On Tue, 13 Feb 2007, Gadi Evron wrote:
We all agree it is not a very likely possibility, but I wouldn't rule it
out completely just yet until more information from Sun becomes
available.
What more information do you need? You have an advisory, access to the
source code, access to the change
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
- --
Debian Security Advisory DSA 1260-1[EMAIL PROTECTED]
http://www.debian.org/security/ Moritz Muehlenhoff
February 14th, 2007
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Symantec Vulnerability Research
http://www.symantec.com/research
Security Advisory
Advisory ID: SYMSA-2007-002
Advisory Title: Palm OS Treo Find Feature System Password Bypass
Gadi,
[...]
One note: although it could just as well be a bug, who says it was not a
backdoor in the early 90's?
Also, I understand this does not work on older Solaris/SunOS systems
(anyone can verify?)
I can. It is not present in anything before Solaris 10.
which adds to my personal
https://bugzilla.mozilla.org/show_bug.cgi?id=370445
Peter Besenbruch wrote:
Ben Bucksch wrote:
https://bugzilla.mozilla.org/show_bug.cgi?id=370445
Are we going to see a version 2.0.0.2 of Firefox soon? With all the
Firefox bugs, we are about due.
A 2.0.0.2 is in progress
http://weblogs.mozillazine.org/qa/
On Thu, 15 Feb 2007, Joep Vesseur wrote:
Gadi,
[...]
One note: although it could just as well be a bug, who says it was not a
backdoor in the early 90's?
Also, I understand this does not work on older Solaris/SunOS systems
(anyone can verify?)
I can. It is not present in
Hello,
We would like to inform you about a vulnerability in Comodo Firewall Pro.
Description:
Comodo Firewall Pro (former Comodo Personal Firewall) implements a component control, which is based on a checksum
comparison of process modules. Probably to achieve a better performance, cyclic
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c00860750
Version: 1
HBSBGN02189 SSRT071297 rev.1 ServiceGuard for Linux, Remote Unauthorized Access
NOTICE: The information in this Security Bulletin should be acted upon as soon
as possible.
[EMAIL PROTECTED] wrote:
There's a new advisory at:
http://www.infohacking.com/INFOHACKING_RESEARCH/Our_Advisories/apache/index.html
Summarizing:
[...]
b) Control codes injection -backspaces, etc.- thus allowing script injection in
the server response. Right now it seems that this
wow reminds me of back in the day ... haven't seen one of these in years.
Thefinn
On Tue, 13 Feb 2007, Gadi Evron wrote:
We all agree it is not a very likely possibility, but I wouldn't rule it
out completely just yet until more information from Sun becomes
available.
What more information do you need? You have an advisory, access to the
source code, access to the change
In some mail from Joe Shamblin, sie said:
How about just uncommenting the following from /etc/default/login
# If CONSOLE is set, root can only login on that device.
# Comment this line out to allow remote login by root.
#
CONSOLE=/dev/console
Not a fix to be sure, but at least prevents a
On Thu, 15 Feb 2007, 3APA3A wrote:
Mitigating factor: it doesn't work through proxy, because for proxy URI
is sent instead of URL and request will be incomplete.
Yup. Depends on the proxy, actually ('GET http://evil.com' might get
parsed as HTTP/0.9) - but Squid, both in direct and in reverse
very good work
I wander whether we can execute code on about:config or about:cache.
Right now we can only modify cookies and bypass the same origin
policy. If we can get JavaScript running on about:cache or
about:config or some chrome URL, we might be able to completely hijack
the browser.
If
weird, firefox slowly dies out
t2.html
html
body
iframe src=t1.html/iframe
/body
/html
t1.html
html
body
scriptlocation.hostname=blog.com;/script
/body
/html
On 2/15/07, pdp (architect) [EMAIL PROTECTED] wrote:
the first one
Ben Bucksch wrote:
https://bugzilla.mozilla.org/show_bug.cgi?id=370445
___
Full-Disclosure - We believe in it.
Hi Ben,
Are we going to see a version 2.0.0.2 of Firefox soon? With all the
Firefox bugs, we are about due.
--
Hawaiian Astronomical
There was also a really entertaining presentation from Patrick Petersen of
IronPort at RSA, in which he mentioned use of defaced web sites as proxy
forwarders for spammers. According to the presentation, the spammers have a
fairly sophisticated toolkit that takes over the site and turns it into a
For some commentary on this issue, this is one man's thoughts.
http://www.schneier.com/crypto-gram-0602.html#16
Tom
Hawk Corporation
[EMAIL PROTECTED]
440-528-4045 Direct
440-498-2276 x 4045
Cell: 440-669-2526
Fax: 917-464-7241
-Original Message-
From: Darren Reed [mailto:[EMAIL
On Thu, 15 Feb 2007 13:50:59 -0500, iDefense Labs [EMAIL PROTECTED] said:
Exploitation allows attackers to degrade the service of the ClamAV
virus scanning service. The most important mitigating factor is that
the clam process runs with the privileges of the clamav user and
group.
Clamav may
Yes, that's true, control characters are not in violation of the stated
charset iso-8859-1. Thank you for notice me this. Unfortunately I mispelled
iso-8859-1 as iso 8859-1 wich is not the same. I'm sorry for this. I'll
correct this right now.
Sincerely,
Just a quick note: what you
This has been fixed as of February 14, 2007.
I would have prefered to be notified directly (my email address was on the
webpage in question) rather than having to peruse bugtraq to find this problem.
We discovered a new potential threat that we term Drive-by Pharming. An
attacker can create a web page containing a simple piece of malicious
JavaScript code. When the page is viewed, the code makes a login attempt into
the user's home broadband router and attempts to change its DNS server
A public, false assertation of malice is called libel.
The great and needed social role that the glaring light of the public
gets to weld to hold others accountable require that public allegations
have at least some reasonable basis, backed by evidence, for their
postulation.
The American
= Lizardtech DjVu Browser Plug-in - Multiple Vulnerabilities
=
= Vendor Website:
= http://www.lizardtech.com/
=
= Affected Version:
=Windows DjVu Browser Plug-in 6.1.1
=
= Public disclosure on February 15th 2007
= EasyMail Objects v6.5 Connect Method Stack Overflow
=
= Vendor Website:
= http://www.quiksoft.com
=
= Affected Version:
= All versions of EasyMail Objects prior to v6.5
=
= Public disclosure on February 16th, 2007.
There have also been too many times in the past when they have been proven
correct to ignore the possibility any longer.
Hi, in what instances has the conjecture that a bug was a deliberate
backdoor been proven correct?
hey guys .. check out this new xss i just found ;P
Vulnerable : Calendar Express 2
web : http://www.ci.emeryville.ca.us/calendar,
http://www.phplite.com/products/calendarexpress/
XSS :
This is also a straight up CSRF exploit as well -- the script does what it
looks like it will do. Change the root user's mysql password with no
interaction.
29 matches
Mail list logo
