OSVDB Mangling

First off a definition:

Data Mangler: A "Data Mangler" is person whose responsibility is to mangle, or edit, a number of vulnerabilities each and every day. Data Manglers do a large amount of technical writing.

The documentation is pretty decent and the backend is very easy to use. It does require a lot of reading and it took me about 1.5 hours to mangle my first entry, and about 40 minutes to mangle the second. My profile is here, you get one point per successfully mangled vulnerability.

I have had three mangles accepted so far. They were both positive learning experiences, particularly about the specifics of exploitation, exploit dissemination and hacking groups, all things I have an idea of but researching them gives me much more insight. They are:

• Winamp Skin File Local Zone Arbitrary Code Execution
  
• PHP-Nuke PhotoADay Module Input Validation Error Variable XSS
  
• Network Everywhere NR041 Router DHCP HOSTNAME Script Injection

For a working exploit of the Winamp vulnerability go here. The executable it loads is the default windows calc.exe so nothing dodgy. I was quite interested to note that Norton Antivirus blocked this exploit not because the executable was malicious but because of the way it was opened.