YaBB Bulletin Board Corruption Vulnerability

Bugtraq ID:	10263
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 03 2004 12:00AM
Updated:	May 03 2004 12:00AM
Credit:	Disclosure of this issue is credited to Dmitry Shurupov <[email protected]>.
Vulnerable:	YaBB YaBB 1 Gold - SP 1.2 YaBB YaBB 1 Gold - SP 1 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.18 - Apache Apache 1.3.17 - Apache Apache 1.3.17 - Microsoft IIS 5.0 - Microsoft IIS 4.0 - Omnicron OmniHTTPD 2.4 Pro
Not Vulnerable:

YaBB Bulletin Board Corruption Vulnerability

It has been reported that YaBB is affected by a bulletin board corruption vulnerability. This is due to an input validation issue that allows users to specify arbitrary values in a text file associated with the application.

This issue might cause the bulletin board related to the application to become corrupted and unreadable, denying service to legitimate users. Other attacks might also be possible.

YaBB Bulletin Board Corruption Vulnerability

No exploit is required to leverage this issue.

YaBB Bulletin Board Corruption Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

YaBB Bulletin Board Corruption Vulnerability

References:

• Vulnerability in YaBB forum (Perl version without SQL) (Dmitry Shurupov )