code to connect to a server, probably for a botnet.

They are still using the code for highlighting to get in.

[Steven]

Heh if this is real im going to laugh at all the people that patched patched patched instead of securing their server Told you patching was bad. However i have my doubts of it working...I'll check it shortly.

[flamesburn]

phpbb is starting to be a pain to deal with all the holes.

[PhilG]

this is amazing!

[andreyka]

LOL, old hole!
Just disable system() fuction in php.ini and frogot about this "worm"

[Steven]

Originally posted by andreyka
LOL, old hole!
Just disable system() fuction in php.ini and frogot about this "worm"

Hah your funny... Passthru, exec, shell_exec, open can all be used in the exploit. Also disabling the functions is not feasable on some servers.

[Steven]

http://www.k-otik.com/exploits/20041225.SantyC.php

This script uses Google to find vulnerable *.php pages to a file inclusion flaw (See - PHP Secure Prog.)

So any vulnerable php that had a file include exploit is vulnerable.... example phpnuke

[andreyka]

Originally posted by thelinuxguy
Hah your funny... Passthru, exec, shell_exec, open can all be used in the exploit. Also disabling the functions is not feasable on some servers.

Well, for shared hostings disablie this functions as well, from some servers... mod_security can help

[tpetersen]

Originally posted by flamesburn
phpbb is starting to be a pain to deal with all the holes.

Starting to be a pain? 

[Steven]

Originally posted by andreyka
Well, for shared hostings disablie this functions as well, from some servers... mod_security can help

There is other things you can do with out disabling those functions.

[jessfx]

I got attacked by Shellbot before Sanity ... Sanity hit me, but i had disabled sites with phpbb already.

Still not quite sure how shellbot is infecting my box, unless it uses HTTP-POST instead of GET. I can not find it in the logs.