Re: ZDI-08-034: HP StorageWorks Storage Mirroring Authentication Processing Stack

["M. Shirk" <shirkdog_list () hotmail com>]

I need to go to your site and take one of your other bugs so I can GET PAID!!

:)

Shirkdog
' or 1=1-- 

http://www.shirkdog.us

> Date: Wed, 4 Jun 2008 21:24:46 +0100
> From: aluigi () autistici org
> To: bugtraq () securityfocus com; full-disclosure () lists grok org uk; cert () cert org
> Subject: Re: [Full-disclosure] ZDI-08-034: HP StorageWorks Storage Mirroring Authentication Processing Stack Overflow 
> Vulnerability
>
> > During the handling of an encoded authentication request, the process
> > copies the user-supplied login information into a fixed length stack
> > buffer
>
> This one seems exactly the same vulnerability I disclosed in February
> 2008 and for which I wrote also a testing attack (number 7) in my
> doubletakedown proof-of-concept:
>
>   http://aluigi.org/adv/doubletakedown-adv.txt
>
> Anyway it's an old version of Double-Take so should be not considered,
> in fact I mentioned that old bug in my advisory only for thoroughness
> but without the minimal consideration since the bug was already
> found and patched by the same vendor (Double-Take, not HP).
>
>
> --- 
> Luigi Auriemma
> http://aluigi.org
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_________________________________________________________________
Instantly invite friends from Facebook and other social networks to join you on Windows Live™ Messenger.
https://www.invite2messenger.net/im/?source=TXT_EML_WLH_InviteFriends

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/