Mail2Forum

[georgec]

Important information for all users of Mail2Forum

A security vulnerability has been brought to our attention today (19th July 2006). We have released a new set of files which will hopefully fix the problem. All users are urged to upgrade immediately - the vulnerability is serious and has already resulted in several websites being defaced.

Thanks to m2f users subtlecoolness, peterflorance, hardym, fgomez and others (including some nice anonymous people ) for their discussion which brought this to our attention!


More Information:

On July 18th we stumbled upon a security vulnerability warning in our support forum (see the discussion topic). A global variable was not being properly checked before use, and thus it opened a hole that permitted arbitrary remote php file execution. This vulnerability has also been registered in the secunia database: http://secunia.com/advisories/21083/.

The vulnerability affects all previous versions of m2f released to date (19th July 2006), including the most recent Stable Release of v1.2. ALL users are strongly advised to upgrade immediately.



>>> Download Link <<<


N.B. that this upgrade requires two steps:

1 - upload the m2f files to the phpBB directory as normal, wiping over the existing copies.
2 - make the following modification to the file phpBB_root/common.php:

[FIND ]

[georgec]

Note that the [ REPLACE WITH ] part above has been changed since it was first posted - phpBB was corrupting the tab characters I was posting. Please re-apply the modification to common.php if you are experiencing problems.

Sorry once again for the annoyance!