Re: Vulnerabilities in Sebo - webstore



On 11 May 2010 01:47, MustLive <mustlive@xxxxxxxxxxxxxxxxxx> wrote:

In my letter to Bugtraq (http://www.securityfocus.com/archive/1/511023),
which was mentioned in my advisory (you can read that letter, if you didn't
read it yet), I wrote about importance of making separate advisories of
vulnerabilities in software which are using CaptchaSecurityImages.php.

If you found a security flaw in a script written by "Babbaleo" and
this script is used by many web application, you don't must send an
email for each application that use it because the hole isn't of the
application. This email and not 'a reproach to you but to all those
who adopt this method (For example the arbitrary file upload
"vulnerability" found in any applications that use a misconfigured
fckeditor or only reflected XSS) .

I and my other in this list do not believe that these bugs are very
critical for the target web application, but in any way if you find a
bug in a used script, you can contact the developer(s) or the
mainteiner(s) of the web application that use it, reporting a warning,
without write any time an email to bugtraq o to other security
mailinglist.

All in this list are understand that there are bugs in
CaptchaSecurityImages.php. If we are using this script, we'll fix the
bugs, stop. There is no need to know all the web applications that use
this "vulnerable" script.

I propose again to you my question: if you find (ad absurdum) a bug
in the printf C function, will you send an e-mail for each software
that uses it?

A friendly advice for the future: more information about the bugs and
fewer links to your site.

--
Salvatore Fresta aka Drosophila
http://www.salvatorefresta.net
CWNP444351



Relevant Pages

  • Re: [2.6.27] filesystem (ext3) corruption (access beyond end)
    ... Ok I ran several disk-intensive jobs (git clone, kernel build, apt-get dist-upgrade) ... but none of those could trigger any bugs. ... BUT, running my http://vanheusden.com/pyk/ script, I definately can trigger the ...
    (Linux-Kernel)
  • smatch and tun.c
    ... One just looks for bugs where a variable is ... dereferenced while initializing a local variable and checked for NULL like ... This script printed 96 warnings. ... Smatch scripts tends to have a lot of false positives. ...
    (Linux-Kernel)
  • Re: php unserialize
    ... Bytes into a properly allocated memory block. ... >FOR SOME STRANGE REASONS HARDENED-PHP.NET HAS RELEASED THIS ADVISORY TODAY TOGETHER WITH A BUNCH OF OTHER VULNERABILITIES ... Hardened-PHP has released an advisory about bugs in unserialize. ...
    (Bugtraq)
  • Fw: Re: [2.6.27] filesystem (ext3) corruption (access beyond end)
    ... Ok I ran several disk-intensive jobs (git clone, kernel build, apt-get dist-upgrade) ... but none of those could trigger any bugs. ... BUT, running my http://vanheusden.com/pyk/ script, I definately can trigger the ...
    (Linux-Kernel)
  • Re: Is this a good idea?
    ... you risk introducting bugs into ... in memory - induces lazyness in the programmers. ... >> few MB per script, ... Sometimes it does not - sometimes, due to lazy programming or bad DB design, ...
    (comp.lang.php)