Re: [Full-disclosure] ZDI-08-034: HP StorageWorks Storage Mirroring Authentication Processing Stack

["M. Shirk" <shirkdog_list@xxxxxxxxxxx>]

I need to go to your site and take one of your other bugs so I can GET PAID!!

:)

Shirkdog
' or 1=1-- 

http://www.shirkdog.us

> Date: Wed, 4 Jun 2008 21:24:46 +0100
> From: aluigi@xxxxxxxxxxxxx
> To: bugtraq@xxxxxxxxxxxxxxxxx; full-disclosure@xxxxxxxxxxxxxxxxx; 
> cert@xxxxxxxx
> Subject: Re: [Full-disclosure] ZDI-08-034: HP StorageWorks Storage Mirroring 
> Authentication Processing Stack Overflow Vulnerability
> 
> > During the handling of an encoded authentication request, the process
> > copies the user-supplied login information into a fixed length stack
> > buffer
> 
> This one seems exactly the same vulnerability I disclosed in February
> 2008 and for which I wrote also a testing attack (number 7) in my
> doubletakedown proof-of-concept:
> 
>   http://aluigi.org/adv/doubletakedown-adv.txt
> 
> Anyway it's an old version of Double-Take so should be not considered,
> in fact I mentioned that old bug in my advisory only for thoroughness
> but without the minimal consideration since the bug was already
> found and patched by the same vendor (Double-Take, not HP).
> 
> 
> --- 
> Luigi Auriemma
> http://aluigi.org
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_________________________________________________________________
Instantly invite friends from Facebook and other social networks to join you on 
Windows Live™ Messenger.
https://www.invite2messenger.net/im/?source=TXT_EML_WLH_InviteFriends

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/