On Sat, 13 May 2017, Steve Simon wrote:
this is (IMHO) a rather subtle bug, the ones i
remember where rather
simpler. is it ok to discuss ancient security holes or is that still bad
manners?
Bring it on :-) Any systems still vulnerable (and exposed to the
Internet) deserves all that they get.
For example, I think I was the first one to mention the SPL bug here (note
that I didn't find it); I'm still trying to find that little program which
I think was published in a Usenix newsletter and exploited by, err, yours
truly...
--
Dave Horsfall DTM (VK2KFU) "Those who don't understand security will
suffer."