bugtraq - Re: Plunet BusinessManager failure in access controls and multiple stored cross site scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 09 Jan 2009 11:09:34 +0100
From: Stefano Zanero <s.zanero@...urenetwork.it>
To: Bugtraq <bugtraq@...urityfocus.com>
Subject: Re: Plunet BusinessManager failure in access controls and multiple
 stored cross site scripting

Dear all,

just in order to give complete information, after being contacted by the
vendor (thanks !) we can confirm the following version information:

> Systems affected: Plunet BusinessManager 4.1

Therefore, the vendor recommended fix is as follows:

> *** FIX INFORMATION ***

Upgrade Plunet BusinessManager to the latest available version, and in
any case to a version >=4.2

Our advisory has been updated to reflect this new information:
http://www.securenetwork.it/ricerca/advisory/download/SN-2008-04.txt

For the records, what apparently happened is that our first advisory was
correctly received and immediately acted upon by the vendor, but we
never received an acknowledgment and fix information afterwards for some
communication mishap. Our later contact attempts did not apparently
reach the appropriate person(s) inside the company.

We thank the vendor for working with us on this.

Best regards,
Stefano Zanero