Re: Vulnerabilities in Sebo - webstore

[Salvatore Fresta aka Drosophila <drosophilaxxx () gmail com>]

On 11 May 2010 01:47, MustLive <mustlive () websecurity com ua> wrote:
> In my letter to Bugtraq (http://www.securityfocus.com/archive/1/511023),
> which was mentioned in my advisory (you can read that letter, if you didn't
> read it yet), I wrote about importance of making separate advisories of
> vulnerabilities in software which are using CaptchaSecurityImages.php.

If you found a security flaw in a script written by "Babbaleo" and
this script is used by many web application, you don't must send an
email for each application that use it because the hole isn't of the
application. This email and not 'a reproach to you but to all those
who adopt this method (For example the arbitrary file upload
"vulnerability" found in any applications that use a misconfigured
fckeditor or only reflected XSS) .

I and my other in this list do not believe that these bugs are very
critical for the target web application, but in any way if you find a
bug in a used script, you can contact the developer(s) or the
mainteiner(s) of the web application that use it, reporting a warning,
without write any time an email to bugtraq o to other security
mailinglist.

All in this list are understand that there are bugs in
CaptchaSecurityImages.php. If we are using this script, we'll fix the
bugs, stop. There is no need to know all the web applications that use
this "vulnerable" script.

I propose again to you my question:  if you find (ad absurdum) a bug
in the printf C function, will you send an e-mail for each software
that uses it?

A friendly advice for the future: more information about the bugs and
fewer links to your site.

-- 
Salvatore Fresta aka Drosophila
http://www.salvatorefresta.net
CWNP444351