bugtraq - Re: local Calendar System v1.1 (lcStdLib.inc) Remote File Include

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 3 Feb 2007 18:38:08 -0500 (EST)
From: "Steven M. Christey" <coley@...re.org>
To: bugtraq@...urityfocus.com
Subject: Re: local Calendar System v1.1 (lcStdLib.inc) Remote File Include

On Mon, 29 Jan 2007, Simple Nomad wrote:
> On Mon, 2007-01-29 at 13:00 -0600, Gadi Evron wrote:
> > How can we all automate the testing process for fake vulns in and
list
> > them as such without overburdening OSVDB, CVE, Milworm and SecuriTeam?
>
> How about letting them get posted to bugtraq as ppl test them out
> anyway?

If it's rejected from Bugtraq, it will just get posted to other
channels that are monitored anyway, so it would just be shifting the
problem around.

Now that there's greater awareness about this common error, we're
seeing a lot more people trying to verify the reports, especially for
RFI.  So, thanks to everyone out there.  Things like nested includes,
extract(), and dynamic variable evaluation can make post-disclosure
analysis even more difficult, as we saw in one long Bugtraq thread
recently.  But these disputes definitely help.

- Steve