bugtraq - Re: Technical Details of Urlcount.cgi Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040203224024.1607.qmail@www.securityfocus.com>
Date: 3 Feb 2004 22:40:24 -0000
From: Tom Hanlin <tom@...erbasic.com>
To: bugtraq@...urityfocus.com
Subject: Re: Technical Details of Urlcount.cgi Vulnerability

In-Reply-To: <000501c226a1$c0f58060$e62d1c41@...rr.com>

>When I informed Summit Computer Networks' Scott
>Slater about the Urlcount.cgi vulnerability, he replied to
>me that the application was property of PowerBASIC,
>and that he would forward it on.  Hearing nothing from
>either Slater, or PowerBASIC, Inc. in nearly two
>weeks, and in response to requests for information from
>list readers, I have decided to make details of the
>vulnerability public.

I gather it never occurred to you to contact PowerBASIC or even to follow up with Mr. Slater. Thank you so much. If I hadn't run across this case on an unrelated web search, PowerBASIC might never have heard of the problem.

Urlcount.cgi was based on the PowerBASIC sample program, EZCount, which is purely introductory in nature: "hello, world!"-type code, not designed or intended for practical use. But, it's a perfectly good idea to put safety first, and we'll have an update out shortly.