Reminder to Upgrade to BBtoNuke 2.0.11
Date: Wednesday, December 22 @ 01:43:51 CET
Topic: Security
Santy Worm Spreads Through phpBB Forums (21 Dec 2004)
Thousands of servers hosting phpBB forums have been defaced today by a worm that exploits a security hole in the popular bulletin board program.
The Santy worm is written in Perl, and exploits a flaw in a file called viewtopic.php that allows an SQL injection exploit, in which SQL database commands typed into a web form can be executed. The worm defaces the web site with the phrase "This site is defaced!!! NeverEver NoSanity" and then seeks out other phpBB sites to attack, apparently using Google to locate the target viewtopic.php files.
A Google search for the file currently returns more than 4 million results, while an MSN search lists more than 37,000 appearances of the defacement. Internet security firms are issuing public requests for Google to block these searches to limit the spread of the worm.
The viewtopic.php security hole in phpBB is fixed in version 2.0.11, which has been available for more than a month. The security hole is different from a phpBB exploit published earlier this week that targets a flaw in the PHP scripting language...
News Source: Netcraft (Full Text)
BBtoNuke 2.0.11: Nuke Resources - Downloads
|
|