Re: phpBB Security Bugs

[Konrad Rieck <kr () roqe org>]

Hi Lucas & List, 

On Thu, 2003-02-20 at 21:37, Lucas Armstrong wrote:
> If a correct password hash digit is guessed, the admin's name will show up 
> as an online user, in the online user list at the bottom of the forum 
> page. After the password hash is determined, it is then placed in the 
> cookie and access is granted to the site.

I am just wondering... You are talking about guessing a 33-digit
hexadecimal number? 

Even if there are 1.000 admin passwords in the hash-space and you
succeed finding one after only searching 10% of space and you are
checking about 1.000.000 hashs per second. You won't finish until the
sun goes nova (which is rather impractical, especially for CPU-
cooling).

I believe this is a theoretical attack against phpBB 2.0, but maybe I
missed some magic in the way phpBB generates these password hashs,
acutally I haven't looked at the code.

Regards,
Konrad 

-- 
Konrad Rieck <kr () roqe org> --------------------------------------------+
Roqefellaz, http://www.roqe.org - PGP: http://www.roqe.org/keys/kr.pub |
Fingerprint: 5803 E58E D1BF 9A29 AFCA  51B3 A725 EA18 ABA7 A6A3 -------+

Attachment: signature.asc
Description: This is a digitally signed message part