Security Advisory: CVE-2011-2516
Please be advised that a security issue affecting the Apache XML Security Library for C++ has been identified and an updated version released to address the issue. The full text of the advisory is below, and a signed version can be found at: http://santuario.apache.org/secadv/CVE-2011-2516.txt -- Scott Cantor CVE-2011-2516: Apache Santuario XML Security for C++ contains buffer overflows signing or verifying with large keys. Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Santuario XML Security for C++ library versions prior to V1.6.1 Description: A buffer overflow exists when creating or verifying XML signatures with RSA keys of sizes on the order of 8192 or more bits. This typically results in a crash and denial of service in applications that verify signatures using keys that could be supplied by an attacker. Mitigation: Applications using library versions older than V1.6.1 should upgrade as soon as possible. Distributors of older versions should apply the patches from this subversion revision: http://svn.apache.org/viewvc?view=revisionrevision=1125752 Applications that can prevent the use of arbitrary keys supplied by an attacker (such as within the ds:KeyInfo element of a signature), or limit key sizes, may prevent the exploitation of this bug. Credit: This issue was reported by Paulo Zanoni. References: http://santuario.apache.org/ Scott Cantor
Re: [Full-disclosure] Ubuntu: reseed(8), random.org, and HTTP request
Ubuntu's reseed(8) can be used to seed the PRNG state of a host. The script is run when the package installed, and anytime su executes the script. reseed(8) performs a unsecured HTTP request to random.org for its bits, despite random.org offering HTTPS services. This resulted in a couple of discussions elsewhere, but as weird the idea of retrieving a seed from the Internet is (over HTTPS or not), this particular use is probably (unintentionally) harmless. Writing to /dev/[u]random does not replace the existing entropy pool, and merely mixes some new data in. Therefore, the script does not reduce the quality of the kernel PRNG if you already have some entropy collected, even if the returned payload is completely bogus. The only effect it may have is improving entropy if you don't have any, or not doing anything useful (if connection fails, or predictable data is returned). I initially thought this is still bad news, because you don't want the kernel to think it has more entropy than in reality (thus not blocking /dev/random reads, etc) - but the write() performed by this code also does not affect the entropy estimate by the virtue of not doing RNDADDTOENTCNT or RNDADDENTROPY ioctls. So, it should be OK. The use of HTTPS is a red herring (and establishing HTTPS without any real entropy available is tricky anyway). A more significant concern is that the ownership or quality of random.org may change. But in this case, it simply renders this effort a nominally harmless no-op. /mz
[SECURITY] [DSA 2273-1] icedove security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2273-1 secur...@debian.org http://www.debian.org/security/Moritz Muehlenhoff July 06, 2011 http://www.debian.org/security/faq - - Package: icedove Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2011-0083 CVE-2011-0085 CVE-2011-2362 CVE-2011-2363 CVE-2011-2365 CVE-2011-2371 CVE-2011-2373 CVE-2011-2374 CVE-2011-2376 Several vulnerabilities have been discovered in Icedove, an unbranded version of the Thunderbird mail/news client. CVE-2011-0083 / CVE-2011-2363 regenrecht discovered two use-after-frees in SVG processing, which could lead to the execution of arbitrary code. CVE-2011-0085 regenrecht discovered a use-after-free in XUL processing, which could lead to the execution of arbitrary code. CVE-2011-2362 David Chan discovered that cookies were insufficiently isolated. CVE-2011-2371 Chris Rohlf and Yan Ivnitskiy discovered an integer overflow in the Javascript engine, which could lead to the execution of arbitrary code. CVE-2011-2373 Martin Barbella discovered a use-after-free in XUL processing, which could lead to the execution of arbitrary code. CVE-2011-2374 Bob Clary, Kevin Brosnan, Nils, Gary Kwong, Jesse Ruderman and Christian Biesinger discovered memory corruption bugs, which may lead to the execution of arbitrary code. CVE-2011-2376 Luke Wagner and Gary Kwong discovered memory corruption bugs, which may lead to the execution of arbitrary code. As indicated in the Lenny (oldstable) release notes, security support for the Icedove packages in the oldstable needed to be stopped before the end of the regular Lenny security maintenance life cycle. You are strongly encouraged to upgrade to stable or switch to a different mail client. For the stable distribution (squeeze), this problem has been fixed in version 3.0.11-1+squeeze3. For the unstable distribution (sid), this problem has been fixed in version 3.1.11-1. We recommend that you upgrade your icedove packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-annou...@lists.debian.org -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.11 (GNU/Linux) iEYEARECAAYFAk4UqlsACgkQXm3vHE4uylq9qwCfUfETLCHVqrtFmgCbghNPN3BV 77wAnixFSCQKnQ4ltDwqJWWhrBYYoddU =fgNJ -END PGP SIGNATURE-
