Home page logo
/

bugtraq logo Bugtraq mailing list archives

Intel.com Mailing List Arbitrary Address Removal Link
From: "E M" <rdnktrk () hotmail com>
Date: Tue, 05 Feb 2002 16:16:06 -0800

.: Overview :.

Several Intel Programs (Intel product dealer -IPD- for example) allow you to join a Mailing List with exclusive Intel news and announcements. This is helpfull in keeping up to date with changes in the marketplace in relation to Intel products.

.: Problem :.

While Intel requires you to login to modify account information, it does not require you to login to remove your e-mail (or any e-mail) from its mailing list database.

.: Example :.

To Remove someone () domain com
http://intel.m0.net/m/u/ien/i.asp?e=someone%40domain.com

.: Factors :.

-You would need to know which addresses you would like to remove.
-You can't modify addresses or information

.: Severity :.

Removal of users from Mailing List without authorization.
 - Low

.: Conclusion :.

An oversight which should be resolved by requiring login prior to unsubscription from the list.

.: Vendor Response :.

Notified Friday 02/01/2002
Responded with "were working on it" 02/05/2002


.: Advisory By :.

Eric McCarty
rdnktrk () hotmail com








_________________________________________________________________
Join the world’s largest e-mail service with MSN Hotmail. http://www.hotmail.com


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault