oss-security - Re: Nginx ngx_http_close_connection function integer overflow

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130426054841.GF23082@nef.pbox.org>
Date: Fri, 26 Apr 2013 07:48:41 +0200
From: Alistair Crooks <agc@...src.org>
To: oss-security@...ts.openwall.com, kseifried@...hat.com
Cc: gremlin@...mlin.ru
Subject: Re: Nginx ngx_http_close_connection function integer
 overflow - can anyone confirm this?

On Thu, Apr 25, 2013 at 11:36:17PM -0600, Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> - From Bugtraq:
> 
> http://www.securityfocus.com/archive/1/526439/30/0/threaded
> 
> Website: http://safe3.com.cn

Is this legit?

I downloaded the index.html file with curl, and embedded around line 87
was a flash file:

<table width="930" border="0" align="center" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF">
<tr><td>
<object type="application/x-shockwave-flash" data="/banner.swf?xml=/banner.xml" width="930" height="180">
<param name="movie" value="/banner.swf?xml=/banner.xml"/>
</object>
</td></tr>
<tr>

so I took it to be an attempt at phishing.

Maybe I'm just too paranoid in my old age?

Regards,
Alistair

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.