Onderwerp: phpBB 2.0.17 remote avatar size bug

Title: phpBB remote avatar size bug
Software: phpBB 2.0.17 (and maybe prior versions)
Discovered by: David Sopas Ferreira < david at systemsecure dot org >
Original link: http://www.systemsecure.org/ssforum/...ic.php?t=3D272


=BB Email from phpBB =AB

Your report "Avatar size" has been closed because your reported issue is
invalid.
Classifying a report as invalid can have various reasons, most of the time
the report is incomplete.

If you think your report has been handled incorrecly, please submit
another report at http://www.phpbb.com/security/index.php.


Comment added by team member:

This isn't a security problem. You can do the same thing with a standard
webpage. As for checking remote avatar size, there are several inherit
problems with that, which I won't detail here. As this isn't a security
problem, closing.

=BB End Of Mail - =AB


=BB My personnal opinion:

I think this is a minor security problem. A malicious user can use larger i=
mages
(for example: 1280px - 1024px) to almost damage the entire view of a
topic. This, to
be done, has to have Remote Avatar selected.

So, if the admins don't consider this a minor security problem, what
is it? A "special"
feature?

I don't want to criticize the phpBB coders, but why is it dificult to
check out the size
of a image and telling the user that that size of image it's not
possible, or even block the
size on the viewtopic table, something like that.


=BB Possible solution:

Disable remote avatar or just dig in the code to set the image size you wan=
t.

I think some people just try to hard to find problems with PHPBB. Yes, this
is a "bug", but it's FAR from a security issue.

LOL.

-----Original Message-----
From: SmOk3 [mailto:smok3f00@gmail.com]
Sent: Tuesday, September 20, 2005 6:56 AM
To: bugtraq@securityfocus.com
Subject: phpBB 2.0.17 remote avatar size bug


Title: phpBB remote avatar size bug
Software: phpBB 2.0.17 (and maybe prior versions)
Discovered by: David Sopas Ferreira < david at systemsecure dot org >
Original link: http://www.systemsecure.org/ssforum/viewtopic.php?t=272


» Email from phpBB «

Your report "Avatar size" has been closed because your reported issue is
invalid.
Classifying a report as invalid can have various reasons, most of the time
the report is incomplete.

If you think your report has been handled incorrecly, please submit
another report at http://www.phpbb.com/security/index.php.


Comment added by team member:

This isn't a security problem. You can do the same thing with a standard
webpage. As for checking remote avatar size, there are several inherit
problems with that, which I won't detail here. As this isn't a security
problem, closing.

» End Of Mail - «


» My personnal opinion:

I think this is a minor security problem. A malicious user can use larger
images
(for example: 1280px - 1024px) to almost damage the entire view of a
topic. This, to
be done, has to have Remote Avatar selected.

So, if the admins don't consider this a minor security problem, what
is it? A "special"
feature?

I don't want to criticize the phpBB coders, but why is it dificult to
check out the size
of a image and telling the user that that size of image it's not
possible, or even block the
size on the viewtopic table, something like that.


» Possible solution:

Disable remote avatar or just dig in the code to set the image size you
want.

This isn't even a bug. How this got past Bugtraq moderators is beyond
me. The "discoverer" goes on to say that to "fix" the problem you would
check the size of the image. Are you going to check the size of the
image on every page load? This is far from a bug..

--Peter

SmOk3 wrote:

>Title: phpBB remote avatar size bug
>Software: phpBB 2.0.17 (and maybe prior versions)
>Discovered by: David Sopas Ferreira < david at systemsecure dot org >
>Original link: http://www.systemsecure.org/ssforum/viewtopic.php?t=272
>
>
>» Email from phpBB «
>
>Your report "Avatar size" has been closed because your reported issue is
>invalid.
>Classifying a report as invalid can have various reasons, most of the time
>the report is incomplete.
>
>If you think your report has been handled incorrecly, please submit
>another report at http://www.phpbb.com/security/index.php.
>
>
>Comment added by team member:
>
>This isn't a security problem. You can do the same thing with a standard
>webpage. As for checking remote avatar size, there are several inherit
>problems with that, which I won't detail here. As this isn't a security
>problem, closing.
>
>» End Of Mail - «
>
>
>» My personnal opinion:
>
>I think this is a minor security problem. A malicious user can use larger images
>(for example: 1280px - 1024px) to almost damage the entire view of a
>topic. This, to
>be done, has to have Remote Avatar selected.
>
>So, if the admins don't consider this a minor security problem, what
>is it? A "special"
>feature?
>
>I don't want to criticize the phpBB coders, but why is it dificult to
>check out the size
>of a image and telling the user that that size of image it's not
>possible, or even block the
>size on the viewtopic table, something like that.
>
>
>» Possible solution:
>
>Disable remote avatar or just dig in the code to set the image size you want.
>
>
>