PHPbb

new threats?

[rj87uk]

Hey guys,

Are there any new bugs out for PHPBB? My host shut my whole website down because one of the processes was using 90% of the procesing power for the whole server for an hour so he had to shut it down.

Website is still down, Im going to go over to phpbb forum and see what I can get done - this is a killer.

[Swanny007]

What version are you running? Is it 2.0.21 (the latest)?

[rj87uk]

Yeseree - I am my humble friend...

[bcolflesh]

If you can't get it sorted, check out PunBB:

[punbb.org...]

[rj87uk]

Thanks for the link - im looking into that one.

Does anyone know where the PHPbb page where they list the updates from versions to => versions? I remember it but I can't find anything on that website.

Its something like:

version 2.1 > current
version 1.8 > current

Go on - someone give me a clue? and don't say google.com :)

[bcolflesh]

I think there is a file like that in the INSTALL files you download with the package?

[trillianjedi]

Why do you think it's phpBB?

Did you get a report on processes?

TJ

[rj87uk]

Yeah, I did - the rest of the website im talking about is all static pages anyway.

He pointed out some lines in the viewtopic.php

So Im going to look over past installs and see if I can spot anything, all else fails I think its a clean install for me, or maybe look into other boards.

[AjiNIMC]

very strange, I am using phpbb for last few years and I never had such problem. If you could pm me the website I can look for possible reasons.

[rj87uk]

If you could pm me the website I can look for possible reasons.

Thanks for the offer, but the website is no longer live as the host has took it all offline. I think im going to do a clean install I took a back-up of the database three days ago (first back up ive took, weird eh?) and just start a fresh.

Thanks for the help guys,
RJ

[trillianjedi]

viewtopic.php

You should kill all of the "highlight content" stuff - that's where 99% of the problems are with phpBB.

That said, a maxxed out CPU is usually something stuck in a tight loop, and I've never seen that in phpBB and I can't think of any code in viewtopic.php that might cause that (and I know that file quite intimately!).

My gut feeling thinks the problem lies elsewhere. What else did you have running on the box?

TJ

[rj87uk]

It is something to do with the highlight - The host sent me over something from a query string that was the "problem". Im still learning PHP so not the best at it.

I don't think it was anything to do with members because it was at 4am this morning. They said I would need to test it out locally and fix the problem - the thing is im not that techy so I was thinking all i can do is install a new copy?

added---
"My gut feeling thinks the problem lies elsewhere. What else did you have running on the box?"

Shared hosting, only a small project - pass time - but the host says it was from that file..

[bcolflesh]

Make sure you send the query string and all your problem info to the security contact at phpBB.

[trillianjedi]

4 am

Use mod_rewrite to alter all of the URL strings. Take out from the templates anything that identifies the software version. Think like a bot...

send the query string and all your problem info to the security contact at phpBB.

It's already a well known problem. I don't know why phpBB don't just remove it all actually - it's not necessary.

TJ

[AjiNIMC]

Take out from the templates anything that identifies the software version.

For each version the hacking method were different as the bugs were different. I know forums dedicately trying and hiring for phpbb hacking. I am a member there to check the latest threats.

PLEASE REMOVE THE VERSION IDENTIFIERS From the templates.