| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070705114836.23444.qmail@securityfocus.com>
Date: 5 Jul 2007 11:48:36 -0000
From: not@...moment.thanks
To: bugtraq@...urityfocus.com
Subject: Re: Serious holes affecting JFFNMS
Per the following comments...
"Finally, the auth.php PHP script also includes the following code:
if (($jffnms_version=="0.0.0") && ($_SERVER["REMOTE_ADDR"]=="128.30.52.13")) {
which could be considered a backdoor althought it does not appear to be
exploitable in a typical installation."
...it should be noted that 128.30.52.13 is likely the source IP address of the W3.ORG validator. So perhaps the PHP code intends to behave differently during a W3.ORG validation test.
Powered by blists - more mailing lists