full-disclosure - Unu hits Kaspersky

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <eada5e910912130352y2a575c70v40c54a1022796ae8@mail.gmail.com>
Date: Sun, 13 Dec 2009 17:22:36 +0530
From: Pradip Sharma <sharma.pradip@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Unu hits Kaspersky

Unu has done a great job again this time. He should make the Kaspersky known
to this issue before making the vulnerability public. I think he did so. The
site was at risk and so were many users. How these big sites are potentially
vulnerable to different attacks!!

Regards,
Pradip

Unu, who has gained a good deal of attention lately, is known for his
vulnerability disclosures that center on SQL Injection. In his latest
adventures, he returns to a vendor he has targeted in the past, security
software specialist Kaspersky.

In February, Unu went public on HackersBlog and disclosed the SQL Injection
flaws he had discovered on Kaspersky’s USA portal. The flaws, which led to
complete access to users, activation codes, lists of bugs, admins, shopping,
etc., were quickly patched, and Kaspersky was quick to point out that,
“despite their attempts, the hackers were unable to gain access to
restricted information stored on the website. Claims by the hackers
responsible for the attack that they had managed to gain access to user data
are untrue.”

Read more:
http://www.thetechherald.com/article.php/200950/4931/Unu-hits-Kaspersky-a-second-time-with-SQL-Injection-disclosure#ixzz0ZZIWR9U7

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/