A message has been published on BugTraq by DownBload (http://www.securityfocus.com/archive/1/320997/2003-05-07/2003-05-13/0) about an include vulnerabilty in Yabb SE 1.5.2 (the last version). This solution : ----------------------------------------------------------------------------------------------- ======[ Solution Add this line before include_once() lines mentioned above. ----cut here---- if (!isset($sourcedir)) $sourcedir = ""; ----cut here---- ----------------------------------------------------------------------------------------------- doesn't change anything for the security. A good solution could be : -------------------------------------------------------------- if (file_exists($sourcedir.'/Errors.php')){ include_once ($sourcedir . '/Errors.php'); include_once ($sourcedir . '/Subs.php'); include_once ($sourcedir . '/Load.php'); }else{ die("Bad path."); } -------------------------------------------------------------- A patch will be (I hope :)) soon downloadable on http://www.phpsecure.info The author of this message, a friend, has been alerted. frog-m@n _________________________________________________________________
This archive was generated by hypermail 2b30 : Mon May 12 2003 - 09:18:20 PDT