<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#990000">
Dear Allan, <br>
We meet again!<br>
But, I do agree this is not a healthy way of development. We will have
a relook at the approach. The reason we are asking to move over to
vtiger5 is simply because vtiger5<br>
is much more stable than previously before.<br>
But again, I do concede that simply because we have released vtiger5
does not mandate<br>
all the users to move to vtiger5 and we cannot leave vtiger-4.x as a
lame duck.<br>
<br>
I will have a relook. <br>
<br>
Allan, kindly understand this - ' it is we ' that matters, not the
vtiger-core team alone.<br>
You are part of the team. As a team member, you have every right to
point out the flaws that are happening. Could it not be put in a better
manner is what I ask?<br>
<br>
Again, thanks for bringing this to light regardless of how you achieve
it ;-)<br>
<br>
Richie<br>
<br>
<br>
Allan Bush wrote:
<blockquote
cite="mid3bec26390610161014y452bd6n227bb95ad52dc805@mail.gmail.com"
type="cite">
<pre wrap="">I love how the vtiger developers like to hand things off to "the team".
The vtiger developers have long since abandoned supporting 4.2.x. I
seem to have become the 4.2 project manager (by being pretty much the
only developer). Here's my take on vtiger security (in both 4.2 and
5.0), it's not kind so I've refrained from stating my views earlier
for fear of insulting someone, but here goes:
VtigerCRM is insecure. There may be 3 insecurities listed on secunia,
but I bet I could exploit it in a hundred difference ways, given a
proper login.
It's an unfortunate situation, but it would take lot more work then I
can to give to fix the issues. I'm content as long as you can't
exploit the program without logging in. If anyone is willing to take
up this project and provide the required fixes, I'll be more then
happy to lend a hand and make sure that the required changes are
merged into the next 4.2 release, but I don't have the time to do this
entire project myself.
On 10/15/06, Gopal <a class="moz-txt-link-rfc2396E" href="mailto:gopals@vtiger.com"><gopals@vtiger.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap=""> Dear Team,
Please have a look at another security advisory for version 4.2.
<a class="moz-txt-link-freetext" href="http://securitydot.net/xpl/exploits/vulnerabilities/articles/1639/exploit.html">http://securitydot.net/xpl/exploits/vulnerabilities/articles/1639/exploit.html</a>
As of now, solution offered by advisory is to migrate product to the
version 5.
Thanks,
Gopal
Thanks,
Gopal
Philip wrote:
Hi Kim,
I have posted this as a ticket in trac, kindly refer the
url for status
<a class="moz-txt-link-freetext" href="http://secunia.com/advisories/21728/">http://secunia.com/advisories/21728/</a> ,
i'll be fixing this on vtigerCRM 5 GA only.
Can anybody volunter for vtigerCRM 4.2.x ? if it has not
been fixed on that.
Philip
---- On Thu, 07 Sep 2006 Kim Haverblad <a class="moz-txt-link-rfc2396E" href="mailto:kim@haverblad.se"><kim@haverblad.se></a>
wrote ----
Well, I posted the advisory info within this list
the same day (060904)
it was issued by Secunia and so far no response
from anyone on the list.
/Kim
Ken Lyle wrote:
> Another Secunia advisory has popped up:
> <a class="moz-txt-link-freetext" href="http://secunia.com/advisories/21728/">http://secunia.com/advisories/21728/</a>
>
> Who is managing and addressing these?
>
> Ken
>
> 484-948-5706
> 866-OUT OF BOX
> (866-688-6326)
>
_______________________________________________
Get started with creating presentations online -
<a class="moz-txt-link-freetext" href="http://zohoshow.com?vt">http://zohoshow.com?vt</a>
________________________________
_______________________________________________
Get started with creating presentations online - <a class="moz-txt-link-freetext" href="http://zohoshow.com?vt">http://zohoshow.com?vt</a>
_______________________________________________
Reach hundreds of potential candidates - <a class="moz-txt-link-freetext" href="http://jobs.vtiger.com">http://jobs.vtiger.com</a>
</pre>
</blockquote>
<pre wrap=""><!---->_______________________________________________
Reach hundreds of potential candidates - <a class="moz-txt-link-freetext" href="http://jobs.vtiger.com">http://jobs.vtiger.com</a>
</pre>
</blockquote>
<br>
</body>
</html>