bugtraq - Re: Sourceforge compromized?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 2 Feb 2007 12:30:45 -0500
From: Tim <tim-security@...tinelchicken.org>
To: Michael Scheidell <scheidell@...nap.net>
Cc: bugtraq@...urityfocus.com, security@...rceforge.net
Subject: Re: Sourceforge compromized?

> Could someone from sourceforge.net comment? What else is compromised on
> the server?
> 
> Can just anyone post anything to any directory or are there specific
> directories that can be hacked?
> 
> Is it just yapig.sourceforge.net?

If you look here:

  http://yapig.sourceforge.net/

You'll see the following list of vulns recently fixed in this image
gallery project:

...
* Vulnerability: Cross site scripting on add comment form (#1230491)
* Vulnerability: Save plain text login information in cookies (#1230491)
* Vulnerability: Arbitrary directory removal on upload.php (#1230491)
* Vulnerability: Extension checks on upload.php (#1230491)
* Vulnerability: Arbitrary file Inclusion global.php and last_gallery.php (#1230491)
* Vulnerability: Cross-site Scripting (#1230491)
* Vulnerability: Information disclosure in phid argument of view.php and slideshow.php (#1230491)
...

Yeah, so their demo site is compromised through one of these, or another
yet to be published.  Have you tried to let the project owner know?

> Either case, I should suggest everyone be careful about what you
> download from sourceforge till they do a full code audit and post the
> results here.

I would hope that sourceforge has decent cross-project segmentation by
now...

tim

PS- next time you start a new thread on lists, could you avoid
responding to messages on completely different threads?  I realize that
some mail clients still don't support the interpretation of threading
headers, but many of ours do.