Re: Serious issue

> From: Brady Bellinger
> 
> Are sites that only allow trusted, registered users also affected by
this issue?
> To my knowledge our site does not allow anonymous users to submit
announcements.
> 
> Thanks,
> 
> Brady

Hi Brady,

That might make a little bit of difference,  but this is serious enough
that you should do 
the patch.  If you are running and older version or have a heavily
modified installation, 
just add the new code in index.php to your index.php.

Also do not be fooled by comments such as "normally only apache/nobody
user access is attained".  
Such access is the first step of almost all breakins as it gives enough
access to run a privelege escallation exploit.

I would like to hear some other opinions on this as well, but that's
currently my take on 
the situation.

Best regards,

Jim Wilson




-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click