Page 9 Any PowerDNN users? - Community Member Announcements

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

Home All Forums

5/21/2008 4:31 PM

Brandon Haynes Haynes

brandonhaynes.org
Joined: 2/6/2006

Posts: 1172

Re: Any PowerDNN users?

Carlos Rodriguez wrote
...did not act in good faith...

Certainly PowerDNN realizes that the only difference between releasing the patch and the exploit itself is a few hours spent with the appropriate tools?

Brandon

Brandon Haynes
BrandonHaynes.org

5/21/2008 4:32 PM

Antony Slater

www.webpc.net
Joined: 9/21/2004

Posts: 499

Re: Any PowerDNN users?

Tony Valenti wrote

Hi All,
Just so everybody knows, I emailed Security@DotNetNuke.com two days ago when Joe R. and I first discovered the issue. We did not receive any follow up or additional information. I'll be resending the information shortly, but Shaun/Bill/Team - this is a critical issue! Ya'll all have my phonenumber, but I don't have yours (and if you don't have mine, it is 402-650-6072). Just Call me! Let's work together and get this thing taken care of. ...

@Tony - If I found a security issue in the core and didn't hear any response from an email to the security@dotnetnuke.com within 24 hours I would be following things up. If I thought the issue critical I would be finding other alternative means of contact.

@DNN Security Team - This thread has been going for quite a few hours and would have thought someone would have been able call PowerDNN.

Please lets get comunicating and ascertain the level of the risk and QA'ing the fixes PowerDNN have developed.

Antony

5/21/2008 4:33 PM

Nik Kalyani

www.kalyani.com
Joined: 8/1/2003

Posts: 769

Re: Any PowerDNN users?

Data Springs Inc. wrote

So.... As of right now (1:15 PST), has the core team received the information on the bug / security issue?

Nothing yet on the security@dotnetnuke.com alias. As Joe mentioned, we monitor this alias diligently and treat messages sent to it as high priority.

Shaun has published a DotNetNuke Security Notice.

Nik Kalyani
Co-founder
DotNetNuke Corporation
Blog | Twitter | FaceBook

5/21/2008 4:38 PM

Joseph Craig

Joined: 7/24/2006

Posts: 1441

Re: Any PowerDNN users?

As a humble user of DotNetNuke, I'm a bit bewildered and concerened by all of this.

I still don't know if there is an issue.

I'm disappointed in what seems to be an issue with PowerDNN.

I'm also disappointed with the response of DotNetNuke.

Geez, you guys do know each other, and there MUST be phone numbers that you have ... or could find. So, if this is such a critical issue, why aren't the phone lines buzzing?

Or is this just a tempest in a teapot? If it is, I'd sure like to hear a definitive statement from DotNetNuke!

What's a poor boy to do in this sort of situation?

Joe Craig
Patapsco Research Group, Ellicott City, MD
DotNetNuke Development and Services (http://patapscorg.com)

5/21/2008 4:39 PM

Dan Duda

Joined: 10/31/2004

Posts: 95

Re: Any PowerDNN users?

I'd also prefer that my hoster not alter any of my site files especially without my permission. If they were the only ones that knew about it they should have first contacted DNN to provide a patch and then the patch could have been offered to users through normal channels. I'd rather make changes/patches to my site myself.

Page 9 of 13

...8

...13

These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
No Flaming or Trolling.
No Profanity, Racism, or Prejudice.
Site Moderators have the final word on approving / removing a thread or post or comment.
English language posting only, please.

Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

DNN Corp. (DotNetNuke)