full-disclosure - Re: ZDI-08-034: HP StorageWorks Storage Mirroring Authentication Processing Stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <BAY109-W56FC710DF4F779773100DC95B50@phx.gbl>
Date: Wed, 4 Jun 2008 16:08:02 -0400
From: "M. Shirk" <shirkdog_list@...mail.com>
To: <bugtraq@...urityfocus.com>, <full-disclosure@...ts.grok.org.uk>,
	<cert@...t.org>
Subject: Re: ZDI-08-034: HP StorageWorks Storage Mirroring
 Authentication Processing Stack


I need to go to your site and take one of your other bugs so I can GET PAID!!

:)

Shirkdog
' or 1=1-- 

http://www.shirkdog.us

> Date: Wed, 4 Jun 2008 21:24:46 +0100
> From: aluigi@...istici.org
> To: bugtraq@...urityfocus.com; full-disclosure@...ts.grok.org.uk; cert@...t.org
> Subject: Re: [Full-disclosure] ZDI-08-034: HP StorageWorks Storage Mirroring Authentication Processing Stack Overflow Vulnerability
> 
> > During the handling of an encoded authentication request, the process
> > copies the user-supplied login information into a fixed length stack
> > buffer
> 
> This one seems exactly the same vulnerability I disclosed in February
> 2008 and for which I wrote also a testing attack (number 7) in my
> doubletakedown proof-of-concept:
> 
>   http://aluigi.org/adv/doubletakedown-adv.txt
> 
> Anyway it's an old version of Double-Take so should be not considered,
> in fact I mentioned that old bug in my advisory only for thoroughness
> but without the minimal consideration since the bug was already
> found and patched by the same vendor (Double-Take, not HP).
> 
> 
> --- 
> Luigi Auriemma
> http://aluigi.org
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_________________________________________________________________
Instantly invite friends from Facebook and other social networks to join you on Windows Live™ Messenger.
https://www.invite2messenger.net/im/?source=TXT_EML_WLH_InviteFriends
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/