Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Full-disclosure] Re: ZH2005-03SA -- multiple vulnerabilities in NukeBookmarks .6
From: Astharot (astharotzone-h.org)
Date: Wed Mar 30 2005 - 17:00:52 CST
Paul Laudanski wrote...
> I can understand how full path disclosure can be an issue, however, in
> a production environment the PHP settings to display errors ought to
> be disabled. As such, full path disclosure goes away.
> That is true if the default table names are used. However it would be
> worth noting that with any web presence that uses a backend database,
> prefix ought to be changed to something random and non-default.
> Does this completely solve the issue, of course not, but it can stop
> the script kiddy attacks. For more on this:
> Thanks for the disclosure.
So, noone should publish any buffer overflow vulnerability... the stack
protection in Windows SP2 and grsecurity can solve every problem...
Gerardo Di Giacomo
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/