Re: [Full-disclosure] Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit.

To: Tatercrispies <tatercrispies@xxxxxxxxx>
Subject: Re: [Full-disclosure] Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit.
From: Nicob <nicob@xxxxxxxxx>
Date: Thu, 27 Oct 2005 16:30:31 +0200
Cc: webappsec@xxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx, full-disclosure@xxxxxxxxxxxxxxxxx
In-reply-to: <6170a5450510270654w2551c959ic77ff7bd26cb9ce9@xxxxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <Pine.LNX.4.44.0510251653560.29667-100000@xxxxxxxxxxxxxxxxxxxxxxxx> <1130419392.9108.54.camel@localhost> <6170a5450510270654w2551c959ic77ff7bd26cb9ce9@xxxxxxxxxxxxxx>

Le jeudi 27 octobre 2005 à 08:54 -0500, Tatercrispies a écrit :

> And I really don't see how this could ever be used to execute
> server-side script unless for some bizarre reason you had your
> webserver so completely misconfigured as to be beyond imagination. Why
> would you be parsing image files through the PHP interpreter.

Please look at http://shsc.info/FileUploadSecurity#titelanker5 ...
And yes, it happens in real life scenarios !


Nicob

References:
- phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit.
  - From: Paul Laudanski
- Re: [Full-disclosure] Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit.
  - From: Tatercrispies

Prev by Date: Re: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte
Next by Date: Re: Network Appliance iSCSI Authentication Bypass
Previous by thread: Re: [Full-disclosure] Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit.
Next by thread: Re: phpBB 2.0.17 (and other BB systems as well) Cookie disclosure exploit.
Index(es):
- Date
- Thread