On Fri, 25 Sep 2009 14:53:52 +1000, Richard Cyrios said: > >> 24/09/2009 Tonight!, the vulnerability goes public and PSIRT is > >> informed. I'd have expected that PSIRT knew about it before... > .... and the world is thrown into chaos via an internal IP being disclosed. Well, in the greater scheme of things, it's not "thrown into chaos" level of bug. It's just information leakage. How serious it *reallu* is depends on what the attacker can do with the info - it tells them an IP and a guess at a subnet that probably has *other* high-value targets on it. Now where it gets *fun* is if you already have a box on the *inside*, but need more recon info on the network layout. At that point, it could become "Well, I pwned a desktop in 192.168.117/24 - but it looks like the *good* stuff may be over in 10.95.12/22."
Attachment:
pgpX_1Ymmzktu.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/