[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <200502202029.j1KKThrs027339@lists.netsys.com>
From: fulldisclosure at wateraxe.demon.nl (Allan)
Subject: How T-Mobil's network was compromised
[quote]
3) (and based on a recent example, I just can't find the reference... it was
some PHP app): Input URLs are examined for "../" and converted into "./".
The function worked correctly, no flaw from a programming perspective.
However, input of ".../" was converted to "../" as planned, but leaving the
application still vulnerable.
(Note: I don't think the fix to that problem was all that great. What should
have occurred is a check for "../" in a loop. Change and replace as often as
"../" is found. There was no such loop in the suggested fix
afair)
[/quote]
I think this was the recent mailman vulnerability...
Powered by blists - more mailing lists