I found a 2 serious vulnerabilities!

[STeRoiD]

Hey guys (and girls)!
Yeah i can hardly belive I did that but I found 2 serious vulnerabilities in a popular message board.

The first one allows D.O.S Against the forum, Other allows stealing user accounts.

I dont wanna give too much details and I really need a week or two to study the issue, but I want to know - what is the best way to publish these vulnerabilities?

What should I say to company who make this message board, how much time should I wait until I publish my information outside and which way is the best way to do that?

p.s. I didnt see "general security" forum so i made the thread here.

[doktorf00bar]

Why would you "publish the information outside" ? just send an anonymous email to the admin...

[souleman]

http://www.wiretrip.net/rfp/policy.html

This was a policy written by RainForestPuppy talking about full disclosure and the proper way to do it.

[doktorf00bar]

i don't think he's saying he discovered some new general vulnerability. I think he's talking about a specific instance on a specific host. THAT should never be publicized, not at least until it is patched....

[STeRoiD]

Well, it IS a new general vulnerability, its not just on a specific host. And why i want to publish what I found? because :
a) i want people to fix it, instead of using a software that can be exploited.
b) i want credit for what i found.

And yeah, I will message the people who made this message board and tell them theres a problem with it before Ill publish what I found, I just wanted to know how exactly should I do that.

[Unl3Ashed]

STeRoiD, If you would like to recieve credit for what you've found, I think the only way is that you should find a big software compony and sell it to them and they can make a fix for it , but if you publish it by your own, then I don't think of any credit. This is just an oponion, may be wrong.

Cheers

[Common_Exploit]

My guess would be to send an email to the admin(s) or creators of the software, explain to them how it can be exploited, and if you can, offer a patch. That would be my best guess.

[el-half]

doktorf00bar, cool nickname.
Mailing the webmaster is the best, I do it pretty often, check sites for holes and mail the webmaster about them+the solution, they appreciate it when you care about their site.

[thehorse13]

el-half,

You may want to look at the post dates before posting to the thread. In this case, they are from October of 2002. By definition, this is a dead thread.



--TH13