full-disclosure - Re: Original Photo Gallery Remote Command Execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 4 Oct 2007 03:04:36 -0700
From: Andrew Farmer <andfarm@...il.com>
To: Aidan Thornton <makosoft@...glemail.com>
Cc: Full-Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Original Photo Gallery Remote Command
	Execution

On 03 Oct 07, at 02:10, Aidan Thornton wrote:
> On 10/2/07, ascii <ascii@...amail.com> wrote:
>> X. LEGAL NOTICES
>>
>> Copyright (c) 2007 Francesco `ascii` Ongaro
>>
>> Note: this exploit is DUAL LICENSED,
>> 1. if you'll use it for personal and non-profit purposes you can
>>    apply GPL v2 and above.
>>
>> 2. In the case you plain to:
>>    a. use our code in any commercial context
>>    b. implement this code in your non-GPL application
>>    c. use this code during a Penetration Test
>>    d. make any profit from it
>>
>>   you need to contact me in order to obtain a _commercial license_.
>>
>> For more informations about Dual Licensing:
>> http://producingoss.com/html-chunk/dual-licensing.html
>
> I think you're misunderstanding the GPL. "GPL, but only for personal
> and non-profit purposes" isn't a valid license since the GPL doesn't
> permit restrictions on commercial use.

In fact, the GPL doesn't permit any restrictions on usage at all. It
only covers distribution.

Probably a moot point anyway, as the actual exploit is trivial enough
that it isn't covered by copyright. (The discovery that you can use
register_globals to set exif_prog isn't a creative work.)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/