bugtraq - Re: Download Accelerator Plus can be tricked to download malicious file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 6 Jan 2006 18:52:14 -0000
From: "Dave Korn" <davek_throwaway@...mail.com>
To: bugtraq@...urityfocus.com
Subject: Re: Download Accelerator Plus can be tricked to download malicious file

visitbipin@...mail.com wrote in
news:20060105180806.22333.qmail@...urityfocus.com
> Just n' update:
> DAP searches for all its mirrors from mirrorsearch.speedbit.com
>
> I have no knowledge about HOW the mirrors are gathered.

  Then your report should have been titled "Maybe DAP can be tricked to
download malicious file, maybe not, I haven't got any idea because I haven't
bothered to find out".

  Or even better, you shouldn't have bothered posting it because it has zero
content.  "There might or might not be a vulnerability in application X" is
NOT information.  Uninformed speculation is NOT information.

  What you actually observed was DAP not being tricked and not downloading a 
malicious file.  What you wrote was the exact opposite.  Your report is 
fraudulent and utterly dishonest.

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....