SecurityFocus Screwup?
Source: Hackers.com
"For obvious reasons, I can't really go into why it was left on the machines." Replies Dean Turner, the Director of Operations at SecurityFocus. Dean is talking about the source code for over 20 programs running on one of SecurityFocus' webservers , which was available to anyone with a web browser for several months. SecurityFocus.com, the self proclaimed 'leading provider of security intelligence services for business', got caught with their pants down.
"This is the most embarrassing thing to happen to Security Focus in a long time", comments an independent security consultant who asked to be identified as 'Olsen'. "The program files detail not only the internal database structure behind SecurityFocus, but also certain file directories. More importantly, toolsend.html, one of program files that allows users to submit tools to SecurityFocus may be manipulatable to allow for attackers to upload malicious scripts, and gain access to execute commands with privileges of the webserver running the code at www1.securityfocus.com ." Another security professional who asked to be identified as 'catch' gave a startling thought: "Considering that all of the other tools are also owned by the webserver user, this casts doubt on SecurityFocus' entire software archive."
