Someone wastes Heine's time - He gives them proper credit

greggles — Wed, 18 Feb 2009 22:50:21 +0000

A little while ago there was this disclosure about a potential Local File Inclusion bug in Drupal core. The issue report was lacking in two areas:

It did not have enough information about how to take advantage of the vulnerability - this is a classic problem with security reports is that they are not complete enough.
It was sent to a public list before being sent to the Drupal security team which could have resulted in a zero-day exploit.

Heine Deelstra took the time to investigate the issue and discuss it with the "researcher" who found it. The result: this mail.

"ZOMG - IF YOU OVERWRITE INDEX.PHP, TEH CODE IS EXECUTED!!!!"

Every security issue sucks up time trying to understand it, verify it, etc. It's nice to have an issue with such a light-hearted resolution.

Cracking Drupal - zomg