TITLE: phpBB Blend Portal System Module "phpbb_root_path" File Inclusion

SECUNIA ADVISORY ID: SA20350

VERIFY ADVISORY: http://secunia.com/advisories/20350/

CRITICAL: Highly critical

IMPACT: System access

WHERE: >From remote

SOFTWARE: Blend Portal System 1.x (module for phpBB)
http://secunia.com/product/10215/

DESCRIPTION: Mustafa Can Bjorn has reported a vulnerability in the Blend Portal System module for phpBB, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "phpbb_root_path" parameter in blend_data/blend_common.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from external and local resources.

Successful exploitation requires that "register_globals" is enabled.

The vulnerability has been reported in version 1.2.0. Other versions may also be affected.

SOLUTION: Apply code changes as instructed by the vendor. http://phpbb-tweaks.com/topics.html-p-17623#17623

PROVIDED AND/OR DISCOVERED BY: Mustafa Can Bjorn

ORIGINAL ADVISORY: http://www.nukedx.com/?viewdoc=41

TITLE: phpBB Activity Mod Plus Module "phpbb_root_path" File Inclusion

SECUNIA ADVISORY ID: SA20354

VERIFY ADVISORY: http://secunia.com/advisories/20354/

CRITICAL: Highly critical

IMPACT: System access

WHERE: >From remote

SOFTWARE: Activity Mod Plus 1.x (module for phpBB)
http://secunia.com/product/10213/

DESCRIPTION: Mustafa Can Bjorn has reported a vulnerability in the Activity Mod Plus module for phpBB, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to the "phpbb_root_path" parameter in "language/lang_english/lang_activity.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from external and local resources.

The "lang_activity_char.php" script is reportedly also affected.

Successful exploitation requires that "register_globals" is enabled.

SOLUTION: Apply code changes as instructed by the vendor. http://www.phpbb-amod.com/topics.html-t-2423

PROVIDED AND/OR DISCOVERED BY: Mustafa Can Bjorn

ORIGINAL ADVISORY: http://www.nukedx.com/?viewdoc=38

TITLE: PHP "curl_init()" Safe Mode Bypass Weakness

SECUNIA ADVISORY ID: SA20337

VERIFY ADVISORY: http://secunia.com/advisories/20337/

CRITICAL: Not critical

IMPACT: Security Bypass

WHERE: Local system

SOFTWARE:
PHP 5.1.x
http://secunia.com/product/6796/
PHP 4.4.x
http://secunia.com/product/5768/
PHP 5.0.x
http://secunia.com/product/3919/

DESCRIPTION: Maksymilian Arciemowicz has discovered a weakness in PHP, which can be exploited by malicious, local users to bypass certain security restrictions.

The weakness is caused due to an error in the handling of null byte characters in the "curl_init()" PHP function in the curl extension. This can be exploited to bypass the safe mode protection and access other users' files located in the same directory as the running script.

Successful exploitation requires that the curl extension is installed and enabled.

The weakness has been confirmed in versions 5.0.5 and 5.1.4, and has also been reported in version 4.4.2. Other versions may also be affected.

SOLUTION: The weakness has been fixed in the CVS repository.

Do not rely on the safe mode protection for files located in the same directory as untrusted scripts.

PROVIDED AND/OR DISCOVERED BY: Maksymilian Arciemowicz

ORIGINAL ADVISORY: http://securityreason.com/achievement_securityalert/39

nb1 writes:  

Java software allows you to run applications called "applets" that are written in the Java programming language. These applets allow you to play online games, chat with people around the world, calculate your mortgage interest, and view images in 3D. Corporations also use applets for intranet applications and e-business solutions.

Sun Microsystems has issued an update to fix stability and security problems with its Java software. It includes all operating systems. It is recommended that you update to the latest version. It's also necessary to remove the old java environments, not just update the new versions, as an attacker can target the old environments when they are still present.
Java Update 1.5.0_07

TITLE: phpBB Nivisec Hacks List Module Local File Inclusion

SECUNIA ADVISORY ID: SA20359

VERIFY ADVISORY: http://secunia.com/advisories/20359/

CRITICAL: Moderately critical

IMPACT: Exposure of sensitive information

WHERE: >From remote

SOFTWARE: Nivisec Hacks List 1.x (module for phpBB) - http://secunia.com/product/10204/

DESCRIPTION: Mustafa Can Bjorn has discovered a vulnerability in the Nivisec Hacks List module for phpBB, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "phpEx" parameter in admin_hacks_list.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from local resources.

Example: http://[host]/admin/admin_hacks_list.php?setmodules=1&board_config[default_lang]=english&phpEx=[file]

Successful exploitation requires that "register_globals" is enabled.

The vulnerability has been confirmed in version 1.20. Other versions may also be affected.

SOLUTION: Edit the source code to ensure that input is properly sanitised. Set "register_globals" to "Off".

PROVIDED AND/OR DISCOVERED BY: Mustafa Can Bjorn

ORIGINAL ADVISORY: http://www.nukedx.com/?viewdoc=37

pcnuke writes:  

Pc-Nuke! has created a new project for:

Coppermine for Nuke module from the standalone version of coppermine photo gallery which is currently at v1.46

You can find out what this version includes by visiting this link: Check Standalone version options

Because our Team members are limited, and since we could find interests within the Nuke community to get involved in this project, PCN has offered the project to outside bids, and more info on that can be found here: Check the Status Read More...

Note: 

Although I went ahead and posted this, I do not agree with your attempt to do an end run around the GPL. You are, imo, violating the GPL by threatening to continue support if someone follows the licensing of the GPL. I, for one, would not use your product with the altered GPL.