full-disclosure - Bytehoard File Disclosure VUlnerability Sequel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: illectro2001 at yahoo.com (Chris Sharp)
Subject: Bytehoard File Disclosure VUlnerability Sequel

So I'm sure this passed over your inboxes in some form
or another....
http://www.securiteam.com/unixfocus/6L00L008KE.html

Just a standard directory traversal attack in an open
source, fixed rapidly like any good open source
project. Except that nobody really looked too hard at
the software, try going to 

http://victim.com/bytehoard/files.inc.php

and you'll find the root directory of the host machine
revealsed to you, you can traverse the tree, but
downloading doesn't appear to work.

Kind of an embarressing bug to have in your software.

Just a FYI

Chris

__________________________________
Do you Yahoo!?
Exclusive Video Premiere - Britney Spears
http://launch.yahoo.com/promos/britneyspears/