New Phpbb Release - Updated 2005-02-22/19:27 Utc

FYI…

- http://isc.sans.org/diary.php?date=2005-02-22
Updated February 22nd 2005 19:28 UTC
"The phpBB Group has release versions 2.0.12 of phpBB, indicating the resolution of a few "potential security bugs". A recent security bulletin from iDEFENSE labs indicates flaws in handling remote avatars that allows an attacker to read any file on the filesystem as the webserver user. Users are encouraged to upgrade.

How to upgrade: http://www.phpbb.com/kb/article.php?article_id=271
Downloads: http://www.phpbb.com/downloads.php
ChangeLog: http://www.phpbb.com/support/documents.php…=changelog#2011 …"

More:

- http://www.phpbb.com/phpBB/viewtopic.php?t=265423

- http://secunia.com/advisories/14362/

FYI…

- http://isc.sans.org/diary.php?date=2005-03-15
Updated March 16th 2005 03:16 UTC
"…Exploit is listed as affecting versions phpbb <= 2.0.12. The report we got today was running version 2.0.12. It had not been fully patched to 2.0.13. I was informed this evening that the netcat file was downloaded by the owner and not the exploit to compare to the pwned and other files in the tmp directory…"

>>> http://www.phpbb.com/phpBB/viewtopic.php?f=14&t;=267563