--k4f25fnPtRuIRUb3
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Fri, Jun 28, 2013 at 12:47:46AM +0100, Vulnerability Lab wrote:
<snip>
> (Copy of the Vendor Homepage: http://www.barracudanetworks.ca/cudatel.asp=
x )
What?
> Report-Timeline:
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> 2012-11-26: Researcher Notification & Coordination (Chokri Ben Achour)
> 2012-11-27: Vendor Notification (Barracuda Networks Security Team - Bug B=
ounty Program)
> 2013-04-03: Vendor Response/Feedback (Barracuda Networks Security Team - =
Bug Bounty Program)
> 2013-05-02: Vendor Fix/Patch (Barracuda Networks Developer Team) [Coordin=
ation: Dave Farrow]
> 2012-06-00: Public Disclosure (Vulnerability Laboratory)
What?
> Vulnerable Section(s):
> [+] Find Me
>=20
> Vulnerable Module(s):
> [+] Call Forwarding - Add
>=20
> Vulnerable Parameter(s):
> [+] Calling Sequence - Listing
What?
Do you hit some "send advisory" -button in your web page without checking t=
he
details? Why don't you just include PoC?
---
Henri Salo
--k4f25fnPtRuIRUb3
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlHNPiMACgkQXf6hBi6kbk9SUACfbJPVuPvZoPsR8SbJ1fJuEUhq
j+4An33ahOKvdPq0VNA1QsE6KtrXYcAe
=g+ur
-----END PGP SIGNATURE-----
--k4f25fnPtRuIRUb3--