BugTraq
Vulnerability fixed in E-gold Mar 15 2006 10:17PM
3APA3A (3APA3A security nnov ru)
Hello full-disclosure, bugtraq

Netsling (shurik.f_(at)_gmail.com) reported vulnerability in E-gold.

Vulnerability was reported and fixed in E-gold partner payment script.
It was possible to transfer money from E-gold account without
knowledge of AccounID/PassPhrase if user is logged on.

Vulnerability details can be found at
http://bhunter.awardspace.com/vuln-en.html

The most interesting thing here is E-gold reaction:

1. Vendor fixed vulnerability within 24 hours.
2. Vendor decided to reward researcher without any request from his
side.
3. Vendor gave permission to publish vulnerability information.

Just ideal. I hope Microsoft to read this.

Vulnerability was found and reported to E-gold by nestling, Web
software developer from Russia. Please contact him directly, if you
have any questions, because I was only asked to translate and publish
this information.

--
/3APA3A
http://www.security.nnov.ru/

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus