First NATS and now Mansion - MPA
 

Source-Code Audit Detects Issue in MPA3

Clients' programs were fixed 'right away,' company says.
By: Sherri L. Shaulis
Posted: 04/30/2008
LOS ANGELES - A routine audit of source code for MPA3 found a "mySQL injection," but the company said the matter has already been resolved.

Oystein Wright, CEO of Mansion Productions, the parent company of MPA3, said the injection meant someone could have added strings to the variables MPA3 uses and extracted some information from the database

The company that conducted the audit notified officials from MPA3 about the issue Monday, and MPA3 officials checked and verified the issue, Wright said.

"We prepared a fix and started updating clients' programs right away," he said.

Clients were notified of the security issue findings and the implemented fix via email, Wright said, adding that, "To date, no information has been lost or compromised that we know of."

"We did get feedback from a few clients asking if their programs had been fixed, and they were all happy to hear that they were," he said. "I have yet to get a single complaint, and I believe it is because we made the necessary changes to secure their programs as soon as we found out about it."

Re: First NATS and now Mansion - MPA
 

No program is 100% impenetrable..ask any programmer.

Oystein is awesome and runs a tight ship. They acted fast and no harm was done

Re: First NATS and now Mansion - MPA
 

I think the difference on this one is (a) the company is openly admitting an issue and dealing with it, and (b) the issue seems to be a hole that was never exploited, found by reviewing source code and not be someone in the wild.

I will, however, allow John to come in to this thread and call me names now.

Re: First NATS and now Mansion - MPA
 

Just wondering if it effected the shave on shave off feature.

Re: First NATS and now Mansion - MPA
 

Hmm, putting the issue out there like this is a BAAAAD idea, why? Because it takes forever for admins to get around to updating their systems and they just told the entire hacker community "HEY GUISE FREE PORN!"

Re: First NATS and now Mansion - MPA
 

Everyone has bugs. And sometimes they create opportunity for an exploit.

What separates the good from the bad is disclosure and response time.