Who's With Me With Security Mods?

[William R]

http://secunia.com/advisories/13893/" target="_blank

It has nothing to do with phpBb

[</end>]

am i right to believe that the new phpbb will at least have the options that austin phpbb security mod has ?

phpBB Security
Short Description

This will add extreme added protection to your board. Will help prevent scripts from attacking & defacing your boards due to exploits in coding. Helps protect admin & moderator accounts.

http://phpbb-tweaks.com/downloads.php?mode=sub&cid=916" target="_blank

if not i know that there are a few fans i have that will go after a site that i run... and ill run into all kinds of problems that i've had b4

[psoTFX]

huh? The only way to be 100% certain you're board is safe (any board, not just phpBB ... the other major boards have just had a series of new releases due to security issues) is to not connect it to the internet. What you appear to be describing though are people spamming your board ... that's quite different to an inherit failure in the code leading to an exploit.

With 3.0 we've altered how we approach to a variety of issues which should lead to more secure code ... we aren't God's though, we're human and thus falible.

And to reiterate ... our best understanding right now is that this attack was not achieved through phpBB itself. Obviously we need to review all the information before commenting further.

[Amailer]

I have seen attacks like this on other sites also but those only replaced the index.* in the servers with a small php script that anyone can built... But it appares that somehow all the files from phpBB.com have been removed- I don't know if that was done by the admins or by the script but it seriously sucks... What reason is there to attack phpBB anyhow?
The only thing that confuses me is that... how on earth was the script run if it was the same type of script that replaces the index.* in all the hosted sites.

[bonelifer]

AWSTATS a popular PERL based weblog analyzer on the most previous version when run on CGI mode based PHP (instead of Apache Module) had a bug which allowed someone to run arbitrary code as the webuser(nobody) which which is the account used by the webserver daemon.