Comment by creshal | Hacker News Reader

Comment by creshal | Hacker News Reader

Parent Full thread

> > A lack of filtering on user CSV output that could allow an attacker to run arbitrary code on an administrator's computer.

Iff the user has Excel, and explicitly allows it to run macros in a CSV file. It's already a stretch to call this a phpMyAdmin vulnerability, much less a "medium severity" one.

> > Improper cookie invalidation that could allow an attacker to unset internal global variables.

From the PDF report:

> Note: Because of the large amount of global variables, and the relatively short nature of this assessment, NCC Group was unable to fully determine the impact of this vulnerability.

It might be serious, but they didn't have enough budget to make a proper analysis.

> Because of the large amount of global variables... NCC Group was unable to fully determine the impact of this vulnerability.

In other words, "This project is too full of potential security holes to find the definite ones."

No, it means we understand there are theoretical security issues with global variables, but cannot determine if they're actually applicable or exploitable in this software.

You just repeated exactly the same thing he said as if you were disagreeing.

A theoretical security vulnerability isn't really a think - it's just a bug. Either it's exploitable, and thus a security vulnerability, or it's a bug and isn't,

Yes it is. It is a bug, that may be exploitable. There's no contradiction there.

Global variables are not bugs -- at worse they are bad style and can cause bugs.

As for your other comments, there's this "burden of proof" thing.

Did you reply to the wrong comment by mistake? What other comments? What are you talking about?

I would venture that to do so would devolve into a full source audit, which seriously increases the scope of the test. Full source audits are likely to consume ten times or more calendar effort.

Performing a full source audit is going to result in sticker shock for all but the most well-funded.

Reply on news.ycombinator.com