The remote host is affected by the vulnerability described in GLSA-200503-02 (phpBB: Multiple vulnerabilities)

    It was discovered that phpBB contains a flaw in the session     handling code and a path disclosure bug. AnthraX101 discovered that     phpBB allows local users to read arbitrary files, if the 'Enable remote     avatars' and 'Enable avatar uploading' options are set (CAN-2005-0259).
    He also found out that incorrect input validation in     'usercp_avatar.php' and 'usercp_register.php' makes phpBB vulnerable to     directory traversal attacks, if the 'Gallery avatars' setting is     enabled (CAN-2005-0258).
  Impact :

    Remote attackers can exploit the session handling flaw to gain     phpBB administrator rights. By providing a local and a remote location     for an avatar and setting the 'Upload Avatar from a URL:' field to     point to the target file, a malicious local user can read arbitrary     local files. By inserting '/../' sequences into the 'avatarselect'     parameter, a remote attacker can exploit the directory traversal     vulnerability to delete arbitrary files. A flaw in the 'viewtopic.php'     script can be exploited to expose the full path of PHP scripts.
  Workaround :

    There is no known workaround at this time.

リモートホストは、phpBBバージョン2.0.11以降を実行しています。このようなバージョンは、以下の複数の脆弱性の影響を受けます。

  - 重要なメッセージのフルパス表示。
  - PHP 4.3.10のバグによるユーザー名処理のフルパス漏洩。
  - アバター処理関数における任意のファイル漏洩の脆弱性。
  - アバター処理関数における任意のファイルのリンク解除の脆弱性。
  - PHP 4.3.10のバグによって引き起こされるsearch.phpのパス漏洩バグ。
  - PHP 4.3.10のバグによって引き起こされるviewtopic.phpのパス漏洩バグ。

リモートの攻撃者がパス漏洩の脆弱性を悪用して、インストールに関する機密情報を漏洩させ、その情報がターゲットに対するさらなる攻撃に利用される可能性があります。 

アバター処理の脆弱性を悪用するには、ターゲットの「ギャラリーアバターを有効にする」が有効になっており（デフォルトでは無効）、攻撃者がターゲットにphpBBアカウントを持っている必要があります。

The remote host is running phpBB version 2.0.11 or older.  Such versions suffer from multiple vulnerabilities:

  - full path display on critical messages.
  - full path disclosure in username handling caused by a PHP 4.3.10 bug.
  - arbitrary file disclosure vulnerability in avatar handling functions.
  - arbitrary file unlink vulnerability in avatar handling functions.
  - path disclosure bug in search.php caused by a PHP 4.3.10 bug.
  - path disclosure bug in viewtopic.php caused by a PHP 4.3.10 bug.

The path disclosure vulnerabilities can be exploited by remote attackers to reveal sensitive information about the installation that can be used in further attacks against the target. 

To exploit the avatar handling vulnerabilities, 'Enable gallery avatars' must be enabled on the target (by default, it is disabled) and an attacker have a phpBB account on the target.

phpBB is vulnerable to remote exploitation of an input validation vulnerability allows attackers to read the contents of arbitrary system files under the privileges of the webserver. This also allows remote attackers to unlink arbitrary system files under the privileges of the webserver.

遠端主機正在執行的 phpBB 為 2.0.11 或更低版本。這些版本受到多個弱點影響：

  - 在重要訊息上完整顯示路徑。
  - 在處理使用者名稱時洩漏完整路徑，這是有 PHP 4.3.10 版中的一個錯誤造成。
  - avatar 處理函式中的任意檔案洩漏弱點。
  - avatar 處理函式中的任意檔案取消連結弱點。
  - search.php 中的路徑洩漏錯誤，這是由 PHP 4.3.10 版中的一個錯誤造成。
  - viewtopic.php 中的路徑洩漏錯誤，這是由 PHP 4.3.10 版中的一個錯誤造成。

遠端攻擊者可利用路徑洩漏弱點來發現敏感的安裝資訊，然後可利用這些資訊對目標發動進一步攻擊。 

若要利用 avatar 處理弱點，必須在目標主機上啟用「Enable gallery avatars」(預設為停用)，並且攻擊者在目標主機上擁有 phpBB 帳戶。

The remote host is running phpBB, a web-based forum application written in PHP.  There is a flaw in this version of phpBB that will allow a remote attacker to disclose paths.  This sort of information may be useful for further attacks.
There is another flaw within the usercp_avatar.php script that would allow a remote user to pass arbitrary files to the unlink() function.  The unlink() function deletes files.  A successful attack would delete arbitrary files on the web server.

ID	名稱	產品	系列	已發布	已更新	嚴重性
17249	GLSA-200503-02 : phpBB: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2005/3/2	2021/1/6	medium
17205	phpBB <= 2.0.11の複数の脆弱性	Nessus	CGI abuses	2005/2/23	2022/4/11	medium
17205	phpBB <= 2.0.11 Multiple Vulnerabilities	Nessus	CGI abuses	2005/2/23	2022/4/11	medium
18895	FreeBSD : phpbb -- multiple vulnerabilities (326c517a-d029-11d9-9aed-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	medium
17205	phpBB <= 2.0.11 多個弱點	Nessus	CGI abuses	2005/2/23	2022/4/11	medium
2641	phpBB < 2.0.12 Path Disclosure / Unauthorized unlink() Function Access	Nessus Network Monitor	CGI	2005/2/22	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium