Re: Fw: PHP Vulnerability Notification

linoj wrote:
> I just got this from my ISP:
> 
> 
> If you currently use PHP (versions prior to 4.3.10), you may be susceptible
> to a vulnerability through the "unserialize" function.  This could allow a
> remote user access to your web server content. If you are using an older
> version of PHP, we strongly recommend that you upgrade as soon as possible.
> To upgrade to PHP 4.3.10, ....
> 
> 
> I don't know much about this but it sounds important...
> 
> Jonathan
> 
It's mostly dangerous for those PHP applications that rely on user input
via unserialize() of cookies, like phpBB, IPB, vBulletin, phpAds et al.
See http://www.hardened-php.net/advisories/012004.txt (as reported by
Marty Vance)

AFAIK, Xaraya is not directly vulnerable in this way, but upgrading for
security reasons is always a good idea anyway, especially if you're
running one of those applications :-)

Speaking about phpBB, there is also an unrelated security hole via the
highlight feature http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240513
which seems to be targetting sites now.

Mike.