bugtraq - Re: Enomaly ECP/Enomalism: Silent update remote command execution vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200902132125.n1DLP5Ha026856@www5.securityfocus.com>
Date: Fri, 13 Feb 2009 14:25:05 -0700
From: lars@...maly.com
To: bugtraq@...urityfocus.com
Subject: Re: Enomaly ECP/Enomalism: Silent update remote command execution
 vulnerability

We've just released an update to Enomaly ECP (v 2.2.2) that addresses this issue. This update removes a fallback feature implemented some time ago which was found to have escaped our usual rigorous QA process. Although no users experienced any security issues, a potential security vulnerability existed in this functionality. This feature will be reintroduced once the security concerns have been addressed.

The Enterprise version of Enomaly ECP is not affected by this issue. 

Sourceforge Download: http://sourceforge.net/projects/enomalism/