Re: [mod-security-users] Sanity.A - phpbb worm

[Ivan R. <iv...@we...>]

Michael Hochradel wrote:
> First off, let me say thanks for making such a great product and=20
> maintaining this mailing list so the newbies like me can get some=20
> answers on things.  My question, obviously, relates to the sanity worm.=
=20
>  I saw on the main page the post from Dec 22 regarding this rule:
>=20
> SecFilterSelective ARG_highlight %27
>=20
> I=92m wondering how effective this is and if there are any new strains =
I=20
> need to be aware of or any other advice from the community about dealin=
g=20
> with this worm.

   The rule should work for new strains but haven't examined the
   vulnerability in great detail to determine if there are other ways
   to break PHPBB. You should upgrade to the latest PHPBB version -
   that's the best advice anyone can give you.

--=20
Ivan Ristic (http://www.modsecurity.org)