Re: [oss-security] Multiple SQL Injection vulnerabilities in Disk Pool Manager (DPM)

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/10/2013 12:17 AM, Adam Zabrocki wrote:
> Name:                 Multiple SQL Injection vulnerabilities in 
> Disk Pool Manager (DPM) Author:               Adam Zabrocki
> (<pi3 () pi3 com pl>) Date:                 November 27, 2009 (Yes,
> it's very old bug ;P)
>
> Timeline
>
> 2009-11-27 - Found vulnerability. 2011-08-03 - Vulnerability
> officialy reported. 2013-02-19 - Updated packages available in the
> EGI UMD-1 and EGI UMD-2. 2013-03-05 - Public disclosure on vendor's
> wiki, after allowing sites to upgrade 
> (https://wiki.egi.eu/wiki/SVG:Advisory-SVG-2012-2683) 2013-03-10 -
> Release of this advisory.
>
>
>
> Best regards, Adam Zabrocki
>
> -- http://pi3.com.pl

I'm curious as to why the 2 year delay? I'm going to go with the date
reported as that is also mentioned in the public advisory, I can't
confirm the 2009 date.

Please use CVE-2011-4970 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRPpXhAAoJEBYNRVNeJnmTWM4QAIXbXji8kHSgx0HRpLSuOORM
EQvjEnKiu65WQxNnDsvde1PIqLMjblG+aKL1ui8lXzqqA1qWmgAKbamQ69BaSzMN
XF1mPsmb7xz+piwUfWUOCJZz/PbOmLBXyp6TRmxOvbne42DC6CBO5mRWmboYLC9k
an1qK3ymSMyf1WHmJGG+6b68WqfhtcH2Q/fKchn7KvpPHgU4+a4zmlmb587q1cf1
UVrMCwr6VWX2Jt/hLs3YP9Phb9DEGKQN/QorieNN9pPe1l5KM5/dB0HWtmD632t3
q44zY4J9cPNHsUcUgrD7iw0q0pYK5Jah72YZjEjPeK29hiBH6BsOtRWcrF5zfUKq
iVifcrNPsaQ2iDn+eU3BYbw/g4EUD3hlqhJ4gYfWUeZQXWfaxBM1wHOupHDQcLUo
GJZZgbpd3nE8rN0Wtc3ZbF0Ht8iv5JiI3ZC6ZXA/R7ff6KfQjeP5ncqkfehPLOYR
sH0arO/Nc/3ek4dtFDYiDCeO1gWNrzx4rZK+ajgtoqMN1zk8I4R5u/3dgmiDirsa
ZHhgcu8XLjBYx/4mmOO09H+ovNZZELGZnHg43HAdcjbG5piUUSB5DhUXYoBMN5QX
LEzBHmppsceuOe3LgbEtjbNX93+nk7Ch8JV8nj03AJo490HFpOUS670PF9nCPGfO
ZKSznOcQlQmvvqUILsaG
=SR7C
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/