full-disclosure - Internet Explorer FTP client can be used to send mail

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: ian-fulldisclosure at penguinhosting.net (Ian Gulliver)
Subject: Internet Explorer FTP client can be used
	to	send mail

> Isn't Konqueror a "free software"? 
> So, where's the "attached patch"? 

Attached.  Sorry, didn't know about KDE when I sent the first email, and
it took me awhile to dig into the C++.

-- 
Ian Gulliver
Penguin Hosting
"Failure is not an option; it comes bundled with your Microsoft products."
-------------- next part --------------
--- kdelibs-3.2.3/kioslave/ftp/ftp.cc	2004-02-15 16:15:27.000000000 -0500
+++ kdelibs-3.2.3-ftp-fixed/kioslave/ftp/ftp.cc	2004-12-25 00:44:27.000000000 -0500
@@ -652,6 +652,9 @@
 {
   assert( sControl > 0 );
 
+  if (cmd.find('\r') != -1 || cmd.find('\n') != -1)
+	  return false;
+
   QCString buf = cmd;
   buf += "\r\n";
 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041225/0a654bff/attachment.bin