Advisory: TCP-Connection risk in DB4Web

From: Stefan.Bagdohnat_private
Date: Tue Sep 17 2002 - 05:44:17 PDT

Next message: Jason A. Fager: "Re: nidump on OS X"

Previous message: Abraham Lincoln: "NSSI-2002-sygatepfw5: Sygate Personal Firewall IP Spoofing Vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi all. It's me again.
The application server DB4Web is able to initiate TCP connections to
arbitrary ports/IPs and can possibly misused as a portscanner. Please see
the attached advisory for deatils and vendors statement.
regards,
 Stefan

text/plain attachment: guardadv-02-2002-db4web-tcp-connect-bug.release.txt

Next message: Jason A. Fager: "Re: nidump on OS X"
Previous message: Abraham Lincoln: "NSSI-2002-sygatepfw5: Sygate Personal Firewall IP Spoofing Vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Sep 18 2002 - 08:43:17 PDT