<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta content="text/html;charset=UTF-8" http-equiv="Content-Type"></head><body >Dear Team,<br><br><font><font>Ivan Markovic of </font></font><a href="http://www.security-net.biz/">www.security-net.biz</a> has identified "moderate risk" security issues in 4.2.x version.<br><br>For more details please refer to: <br><br>http://www.frsirt.com/english/advisories/2006/3444<br><br>Philip has started analyzing the issues and will keep you update the status. In the meantime if you have any solutions please let us share.<br><br>Regards,<br>Gopal<br>---
<br>S.S.G.Gopal
<br>skype: sripadag
<br>ph: +1 877 788 4437
<br>blog: http://gopal.vtiger.com<br><br>---- On Fri, 01 Sep 2006 <b>Tim Smith <smith.timsmith@gmail.com></b> wrote ---- <br><br><blockquote style="border-left: 1px solid rgb(160, 154, 255); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">There are two options:<br>1. Fix the security flaws<br>2. Notify the user that their system has the security flaw during install<br><br>#2 is only valid if you can detect that all the required security settings are enabled. I guess you could make a request to read the log and notify the user if you were able to. This check could also be done at login time when the administrator logs in.
<br><br>Personally, I'd rather see the security flaws fixed.<br><br>Tim<br>
_______________________________________________<br>Get started with creating presentations online - <a href="http://zohoshow.com?vt" target="_blank">http://zohoshow.com?vt</a> <br></blockquote></body></html>