full-disclosure - A correction to "UNIRAS ALERT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: Ulf.Harnhammar.9485 at student.uu.se (Ulf Härnhammar)
Subject: A correction to "UNIRAS ALERT - 34/04"

----- Forwarded message from Ulf H?rnhammar <Ulf.Harnhammar.9485@...dent.uu.se>
-----
    Date: Thu, 16 Sep 2004 12:24:39 +0200
    From: Ulf H?rnhammar <Ulf.Harnhammar.9485@...dent.uu.se>
Reply To: Ulf H?rnhammar <Ulf.Harnhammar.9485@...dent.uu.se>
 Subject: A correction to "UNIRAS ALERT - 34/04"
      To: vulteam@...cc.gov.uk

Hello,

I think this paragraph from your alert 34/04 is misleading:

> However for this vulnerability to be exploited, an attacker must first
> induce a normal user to install the malicious configuration files onto
> their servers before a exploit can take place.

In the scenario that I and SITIC have described, the attacker is the normal 
user. If Peter is a customer of MegaISP, which allows their users to configure 
their web pages with .htaccess files, Peter can hack MegaISP by storing 
malicious .htaccess files in his web space at MegaISP. Thus, there is no need 
for an attacker to induce a normal user to do anything.

Please correct this.

// Ulf Harnhammar

----- End of forwarded message -----

BTW, I wrote some more about this vulnerability in my Advogato blog.

-- 
Ulf Harnhammar
http://www.advogato.org/person/metaur/