[VulnDiscuss] Re: Xeneo Webserver Vulnerability
"badpack3t" <[email protected]>
| Newsgroups | gmane.comp.security.vulnerabilities.watch.general,gmane.comp.security.full-disclosure,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <[email protected]> |
Tamer, You may want to correct yourself. You discovered http://target/% on an OLD (Xeneo 2.1.0.0 (PHP version) and 2.0.759.6 are vulnerable.) version. I found a different bug in there latest version (which was 2.2.9.0. at the time) by requesting a GET / with 4096 ?'s. Now how would this be the same as you released? Care to explain? --------------------------- -badpack3t www.security-protocols.com --------------------------- > Hi Folks, > > I contributed the vulnurability about Xeneo Webserver, mentioned below, > to iDefense on 4th, November 2002. All rights on this vulnurability > belongs to me and iDefense. > > Craps, > http://lists.netsys.com/pipermail/full-disclosure/2003-April/009371.html > http://lists.netsys.com/pipermail/full-disclosure/2003-April/009386.html > > My Advisories at iDefense, > http://www.idefense.com/advisory/11.04.02b.txt > > Please, without searching well, do not publish these kind of advisories. > > Cheers, > > Tamer Sahin > http://www.securityoffice.net