full-disclosure - Re: Tikiwiki 1.9.8 exploit ITW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1563290217.20071012142302@SECURITY.NNOV.RU>
Date: Fri, 12 Oct 2007 14:23:02 +0400
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: Moritz Naumann <security@...itz-naumann.com>
Cc: Full Disclosure <full-disclosure@...ts.grok.org.uk>,
	bugtraq@...urityfocus.com
Subject: Re: Tikiwiki 1.9.8 exploit ITW

Dear Moritz Naumann,

This  vulnerability  was  found  by  ShAnKaR

http://securityvulns.ru/Sdocument162.html

and   reported   on  Bugtraq  yesterday  (see  "Vulnerabilities  digest"
message). TikiWiki developers were informed on October, 8.

--Friday, October 12, 2007, 1:20:06 AM, you wrote to full-disclosure@...ts.grok.org.uk:

MN> Disabling url_fopen() or denying access to tiki-graph_formula.php for
MN> unauthenticated users will prevent your site from being exploited.

MN> I've notified the developers.

MN> If, what it says on http://dev.tikiwiki.org/Security is up to date (i.e.
MN> unfixed security issues of high priority initially reported 9 months
MN> ago), then you really should not use this software.

-- 
~/ZARAZA http://securityvulns.com/
Человек это тайна... я занимаюсь этой тайной чтобы быть человеком. (Достоевский)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/