Archive for April, 2011
Random Thought of the Day
by CTruncer on Apr.23, 2011, under Random Thought
Isn’t it funny that World of Warcraft and Facebook are rolling out multifactor authentication for securely logging in, but I can’t find a bank around me that does the same?
IP Board Vulnerabilities
by CTruncer on Apr.07, 2011, under Security
Good Morning all,
It’s been a busy past month for me, but I did happen to find a new vulnerability that exists in IP.Board. IP.Board is basically a web application that allows you to run a forum, with the option to purchase additional functionality, like blogs, a store, etc.
While I was looking into how IP.Board works, and running some tests and scans against it, I’ve discovered a couple of vulnerabilities in the application. At the moment, it seems to largely be information disclosure and XSRF vulnerabilities, but I am in the process of seeing if it is capable of further development into something a little more dangerous.
I’ve already reported some of the vulnerabilities to the developers of IP.Board, and they said that a fix has been created for their next update. I’ll be sure to let you know once it is released if it fixes the issue. The other outstanding vulnerabilities I want to look into as much as I can to see if it can result in a dangerous attack. As I find out more information, and understand how it works, I will then be able to provide a better report to the developers of IP.Board (Invision Services) about the vulnerability.
I am also currently working to get a CVE number reserved for the issue for proper tracking of the vulnerability.