full-disclosure - Apache 1.3.29

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <001301c407bc$f84fc540$6401a8c0@jarroom>
From: SirSlappy at cox-internet.com (Jarrod SMith)
Subject: Apache 1.3.29

They might have used an apache user discosure bug that allows you to check user names vs. passwords.. I think it's made by w00w00. It will check the user names and passes, if it finds one that works it will login via FTP to make sure.  


  ----- Original Message ----- 
  From: VeNoMouS 
  To: full-disclosure@...ts.netsys.com 
  Sent: Thursday, March 11, 2004 2:38 PM
  Subject: [Full-Disclosure] Apache 1.3.29


  any one know if theres a new exploit for apache 1.3.29 in the wild one of my mates boxes was breached this morning by ir4dex appears they gained axx via apache then got root via mmap()
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040311/52adc76c/attachment.html