Full Disclosure mailing list archives
Re: sourceforge entry point seems still active.
From: exploit dev <extraexploit () gmail com>
Date: Tue, 25 Jan 2011 21:18:25 +0100
Hi Andrew, just a reminder: this breach was used by php/python/perl script for get and save on user directory bot and remote shell. Also you could, as reported also in owned and exposed zine, launch commands and attempt privilege escalation. So I'm not so sure that this is not so writable as well i think is not right sayd that is not critical. Regards-. On Tue, Jan 25, 2011 at 8:47 PM, Andrew Farmer <andfarm () gmail com> wrote:
On 2011-01-24, at 12:08, exploit dev wrote:Anyway, I'm sorry repeat my message. I think that this issue is a bit critical but I don't receive still any feedback,It's not particularly critical by any means. SourceForge projects all have their own web space, and there are doubtless a bunch of them running vulnerable versions of software. These sites are relatively isolated, and don't have write access to the project's SCM or downloads.
-- http://extraexploit.blogspot.com
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- sourceforge entry point seems still active. exploit dev (Jan 22)
- Re: sourceforge entry point seems still active. exploit dev (Jan 25)
- Re: sourceforge entry point seems still active. Jeffrey Walton (Jan 25)
- Re: sourceforge entry point seems still active. exploit dev (Jan 25)
- Re: sourceforge entry point seems still active. Andrew Farmer (Jan 25)
- Re: sourceforge entry point seems still active. exploit dev (Jan 25)
- Re: sourceforge entry point seems still active. exploit dev (Jan 28)
- Re: sourceforge entry point seems still active. Sal Rinder (Jan 31)
- Re: sourceforge entry point seems still active. exploit dev (Jan 30)
- Re: sourceforge entry point seems still active. wac (Jan 30)
- Re: sourceforge entry point seems still active. Jeffrey Walton (Jan 25)
- Re: sourceforge entry point seems still active. exploit dev (Jan 25)