[14002] in bugtraq
Re: A.L.E.R.T.: BigMailBox.com href tokens leave mailboxes open
daemon@ATHENA.MIT.EDU (Cancer Omega)
Thu Feb 24 14:46:29 2000
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-Id: <Pine.LNX.3.96.1000223105910.17003A-100000@forced.attrition.org>
Date: Wed, 23 Feb 2000 11:03:23 -0700
Reply-To: Cancer Omega <comega@ATTRITION.ORG>
From: Cancer Omega <comega@ATTRITION.ORG>
X-To: Jim Paris <jim@jtan.com>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <20000223060411.A10581@jtan.com>
On Wed, 23 Feb 2000, Jim Paris wrote:
> > BigMailBox.com was notified of the problem on Fri, 11 Feb 2000. After
> > additional testing and verification, staff of BigMailBox.com patched
> > the vulnerability on Mon, 14 Feb 2000.
> ...
> > Contact BigMailBox and complain about shoddy and insecure e-mail access.
>
> They patched the hole in 3 days (over a weekend, no less!). I don't
> think that demands mass complaints about "shoddy and insecure"
> e-mail. They seem to have been very responsible about the bug.
The fix did not occur three days following notification. After posting
our notice, we were notified by another Bugtraq subscriber that said
vulnerability had been previously posted to Bugtraq over a *month* ago.
(Yeah, we missed that, but so did BigMailBox.)
.c
