Re: local Calendar System v1.1 (lcStdLib.inc) Remote File Include

["Steven M. Christey" <coley () mitre org>]

On Mon, 29 Jan 2007, Simple Nomad wrote:
> On Mon, 2007-01-29 at 13:00 -0600, Gadi Evron wrote:
> > How can we all automate the testing process for fake vulns in and
list
> > them as such without overburdening OSVDB, CVE, Milworm and SecuriTeam?
>
> How about letting them get posted to bugtraq as ppl test them out
> anyway?

If it's rejected from Bugtraq, it will just get posted to other
channels that are monitored anyway, so it would just be shifting the
problem around.

Now that there's greater awareness about this common error, we're
seeing a lot more people trying to verify the reports, especially for
RFI.  So, thanks to everyone out there.  Things like nested includes,
extract(), and dynamic variable evaluation can make post-disclosure
analysis even more difficult, as we saw in one long Bugtraq thread
recently.  But these disputes definitely help.

- Steve