[security bulletin] HPSBMA02674 SSRT100487 rev.2 - HP Service Manager and HP Service Center, Unauthorized Remote Access, Unsecured Local Access, Remote Disclosure of Privileged Information, HTTP Sessi
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02863015 Version: 2 HPSBMA02674 SSRT100487 rev.2 - HP Service Manager and HP Service Center, Unauthorized Remote Access, Unsecured Local Access, Remote Disclosure of Privileged Information, HTTP Session Credential Re-use, Cross Site Scripting (XSS) and Remote Script Inject NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2011-06-07 Last Updated: 2011-07-05 Potential Security Impact: Unauthorized remote access, unsecured local access, remote disclosure of privileged information, HTTP session credential re-use, cross site scripting (XSS) and remote script injection Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified in HP Service Manager and HP Service Center which may allow remote authenticated users unauthorized access, unsecured local access, remote disclosure of privileged information, HTTP session credential re-use, cross site scripting (XSS) and remote script injection. References: Reference Description CVE-2011-1857 Unauthorized Remote Access CVE-2011-1858 Unsecured Local Access CVE-2011-1859 Remote Disclosure of Privileged Information CVE-2011-1860 HTTP Session Credential Re-use CVE-2011-1861 Unauthorized Remote Access CVE-2011-1862 Cross Site Scripting (XSS) CVE-2011-1863 Remote Script Injection SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP Service Manager v9.21, v9.20, v7.11, v7.02 running on AIX, HP-UX, Linux, Solaris and Windows HP Service Manager client v9.21, v9.20, v7.11, v7.02 running on Windows HP Service Center v6.2.8 Client running on Windows HP Service Center v6.2.8 running on AIX, HP-UX, Linux, Solaris and Windows BACKGROUND CVSS 2.0 Base Metrics === Reference Base Vector Base Score CVE-2011-1857(AV:N/AC:M/Au:S/C:P/I:C/A:C) 8.2 CVE-2011-1858(AV:L/AC:L/Au:S/C:N/I:N/A:N) 3.1 CVE-2011-1859(AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 CVE-2011-1860(AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 CVE-2011-1861(AV:N/AC:M/Au:N/C:C/I:P/A:N) 7.8 CVE-2011-1862(AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2011-1863(AV:N/AC:M/Au:S/C:C/I:P/A:P) 7.5 === Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION The vulnerability can be resolved by updating affected versions of the HP Service Manager and HP Service Center with the following patches or the subsequent version of the patch. Customers can download the patches from HP SSO at http://support.openview.hp.com/selfsolve/patches . Notes: Each table below lists the security vulnerabilities which impact the product version and the minimum patch or patches needed to resolve the issue. To locate the patch document on HP SSO, use a URL in this form: http://support.openview.hp.com/selfsolve/document/ Document ID . Please substitute the appropriate document id. For example, to go to the page for document id KM1061984, use this URL: http://support.openview.hp.com/selfsolve/document/KM1061984 SM v9.21 Vulnerability reference SM v9.21 patch document title Document ID CVE-2011-1858 SM9.21p1 Web Tier KM1061984 CVE-2011-1859 SM9.21p1 Web Tier KM1061984 CVE-2011-1861 SM9.21p1 Web Tier KM1061984 SM v9.21 client Vulnerability reference SM v9.21 client patch document title Document ID CVE-2011-1858 SM9.21p1 Windows Client KM1061983 SM v9.20 Vulnerability reference SM v9.20 patch document title Document ID CVE-2011-1857 SM9.20p1HF1 Web Tier KM1027247 CVE-2011-1858 Upgrade to SM v9.21 CVE-2011-1859 SM9.20p1HF1 Web Tier KM1027247 CVE-2011-1860 SM9.20p1HF1 Web Tier KM1027247 CVE-2011-1861 Upgrade to SM v9.21 CVE-2011-1862 SM9.20p1HF1 Web Tier KM1027247 CVE-2011-1863 SM9.20p1HF1 Web Tier KM1027247 SM v9.20 client Vulnerability reference SM v9.20 client resolution CVE-2011-1858 Upgrade to SM v9.21 SM v7.11 Vulnerability reference SM v7.11 patch document title document title Document ID CVE-2011-1857 SM7.11p15 Web Tier KM1030364 CVE-2011-1858 SM7.11p15 Web Tier KM1030364 CVE-2011-1860 SM7.11p15 Web Tier KM1030364 CVE-2011-1861 SM7.11p15HF1 Web Tier Request HP support channel for this hotfix CVE-2011-1862 SM7.11p15 Web Tier KM1030364 CVE-2011-1863 SM7.11p15 Web Tier KM1030364 SM v7.11 client Vulnerability reference SM v7.11 client patch document title Document ID CVE-2011-1858 SM7.11p15 Windows Client KM1030362 SM v7.02 Vulnerability reference SM v7.02 patch document title Document ID CVE-2011-1857 SM7.02p15 Web Tier KM973524 (included in next patch) CVE-2011-1858 SM7.02p16 Web Tier KM1099883 CVE-2011-1860 SM7.02p16 Web Tier KM1099883 CVE-2011-1861
