| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 21 Feb 2011 20:20:50 +0200 From: "MustLive" <mustlive@...security.com.ua> To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>, <bugtraq@...urityfocus.com> Subject: Denial of Service vulnerability in Megapolis.Portal Manager Hello list! I want to warn you about Denial of Service vulnerability in Megapolis.Portal Manager. It's commercial CMS from Softline, which in particularly widespread among Ukrainian government sites (including ministry, parliament, two special services and many other web sites). In 2006-2007 I already wrote about multiple vulnerabilities at gov.ua sites on Megapolis.Portal Manager. ------------------------- Affected products: ------------------------- Vulnerable are all versions of Megapolis.Portal Manager. ---------- Details: ---------- Denial of Service (WASC-10): http://site/path/cewolf?img=1&width=10000&height=10000 By using large values in parameter width, height or in both parameters it's possible to consume the whole memory of the server. ------------ Timeline: ------------ 2010.12.24 - announced at my site. 2010.12.25 - informed developers. 2011.02.19 - disclosed at my site. I mentioned about this vulnerability at my site (http://websecurity.com.ua/4788/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists