full-disclosure - Re: nVidia.com [Url Redirection flaw]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <49CBBE6B.27595.4F6A3563@nick.virus-l.demon.co.uk>
Date: Thu, 26 Mar 2009 17:42:03 +1300
From: Nick FitzGerald <nick@...us-l.demon.co.uk>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: nVidia.com [Url Redirection flaw]

Rubén Camarero wrote:

> What great references. Owasp isn't the king of vulnerability information, of
> course a website named XSSed is going to count this as super serious, and
> while I respect Insecure.. these days, people have exploited web bugs to
> their max (and I'm waiting for more), but they aren't directly serious.
> DIRECTLY is the key word.

No, but just because this kind of vulnerability is "only" indirectly 
serious dosen't mean that they aren't serious.

Just because _you_ are too dim to imagine a way that someone can profit 
significantly from exploiting this does not mean that there are not such 
methods, NOR that use of such exploits won't "damage" nVidia.

Whether nVidia (and others affected by so many similar vulnerabilities) 
will see this and decide to take action is what really matters.  In this 
regard, I certainly hope that you do not work for, or consult with, or 
otherwise represent the view of nVidia on this issue.

Regards,

Nick FitzGerald

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/