Hi str0ke, str0ke schrieb am Thu, 21 Sep 2006 11:16:20 -0500: >The vulnerability is in version 1.2g and below. I know (now): After azzcoder send me a direct mail this morning I looked at the version he tested, which is 1.2g. His "(Latest)" in the subject leads me to the actual version, 1.2i, which is not vulnerable. My answer to him was send also to Bugtraq, but it seems as if it was to late to stop/change my previous mail. >Source code : >http://prdownloads.sourceforge.net/pnphpbb2/ Thats a funny solution from PNphpBB: If I want to download from their Homepage (with the link at the top right) they send me to <http://noc.postnuke.com/frs/?group_id=374> instead of their own Sourceforge-Page. And there is no other version than 1.2i. After azzcoder send me the link to the Sourceforge- Download I found the older versions. But if I'm right than there is no direct link from <http://www.pnphpbb.com/> to Sourceforge, so I would never looked there. Regards Carsten -- Dipl.-Inform. Carsten Eilers IT-Sicherheit und Datenschutz <http://www.ceilers-it.de>
