full-disclosure - minor security problem on Mandrake Multiple Network Firewall GUI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <200305090554.h495s6Gp000894@mailserver1.hushmail.com>
From: netw3_security at hushmail.com (Curt Wilson)
Subject: minor security problem on Mandrake Multiple Network Firewall GUI - TCP 8443

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm investigating a minor problem I've found on the Mandrake Multiple
Network Firewall administration GUI running on TCP 8443. The actual problem
appears to be related to the web GUI configuration, but I want to verify
this with other installations. If you are using MNF and are not too paranoid,
 drop me a line to discuss. I've notified Mandrake of the issue and am
awaiting any response. I consider this a low priority issue since the
web GUI port should be heavily ACL'ed in the first place, but I still
feel that security standards for a firewall should not allow the behavior
I'm seeing. More details forthcoming.

Curt R. Wilson
Netw3 Security
www.netw3.com
-----BEGIN PGP SIGNATURE-----
Version: Hush 2.2 (Java)
Note: This signature can be verified at https://www.hushtools.com/verify

wmMEARECACMFAj67QZQcHG5ldHczX3NlY3VyaXR5QGh1c2htYWlsLmNvbQAKCRBGd/Yw
aRH3Kz10AKCkpZiRQ9zLNRfGoITaEOAq9oy7gwCdH5+UkBgXV3ge0D+UEEQb82cp744=
=6Si6
-----END PGP SIGNATURE-----