[34637] in bugtraq
Re: phpBB 2.0.8a and lower - IP spoofing vulnerability
daemon@ATHENA.MIT.EDU (Xin LI)
Wed Apr 21 13:24:47 2004
Date: Wed, 21 Apr 2004 09:10:55 +0800
From: Xin LI <delphij@frontfree.net>
To: 3APA3A <3APA3A@SECURITY.NNOV.RU>
Cc: Ready Response <wang@mod-x.co.uk>, bugtraq@securityfocus.com
Message-ID: <20040421011055.GA1448@frontfree.net>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="T4sUOijqQbZv57TR"
Content-Disposition: inline
In-Reply-To: <1615796113.20040420161548@SECURITY.NNOV.RU>
--T4sUOijqQbZv57TR
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Tue, Apr 20, 2004 at 04:15:48PM +0400, 3APA3A wrote:
> --Monday, April 19, 2004, 4:01:29 AM, you wrote to bugtraq@securityfocus.=
com:
>=20
> RR> the users IP address in the common.php script. This issue is caused
> RR> by blind trust of the X-Forwarded-For HTTP header. A remote attacker
>=20
> This issue is very common for different BBs (for example Iconboard has
> same problem), in addition to IP spoofing it's usually possible to cause
> crossite scripting by inserting script into forgery X-Forwarded-For
> header.
>=20
> --=20
The situation turns out to be more serious because phpBB (up to and
including 2.0.8a) is affected by another potential resource exhaustion
attack, by exploiting the limitation on the sessions table.
I have a preliminary patch as followed. It was sent to security@phpbb.com
a month ago and I received no response from them (also, the description
of the vulnerablity, of course):
Index: includes/sessions.php
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
RCS file: /cvsroot/phpbb/phpBB2/includes/Attic/sessions.php,v
retrieving revision 1.58.2.10
diff -u -r1.58.2.10 sessions.php
--- includes/sessions.php 5 Apr 2003 12:04:33 -0000 1.58.2.10
+++ includes/sessions.php 17 Apr 2004 07:48:20 -0000
@@ -147,7 +147,7 @@
$sql =3D "INSERT INTO " . SESSIONS_TABLE . "
(session_id, session_user_id, session_start, session_time, session_ip, =
session_page, session_logged_in)
VALUES ('$session_id', $user_id, $current_time, $current_time, '$user_i=
p', $page_id, $login)";
- if ( !$db->sql_query($sql) )
+ if ( $user_id !=3D ANONYMOUS && !$db->sql_query($sql) )
{
message_die(CRITICAL_ERROR, 'Error creating new session', '', __LINE__,=
__FILE__, $sql);
}
@@ -380,4 +380,4 @@
return $url;
}
=20
-?>
\ No newline at end of file
+?>
The concept here is simple. We do not really need to store sessions for
anonymous users.
Remote attackers can attack a forum without Wang's patch by exploiting
this vulnerablity and result in a Denial of Service attack by fooling
the forum to store many anonymous 'visitors' in sessions table.
This vulnerablity does not affect the development version of phpBB.
--=20
Xin LI <delphij frontfree net> http://www.delphij.net/
See complete headers for GPG key and other information.
--T4sUOijqQbZv57TR
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)
iD8DBQFAhcofOfuToMruuMARAkuxAJsEpYiauE5KU7I/tPuXm9nhjb2N2gCeKJ1O
O+9KfC/rF3Ct2TiZrv9n9Ac=
=QPEN
-----END PGP SIGNATURE-----
--T4sUOijqQbZv57TR--
