Re: qDefense Advisory: DCForum allows remote read/write/execute

From: Franklin DeMatto (franklinat_private)
Date: Tue Apr 17 2001 - 07:20:09 PDT

Next message: Dan Astoorian: "Re: Solaris ipcs vulnerability"

Previous message: Richard M. Smith: "Re: [SX-20010320-2] - Microsoft ISA Server Denial of Service"
In reply to: Wolfgang Wiese: "Re: qDefense Advisory: DCForum allows remote read/write/execute"
Next in thread: adminat_private: "Re: qDefense Advisory: DCForum allows remote read/write/execute"
Reply: adminat_private: "Re: qDefense Advisory: DCForum allows remote read/write/execute"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Sorry for not clarifying.  This is another vulnerability.  The patch made
DOES NOT fix this vulnerability.
The CGISecurity hole only allowed read, not execute, and the patch did not
affect the az field.



At 11:07 AM 4/17/01 +0200, Wolfgang Wiese wrote:
>Hi,
>
> > Version Tested: DCForum 2000 1.0
> > Severity: Any remote attacker may gain read/write/execute privilleges
>
>
>Isn't that the same security-leak CGISecurity (http://www.CGISecurity.com/)
>reportet Nov 2000 about?
>
>Moreover the current version of DCForum is 6.1. The security-leak was
>affecting versions 1.0 - 6.0 and was patched by DCScripts on
>March, 31. (http://www.dcscripts.com/FAQ/sec_2001_03_31.html)
>
>Ciao,
>   Wolfgang
>
>
>--
>______________________________________________________________________
>   Dipl. Inf. Wolfgang Wiese                   XWolf CGI & Webworking
>   xwolfat_private                               http://www.xwolf.com
>______________________________________________________________________
>             PGP-key: http://www.xwolf.com/public-key.txt

Next message: Dan Astoorian: "Re: Solaris ipcs vulnerability"
Previous message: Richard M. Smith: "Re: [SX-20010320-2] - Microsoft ISA Server Denial of Service"
In reply to: Wolfgang Wiese: "Re: qDefense Advisory: DCForum allows remote read/write/execute"
Next in thread: adminat_private: "Re: qDefense Advisory: DCForum allows remote read/write/execute"
Reply: adminat_private: "Re: qDefense Advisory: DCForum allows remote read/write/execute"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Apr 17 2001 - 12:55:37 PDT