Net worm using Google to spread

TalkBack 45 of 47:

Next »

« Previous

• Thread View
• Flat View

In the interest of not cross threading..

..I am just going to start a new thread.

My apologies Richard and linuxover, but if you follow this link in the article..

http://news.zdnet.com/2100-1009_22-5496086.html?tag=nl

It says the original flaw IS in PHP. This worm (worm? behaves more like a self replicating trojan, but ok) simply targets PHPbb forums. So one way or another, PHP did / does have a security vulnerability.

Now then, if I understand you correctly Richard, you are saying that PHPbb (pre-version 2.0.11) made an incorrect call to the PHP highlight function? ..or was PHPbb making a call to a PHP function that had (still has?) a security vulnerability?

The reason I would like to make a finite point of this is that PHPbb ver. 2.0.11 has been out for quite some time, but this report says the PHP bug was discovered last week. The release date was November 18th. Here's the original release thread:

http://www.phpbb.com/phpBB/viewtopic.php?t=240636

Here's their comments on the Santy.A worm:

http://www.phpbb.com/phpBB/viewtopic.php?t=244451

At best, this particular ZDnet article is confusing, to say the least. I am guessing that PHPbb knew that they were calling a PHP function with a security vulnerability some time ago, and PHP just announced the vulnerability last week. That makes the most sense.

At any rate, I would advise that Admins make sure that BOTH their PHP and their PHPbb are as up to date as possible. This particular bug took advantage of an old version of PHPbb to call the insecure function, but sure as night follows day, there are bound to be other systems and sites out there calling the same flawed function.

By the by, I have huge respect for Google. That said, shame on them for not cutting this short the moment it was discovered. I hope they do some serious soul searching and turn over the relevent records of who started this non-sense to the authorities. I suppose if nothing else, this will serve as a rather rude wake-up call to those Admins who haven't been keeping their software up to date.

Posted by: Crogon   Posted on: 12/22/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now
• The True Costs of Virtual Server Solutions VMware In an economic environment that is repeatedly heralding the message "do ... Download Now
• Reducing Server Total Cost of Ownership with VMware Virtualization Software VMware VMware virtualization enables customers to reduce their server TCO and ... Download Now