Re: [cobalt-users] Openwebmail 1.71 exploit... fixed

["Bill Gibbs" <bgibbs@xxxxxxxxxxxxx>]

I patched it and it all works fine as well.  Thanks!

Bill "Elvis" Gibbs
Eduro Technologies, Inc.
main 240-529-2000 | fax 301-662-9552 | cell 301-748-5418


----- Original Message ----- 
From: "Gerald Waugh" <gwaugh@xxxxxxxxxxxxxxxxxxxxxxx>
To: "cobalt-users" <cobalt-users@xxxxxxxxxxxxxxx>
Sent: Monday, December 23, 2002 11:01 AM
Subject: [cobalt-users] Openwebmail 1.71 exploit... fixed


> 
> http://online.securityfocus.com/archive/1/303997
> 
> I patched mine and it works OK
> 
>     135   $loginname =~ s/\-session\-0.*$//; # Grab loginname from
> sessionid
>     136 ### security fix patch 12/22/2002 GW added this line
>     137   $loginname =~ s/[\.\/\;\|\'\"\`\&]//g;
>     138 ###
> 
> Thanks for the heads-up Bruce.
> 
> 
> Gerald
> --
> http://frontstreetnetworks.com | http://raqware.com
> Front Street Networks LLC  | Phone: +1 203-785-0699
> 229 Front Street, Ste. C, New Haven, CT. 06513-3203
> 
> 
> _____________________________________
> cobalt-users mailing list
> cobalt-users@xxxxxxxxxxxxxxx
> To subscribe/unsubscribe, or to SEARCH THE ARCHIVES, go to:
> http://list.cobalt.com/mailman/listinfo/cobalt-users
>