lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <65773948.20070504011315@SECURITY.NNOV.RU>
Date: Fri, 4 May 2007 01:13:15 +0400
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: Tim Brown <timb@...-dimension.org.uk>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	news@...uriteam.com
Subject: Re: Medium security hole affecting DSL-G624T

Dear Tim Brown,

This  vulnerability  for  D-Link  DSL-G624T was already reported by Jose
Ramon Palanco. See

http://securityvulns.ru/Odocument816.html

Previously, same problem was reported for D-Link DSL-G604T by Qex

http://securityvulns.ru/Mdocument578.html


There were also few more problems reported about /cgi-bin/webcm, see

http://securityvulns.ru/Idocument664.html
http://securityvulns.ru/Idocument759.html



--Thursday, May 3, 2007, 2:43:58 AM, you wrote to news@...uriteam.com:

TB> Hi,

TB> I've identified a couple of security flaws affecting the DSL-G624T firmware.
TB> I believe the directory traversal issue has been reported in other devices /
TB> firmware versions supplied by D-Link but not the combination I tested and
TB> clearly has not been resolved.  Additionally, the Javascript injection issue
TB> is I believe new and has not been reported on any device.

TB> These issues were reported by email to the vendor at the usual addresses
TB> (support/security/etc) without response on 13th April 2007.  I also attempted
TB> to log faults on the vendors support web site but sadly, it would not
TB> function adequately using either Firefox nor Konqueror.

TB> Tim


-- 
~/ZARAZA http://securityvulns.com/
Åñëè äàæå âû ïîëó÷èòå êàêîå-íèáóäü ïèñüìî, âû âñå ðàâíî íå ñóìååòå åãî ïðî÷èòàòü. (Òâåí)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