On 11 May 2010 01:47, MustLive <mustlive@xxxxxxxxxxxxxxxxxx> wrote: > > In my letter to Bugtraq (http://www.securityfocus.com/archive/1/511023), > which was mentioned in my advisory (you can read that letter, if you didn't > read it yet), I wrote about importance of making separate advisories of > vulnerabilities in software which are using CaptchaSecurityImages.php. If you found a security flaw in a script written by "Babbaleo" and this script is used by many web application, you don't must send an email for each application that use it because the hole isn't of the application. This email and not 'a reproach to you but to all those who adopt this method (For example the arbitrary file upload "vulnerability" found in any applications that use a misconfigured fckeditor or only reflected XSS) . I and my other in this list do not believe that these bugs are very critical for the target web application, but in any way if you find a bug in a used script, you can contact the developer(s) or the mainteiner(s) of the web application that use it, reporting a warning, without write any time an email to bugtraq o to other security mailinglist. All in this list are understand that there are bugs in CaptchaSecurityImages.php. If we are using this script, we'll fix the bugs, stop. There is no need to know all the web applications that use this "vulnerable" script. I propose again to you my question: if you find (ad absurdum) a bug in the printf C function, will you send an e-mail for each software that uses it? A friendly advice for the future: more information about the bugs and fewer links to your site. -- Salvatore Fresta aka Drosophila http://www.salvatorefresta.net CWNP444351
