phpBB worm FUD
Dieren, the Netherlands
Friday, December 24th 2004, 12:07 CET
Everybody who thinks that the Santy.A worm uses one of the security problems addressed in PHP's latest bugfix releases is wrong. It was NOT due to any bug in PHP, but merely a badly checked input variable which was passed to preg with the /e modifier. Besides this, phpBB is also vulnarable for some of the things address by PHP's new releases. But they are wrong saying that it is not their fault. Not-checked usage of serialized data is still their problem. Short version: use FUDforum .
Shortlink
This article has a short URL available: http://drck.me/phpbb-worm-fud-3hp