full-disclosure - Multiple Phorum XSS and Session Hijacking vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <43188540.6090700@gmail.com>
Date: Fri Sep  2 18:00:58 2005
From: wr0ck.lists at gmail.com (Scott Dewey)
Subject: Multiple Phorum XSS and Session Hijacking
	vulnerabilities

Brian Moon wrote:
> First, all issues that will allow any of the issues here to happen have 
> been fixed.  With 5.0.18a, you can not use any method described below. 
> We had the fixes done in less than 24 hours.
> 
> Now, what a professional and responsible post.  I normally don't reply 
> to these emails, but this person has misrepresented the communications 
> we had with him.  It makes me not want to communicate with people that 
> report security flaws.  If I had known he would use my words out of 
> context this way, I would have just released the new version and ignored 
> his email.
> 
> "Scott" clearly has another agenda here.  That is to discredit 
> applications and promote interests of his own.  The mention of IPB 
> specifically makes that clear.
> 
> Brian Moon
> Phorum Dev Team
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> 

I commend you and your team on resolving the issues in a timely manner.

I do not believe I misrepresented any of the communications between us, 
and I don't think I took anything out of context. I quoted what was said 
is all.

If my "agenda" is to help you and your development team by not only 
alerting you of the problem, but offering up possible solutions to 
remedy the issues, then you're probably right. But to say that I'm 
trying to discredit your application and promote interests of my own 
(IPB is not an interest of mine) is wrong.

Perhaps we should take this off-list, there's no sense in debating it 
here.. no sense in debating this at all even, nobody cares.