Re: [Full-disclosure] SSH brute force blocking tool

That specially crafted attempt would be a HUGE raping of TCP/IP. How do
you supposed it would be possible for someone to insert 0wn3ed or any
other variable outside of an IP address?

Remember the (in)famous quote "...that vulnerability is purely
theoretical..."?

I think the point is you don't use $language to split a bunch of fields,
and then pipe them back through /bin/sh without making sure they're not
malicious.

Doesn't matter that you can't think of a way to make them malicious ..
somebody else will find one. It's safer to just assume it'll happen and
always sanitize variables before you {do_stuff;} with them.

(my $0.02)

~Mike.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages