full-disclosure - Re: Tikiwiki 1.9.8 exploit ITW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20071012130835.87B34DA827@mailserver7.hushmail.com>
Date: Fri, 12 Oct 2007 09:08:35 -0400
From: <full-disclosure@...hmail.com>
To: <security@...itz-naumann.com>,<3apa3a@...urity.nnov.ru>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: Tikiwiki 1.9.8 exploit ITW

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SHUT UP VLADIS THE PIG

On Fri, 12 Oct 2007 06:23:02 -0400 3APA3A <3APA3A@...URITY.NNOV.RU>
wrote:
>Dear Moritz Naumann,
>
>This  vulnerability  was  found  by  ShAnKaR
>
>http://securityvulns.ru/Sdocument162.html
>
>and   reported   on  Bugtraq  yesterday  (see  "Vulnerabilities
>digest"
>message). TikiWiki developers were informed on October, 8.
>
>--Friday, October 12, 2007, 1:20:06 AM, you wrote to full-
>disclosure@...ts.grok.org.uk:
>
>
>MN> Disabling url_fopen() or denying access to tiki-
>graph_formula.php for
>MN> unauthenticated users will prevent your site from being
>exploited.
>
>MN> I've notified the developers.
>
>MN> If, what it says on http://dev.tikiwiki.org/Security is up to
>date (i.e.
>MN> unfixed security issues of high priority initially reported 9
>months
>MN> ago), then you really should not use this software.
>
>--
>~/ZARAZA http://securityvulns.com/
>Человек это тайна... я занимаюсь этой тайной чтобы быть человеком.
>(Достоевский)
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcPcdMACgkQ+dWaEhErNvSBmQP/YyKViYrNIFmSJMwLKogC7aey9IkI
FWfpKxLHIncZ5RVkEsOZbdj6gRDua1+L05oSuCKzKxkz77BVjZG3gCmEO9n0na9Ac7GF
4suxGSRnkXjn5uIIHJS+o7E0PgyaT5Vpos/210JAY0AI0jn8o53F2l+0WFFPmMUv3UPS
pMn8fYk=
=RkFL
-----END PGP SIGNATURE-----


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/