full-disclosure - Re: ZH2005-03SA -- multiple vulnerabilities in NukeBookmarks .6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <424B2FA4.60403@zone-h.org>
Date: Fri Apr  1 01:02:53 2005
From: astharot at zone-h.org (Astharot)
Subject: Re: ZH2005-03SA -- multiple vulnerabilities
	in NukeBookmarks .6

Paul Laudanski wrote...
> I can understand how full path disclosure can be an issue, however, in
> a production environment the PHP settings to display errors ought to
> be disabled. As such, full path disclosure goes away.

> That is true if the default table names are used. However it would be
> worth noting that with any web presence that uses a backend database,
> the
> prefix ought to be changed to something random and non-default.
>
> Does this completely solve the issue, of course not, but it can stop
> the script kiddy attacks. For more on this:
>
> http://unixwiz.net/techtips/sql-injection.html
>
> Thanks for the disclosure.

So, noone should publish any buffer overflow vulnerability... the stack
protection in Windows SP2 and grsecurity can solve every problem...
right? :)

Buh!

Greetings

	Gerardo Di Giacomo