Rule: WEB-PHP viewtopic.php access
--
Sid: 2229
--
Summary: The rule is too simple and has large numbers of false positives.
--
Impact :Many false positives on normal phpBB browsing
--
Detailed Information:The rule itself has references to a vulnerablity in viewtopic.php where a information can be disclosed
by exploiting a weakness in the topic_id parameter. The rule itself only looks for access to viewtopic.php. Anytime someone looks at a topic, which
is nomal behavior it will cause the rule to trigger. By at least adding topic_id to the uricontent match you would drastically
reduce the number of false positives. This still would leave it open to FP's and really the rule would probably need a pcre rule
of the uricontent to match on possiblities of exploiting this vulnerablity in the old phpBB versions.
--
Affected Systems:
--
Attack Scenarios:
--
Ease of Attack:
--
False Positives:
http://<server_ip>/viewtopic.php?t=1
--
False Negatives:
--
Corrective Action:
adding a uricontent to match 'topic_id', better would be a full pcre to catch actaul attacks.
--
Contributors:
--
Additional References:
Joel Ebrahimi
jebrahimi@demarc.com
------------------
Demarc Security, Inc.
http://demarc.com/
---
This email and any files transmitted with it are solely intended for the use of the addressee(s) and may contain information that is confidential and privileged. If you receive this email in error, please advise us by return email immediately. Please also disregard the contents of the email, delete it and destroy any copies immediately. Demarc Security, Inc. does not accept liability for the views expressed in the email or for the consequences of any computer viruses that may be transmitted with this email.
This email is also subject to copyright. No part of it should be reproduced, adapted or transmitted without the written consent of the copyright owner.
-------------------------------------------------------
This SF.Net email is sponsored by the 'Do More With Dual!' webinar happening
July 14 at 8am PDT/11am EDT. We invite you to explore the latest in dual
core and dual graphics technology at this free one hour event hosted by HP,
AMD, and NVIDIA. To register visit http://www.hp.com/go/dualwebinar
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
|
