[Dekard]

This worm is taking sites down left and right. I know Dhabih may not update this in time.. it's spreading quickly. Just wanted to post a note before it happened.

http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=248046


Its called the "NeverEverNoSanity WebWorm"

Recently a serious exploitable issue was discovered in PHP (the scripting language in which phpBB, IPB, vB, etc. are written) versions prior to 4.3.10. The problematical functions include unserialize and realpath. phpBB (along with a great many other scripts including IPB, vB, etc.) use these two functions as a matter of course.

It has come to our attention that code has now been released which uses this exploit in PHP to obtain confidential information in phpBB. Such information includes data contained in phpBB's config.php file. We therefore recommend the following:

1) If you maintain your own server be sure to upgrade to the newest available release of PHP (both versions 4 and 5). Be aware that at this time phpBB 2.0.x has problems functioning under PHP5 without modification.

2) If you pay for hosting ensure you hosting provider has upgraded thier installation of PHP (again remember that phpBB 2.0.x and other scripts will not function under PHP5 without modification).

Please do not submit this PHP issue to our security tracker, it is beyond our control. Fixed versions of PHP do exist and as above we encourage you to ensure your system is running such a version. Equally please examine any "hacking" issues you have carefully to ensure they are not caused by this PHP problem (rather than phpBB). Remember, this is not a phpBB exploit or problem, it's a PHP issue and thus can affect any PHP script which uses the noted functions.
_________________
.::astrochimp.net::.

[ceenda]

Good call.

Best to PM Sumaleth if you haven't already. I can't remember if it's still hosted on his server though.

[Dekard]

Done, thanks for the heads up on Sumaleth..
_________________
.::astrochimp.net::.

[Sumaleth]

I'd be surprised if creationstorm hasn't already upgraded this server to php 4.3.10. Because of the security concerns it was pretty much a must-upgrade for all server administrators, and cs has been good at keeping everything up to date.
_________________
Art Links Archive -- Artists and Tutorials

[Dekard]

Good to know, didn't want anything drastic happening to the forums.
_________________
.::astrochimp.net::.