On Sunday 22 April 2007 08:32:35 Youness Alaoui wrote: > Hi, > > I'm a developer and admin of the aMSN project, someone just sent me this > link ( > http://lists.grok.org.uk/pipermail/full-disclosure/2007-April/053912.html > ). > > I just grepped in the source code and that port (31337) is not used by > aMSN, it could be a port used for a profile (as a locking system), in which > case the port is randomly chosen each time, so this is probably just a > fluke, he found the port of his current aMSN instance and used it. > > As I don't have more info, I can't really test this bug and find the real > cause and fix it, so it would be nice to have more info about this. > > Seeing how the user replied on the "Vendor contacted?" tag, I wonder if I > can get any more info on this matter. His sample PoC has an infinite loop so he basically DDoSed that port. -- Life is a game, and if you aren't in it to win, what the heck are you still doing here? -- Linus Torvalds (talking about open source development)
Attachment:
signature.asc
Description: This is a digitally signed message part.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/