full-disclosure - minor security problem on Mandrake Multiple Network Firewall GUI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20030509155935.GK736@mandrakesoft.com>
From: vdanen at mandrakesoft.com (Vincent Danen)
Subject: minor security problem on Mandrake Multiple Network Firewall GUI - TCP 8443

On Thu May 08, 2003 at 10:54:06PM -0700, Curt Wilson wrote:

> I'm investigating a minor problem I've found on the Mandrake Multiple
> Network Firewall administration GUI running on TCP 8443. The actual problem
> appears to be related to the web GUI configuration, but I want to verify
> this with other installations. If you are using MNF and are not too paranoid,
>  drop me a line to discuss. I've notified Mandrake of the issue and am
> awaiting any response. I consider this a low priority issue since the
> web GUI port should be heavily ACL'ed in the first place, but I still
> feel that security standards for a firewall should not allow the behavior
> I'm seeing. More details forthcoming.

I'm not sure who you contacted, but I'd like to discuss this with you.

-- 
MandrakeSoft Security; http://www.mandrakesecure.net/
Online Security Resource Book; http://linsec.ca/
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FE6F2AFD : 88D8 0D23 8D4B 3407 5BD7  66F9 2043 D0E5 FE6F 2AFD}

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 186 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030509/264d205f/attachment.bin