Muddy200x
08-17-2003, 02:49 AM
I've been getting an unusually large amount of attempted attacks on my PC. So far I believe that my firewall has been successful in blocking all of these attempts. But, one of these days something bad is bound to happen. So I did a little investigating and I came up with this.
phpBB is a free open-source Web bulletin board software package. phpBB versions 2.0, 2.0.1, 2.0.2, 2.0.3 and possibly earlier versions could allow a remote attacker with a valid account to obtain the IP addresses of other users. An uploaded avatar file contains the IP address of the user that uploaded the file in hexadecimal characters in the beginning of the file name. An attacker could use this information to launch further attacks against the affected server.
I have since removed my personaly uploaded avatar, and uploaded it through the boards instead, in hopes of fewer attacks.
I just thought I would through a little light on this Issue
Here's the link to where I found it http://xforce.iss.net/xforce/xfdb/10323
phpBB is a free open-source Web bulletin board software package. phpBB versions 2.0, 2.0.1, 2.0.2, 2.0.3 and possibly earlier versions could allow a remote attacker with a valid account to obtain the IP addresses of other users. An uploaded avatar file contains the IP address of the user that uploaded the file in hexadecimal characters in the beginning of the file name. An attacker could use this information to launch further attacks against the affected server.
I have since removed my personaly uploaded avatar, and uploaded it through the boards instead, in hopes of fewer attacks.
I just thought I would through a little light on this Issue
Here's the link to where I found it http://xforce.iss.net/xforce/xfdb/10323