serious security hole

frog-man · Post by **frog-man** » Sun May 23, 2004 11:57 pm

Please contact me about a serious security hole in Serendipity v 6.0 pl1.
Here is a fix for this vulnerability :

url-removed until patch is released

Post by **garvinhicking** » Mon May 24, 2004 12:59 am

Thanks for you note.

However a serious and upright bug reporter would FIRST inform the developers PRIVATELY, and after THEY have published a fix you can tell about the vulnerability. That's the way it works with nearly all honest opensource-vulnerability reports. It's sad to see which way you went without giving us the ability or time to take the right actions.

Of course we will release a 0.6-pl2 version shortly.

frog-man · Post by **frog-man** » Mon May 24, 2004 1:16 am

I know what should make a "serious bug reporter" but a "serious webmaster" should allow the bug reporters to contact him privately.
When I click on "contact", I've 3 choices :
- Mailing list (not private)
- IRC (nobody!)
- Forums (here I am)

I haven't explain the vulnerability, and I'm waiting for a mail or a private message like I said in my previous post.

Post by **garvinhicking** » Mon May 24, 2004 1:30 am

frog-man wrote:I know what should make a "serious bug reporter" but a "serious webmaster" should allow the bug reporters to contact him privately.
When I click on "contact", I've 3 choices :
- Mailing list (not private)
- IRC (nobody!)
- Forums (here I am)

Look at s9y.org, our wiki. There are the developers, most with personal webpages which you could have contacted.

You could have looked on our mailinglist and asked there. Or just look at the developers posting there, they do have mail adresses.

You could have looked at our sourceforge-account, the lead developers are listed there with the ability to send them a message.

You could have sent a personal message to me or others through this forum.

The basic thing is, you shouldn't have posted the link on your homepage without trying to contact us seriously. The patch there explains exactly what the vulernability is, so everyone already knows what the case is. If you have anything to add, you can point your mail client to 'serendipity at supergarv dot de'.

BTW, that only applies to server with Register_Globals set to On, a setting which is suggested since PHP 4.1.0, so I do hope it's only a medium priority issue on well-hosted webservers. Of course there's no talking about the bug itself and that it shouldn't be inside of s9y.

Regards,
Garvin.

frog-man · Post by **frog-man** » Mon May 24, 2004 1:43 am

Well, I could also do nothing !
I don't use your product and I do this for free !
Please don't forget it...
But I'm not like that and I'll thus contact you by mail.
Sorry for my poor english.

Post by **garvinhicking** » Mon May 24, 2004 2:02 am

Please don't reverse the situation - of course we do very much appreciate your effort on helping us and fixing the bug. It's just that there are some things to pay attention to when doing so; especially as I see you have experience with reporting bugs on your site.

I'm sorry if I may sound rude, I just think there are common ways of reportung security issues, and it didn't went that way...

Best regards, and we're working on it.

Garvin.

frog-man · Post by **frog-man** » Mon May 24, 2004 12:27 pm

No problem I understand very well.

Maybe I want to work too fast so I don't make the most I could

Good work

frog

serious security hole

serious security hole

Re: serious security hole

hum

Re: hum

hum

Re: hum

plop