lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri Apr 1 01:02:53 2005 From: astharot at zone-h.org (Astharot) Subject: Re: ZH2005-03SA -- multiple vulnerabilities in NukeBookmarks .6 Paul Laudanski wrote... > I can understand how full path disclosure can be an issue, however, in > a production environment the PHP settings to display errors ought to > be disabled. As such, full path disclosure goes away. > That is true if the default table names are used. However it would be > worth noting that with any web presence that uses a backend database, > the > prefix ought to be changed to something random and non-default. > > Does this completely solve the issue, of course not, but it can stop > the script kiddy attacks. For more on this: > > http://unixwiz.net/techtips/sql-injection.html > > Thanks for the disclosure. So, noone should publish any buffer overflow vulnerability... the stack protection in Windows SP2 and grsecurity can solve every problem... right? :) Buh! Greetings Gerardo Di Giacomo
Powered by blists - more mailing lists