full-disclosure - Vulnerability in sourceforge.net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <000101c46f2f$d6c1aee0$2001010a@msad.brookshires.net>
From: toddtowles at brookshires.com (Todd Towles)
Subject: Vulnerability in sourceforge.net

-----Original Message-----
From: nicolas vigier [mailto:boklm@...s-attacks.org] 
Sent: Wednesday, July 21, 2004 9:16 AM
To: Todd Towles
Cc: 'Alexander'; full-disclosure@...ts.netsys.com
Subject: Re: [Full-Disclosure] Vulnerability in sourceforge.net

On Wed, 21 Jul 2004, Todd Towles wrote:

> I would call that a Directory Traversal Vulnerability, if it allows a user
> to read files that he doesn't have permission to read.

Yes, but your can also read theses files if you have an account on
sourceforge.net (and it's easy to get one), so that's not a very big
vulnerability. And the vulnerability does not come from sourceforge,
but from the "Smart BootManager" project's webpage hosted on sourceforge.
Anyway, it might be a good idea for them to correct this :)

It could allow someone with an account on sourceforge to put some files
on it and include them on their website to have fake pages for example.