| Author |
 Topic  |
|
|
vdevil
Starting Member
20 Posts |
 Posted - 06 September 2006 : 09:59:15
|
Hi,
I've a 3.4.03 version. I've recently read 2 important bug fix... how I can fix the bug?
I can't upgrade to 3.4.05 version.
Thank you
quote:
BUG:
Account Compromise Via Cookie Poisoning
password.asp Password Reset Vulnerability
|
|
|
ruirib
Snitz Forums Admin
Portugal
26364 Posts |
|
|
vdevil
Starting Member
20 Posts |
Posted - 06 September 2006 : 10:29:54
|
in a security bulletin
http://marc.theaimsgroup.com/?l=bugtraq&m=105578322012128&w=2
quote:
Account Compromise Via Cookie Poisoning
-------------------------------------------
In order to steal another users identity, all an attacker
needs to know is thier encrypted password. This is not
very hard to obtain using the XSS as described above, or
other methods. Once an attacker has this info, all they
have to do is login to thier normal account to get a valid
session id, close the browser, replace thier username and
encrypted pass with that of the victim, and return to the
site where they will be recognized as the victim.
password.asp Password Reset Vulnerability
-------------------------------------------
This is the most serious of the vulns, as it requries no
real effort and leaves the entire snitz forum open to attack.
All an attacker has to do is request a forgotten password, save
the password reset page offline,edit the member id to the desired
member id, and submit the form. The members password will then
be reset to that of the attackers choosing.
How I can fix?
snitz forum 3.4.03 is affected!!! |
Edited by - vdevil on 06 September 2006 10:33:17 |
 |
|
|
vdevil
Starting Member
20 Posts |
|
|
HuwR
Forum Admin
United Kingdom
20584 Posts |
Posted - 06 September 2006 : 10:43:44
|
this is a very old vunerability(> 3 years), so I'm not sure which topic actually relates to the fix
In fact I'm not sure that the fix was released seperately but rather was released as part of the 3.4.04 update |
|
|
|
vdevil
Starting Member
20 Posts |
Posted - 06 September 2006 : 10:59:36
|
| May I see the bug fix list of 3.4.03 from anywhere? |
|
|
|
AnonJr
Moderator
United States
5768 Posts |
Posted - 06 September 2006 : 11:04:07
|
| Its probably in DEV Bug Reports (Closed) or as an archived topic in either Bug Reports forum. |
|
|
|
vdevil
Starting Member
20 Posts |
Posted - 06 September 2006 : 11:10:13
|
| nothing :-( |
|
|
|
AnonJr
Moderator
United States
5768 Posts |
|
|
AnonJr
Moderator
United States
5768 Posts |
|
|
Davio
Development Team Member
Jamaica
12217 Posts |
|
| |
Topic |
|
Topic Locked
