bugtraq - Re: Vulnerabilities in Sebo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 11 May 2010 10:17:55 +0200
From: Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com>
To: MustLive <mustlive@...security.com.ua>
Cc: Bugtraq <bugtraq@...urityfocus.com>
Subject: Re: Vulnerabilities in Sebo - webstore

On 11 May 2010 01:47, MustLive <mustlive@...security.com.ua> wrote:
>
> In my letter to Bugtraq (http://www.securityfocus.com/archive/1/511023),
> which was mentioned in my advisory (you can read that letter, if you didn't
> read it yet), I wrote about importance of making separate advisories of
> vulnerabilities in software which are using CaptchaSecurityImages.php.

If you found a security flaw in a script written by "Babbaleo" and
this script is used by many web application, you don't must send an
email for each application that use it because the hole isn't of the
application. This email and not 'a reproach to you but to all those
who adopt this method (For example the arbitrary file upload
"vulnerability" found in any applications that use a misconfigured
fckeditor or only reflected XSS) .

I and my other in this list do not believe that these bugs are very
critical for the target web application, but in any way if you find a
bug in a used script, you can contact the developer(s) or the
mainteiner(s) of the web application that use it, reporting a warning,
without write any time an email to bugtraq o to other security
mailinglist.

All in this list are understand that there are bugs in
CaptchaSecurityImages.php. If we are using this script, we'll fix the
bugs, stop. There is no need to know all the web applications that use
this "vulnerable" script.

I propose again to you my question:  if you find (ad absurdum) a bug
in the printf C function, will you send an e-mail for each software
that uses it?

A friendly advice for the future: more information about the bugs and
fewer links to your site.

-- 
Salvatore Fresta aka Drosophila
http://www.salvatorefresta.net
CWNP444351