Full Disclosure mailing list archives
Re: Tikiwiki 1.9.8 exploit ITW
From: <full-disclosure () hushmail com>
Date: Fri, 12 Oct 2007 09:08:35 -0400
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SHUT UP VLADIS THE PIG On Fri, 12 Oct 2007 06:23:02 -0400 3APA3A <3APA3A () SECURITY NNOV RU> wrote:
Dear Moritz Naumann, This vulnerability was found by ShAnKaR http://securityvulns.ru/Sdocument162.html and reported on Bugtraq yesterday (see "Vulnerabilities digest" message). TikiWiki developers were informed on October, 8. --Friday, October 12, 2007, 1:20:06 AM, you wrote to full- disclosure () lists grok org uk: MN> Disabling url_fopen() or denying access to tiki- graph_formula.php for MN> unauthenticated users will prevent your site from being exploited. MN> I've notified the developers. MN> If, what it says on http://dev.tikiwiki.org/Security is up to date (i.e. MN> unfixed security issues of high priority initially reported 9 months MN> ago), then you really should not use this software. -- ~/ZARAZA http://securityvulns.com/ Человек это тайна... я занимаюсь этой тайной чтобы быть человеком. (Достоевский) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Charset: UTF8 Version: Hush 2.5 wpwEAQECAAYFAkcPcdMACgkQ+dWaEhErNvSBmQP/YyKViYrNIFmSJMwLKogC7aey9IkI FWfpKxLHIncZ5RVkEsOZbdj6gRDua1+L05oSuCKzKxkz77BVjZG3gCmEO9n0na9Ac7GF 4suxGSRnkXjn5uIIHJS+o7E0PgyaT5Vpos/210JAY0AI0jn8o53F2l+0WFFPmMUv3UPS pMn8fYk= =RkFL -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Tikiwiki 1.9.8 exploit ITW Moritz Naumann (Oct 11)
- Re: Tikiwiki 1.9.8 exploit ITW 3APA3A (Oct 12)
- <Possible follow-ups>
- Re: Tikiwiki 1.9.8 exploit ITW full-disclosure (Oct 12)