Full Disclosure: Re: Original Photo Gallery Remote Command Execution

[Andrew Farmer <andfarm () gmail com>]

On 03 Oct 07, at 02:10, Aidan Thornton wrote:
> On 10/2/07, ascii <ascii () katamail com> wrote:
> > X. LEGAL NOTICES
> >
> > Copyright (c) 2007 Francesco `ascii` Ongaro
> >
> > Note: this exploit is DUAL LICENSED,
> > 1. if you'll use it for personal and non-profit purposes you can
> >    apply GPL v2 and above.
> >
> > 2. In the case you plain to:
> >    a. use our code in any commercial context
> >    b. implement this code in your non-GPL application
> >    c. use this code during a Penetration Test
> >    d. make any profit from it
> >
> >   you need to contact me in order to obtain a _commercial license_.
> >
> > For more informations about Dual Licensing:
> > http://producingoss.com/html-chunk/dual-licensing.html
> I think you're misunderstanding the GPL. "GPL, but only for personal
> and non-profit purposes" isn't a valid license since the GPL doesn't
> permit restrictions on commercial use.
In fact, the GPL doesn't permit any restrictions on usage at all. It
only covers distribution.

Probably a moot point anyway, as the actual exploit is trivial enough
that it isn't covered by copyright. (The discovery that you can use
register_globals to set exif_prog isn't a creative work.)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/