Security Advisory: CVE-2011-2464 - ISC BIND 9 Remote packet Denial of Service against Authoritative and Recursive Servers
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 ISC BIND 9 Remote packet Denial of Service against Authoritative and Recursive Servers A specially constructed packet will cause BIND 9 (named) to exit, affecting DNS service. CVE: CVE-2011-2464 Document Version: 2.0 Posting date: 05 Jul 2011 Program Impacted: BIND Versions affected: 9.6.3, 9.6-ESV-R4, 9.6-ESV-R4-P1, 9.6-ESV-R5b1 9.7.0, 9.7.0-P1, 9.7.0-P2, 9.7.1, 9.7.1-P1, 9.7.1-P2, 9.7.2, 9.7.2-P1, 9.7.2-P2, 9.7.2-P3, 9.7.3, 9.7.3-P1, 9.7.3-P2, 9.7.4b1 9.8.0, 9.8.0-P1, 9.8.0-P2, 9.8.0-P3, 9.8.1b1 Severity: High Exploitable: Remotely Description: A defect in the affected BIND 9 versions allows an attacker to remotely cause the named process to exit using a specially crafted packet. This defect affects both recursive and authoritative servers. The code location of the defect makes it impossible to protect BIND using ACLs configured within named.conf or by disabling any features at compile-time or run-time. A remote attacker would need to be able to send a specially crafted packet directly to a server running a vulnerable version of BIND. There is also the potential for an indirect attack via malware that is inadvertently installed and run, where infected machines have direct access to an organization's nameservers. CVSS Score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C) For more information on the Common Vulnerability Scoring System and to obtain your specific environmental score please visit: http://nvd.nist.gov/cvss.cfm?calculatoradvversion=2 Workarounds: There are no known workarounds for publicly available servers. Administrators of servers that are not publicly available may be able to limit exposure via firewalls and packet filters. Active exploits: ISC knows of no public tools to exploit this defect at the time of this advisory. Solution: Upgrade to: 9.6-ESV-R4-P3, 9.7.3-P3 or 9.8.0-P4. Download these versions from the following locations: ISC releases of BIND 9 software may be downloaded from http://www.isc.org/software/bind If you do not obtain your BIND software directly from ISC, contact your operating system or software vendor for an update. If you are participating in ISC's beta or release candidate (RC) programs, please upgrade. ISC Beta/RC testers are expected to remove vulnerable versions and upgrade. No security advisories are issued for beta / release candidates once the corresponding final release is made. In addition, 9.5.3b1 and 9.5.3rc1 are affected although ISC has not released a final production version of 9.5.3. Note that BIND 9.5 is End-of-Life, therefore if you are running a pre-release version of 9.5.3 we recommend upgrading to a supported production version of BIND. 9.6-ESV-R4-P2 is not affected by any known attack vectors, but has been replaced by 9.6-ESV-R4-P3 which carries a more complete fix Other versions of BIND 9 not listed in this advisory are not vulnerable to this problem. Acknowledgements: ISC thanks Roy Arends from Nominet for pin-pointing the exact nature of the vulnerability. We also thank Ramesh Damodaran of Infoblox for finding a variation of the attack vector and Mats Dufberg of TeliaSonera Sweden for confirming additional variants. Document Revision History: Version 1.0 - 14 June 2011: Phase One Disclosure Date Version 1.1 - 20 June 2011: Phase Two Disclosure Date with updates. Version 1.2 - 21 June 2011: Updates on beta, RC, and clarity editing Verison 1.3 - 21 June 2011: Sent Hold Notices to Phase I constituents, extended Acknowledgments Version 1.4 - 23 June 2011: Updated -P versions to include Advanced Security Patches release to Phase I, and Upgrade to: versions Version 1.5 - 24 June 2011: Added document URL, sent schedule update to Phase I constituents. Version 1.6 - 28 June 2011: Updated Versions Affected, extended Acknowledgments, sent Phase I updates Version 1.7 - 30 June 2011: Updated attribution text. Version 1.8 - 4 July 2011: Phase Three and Four Disclosure Date version 2.0 - 5 July 2011: Public Disclosure Do you have Questions? Questions regarding this advisory should go to security-offi...@isc.org. Do you need Software Support? Questions on ISC's Support services or other offerings should be sent to sa...@isc.org. More information on ISC's support and other offerings are available at: http://www.isc.org/community/blog/201102/BIND-support ISC Security Vulnerability Disclosure Policy: Details of our current security advisory policy and practice can be found here: https://www.isc.org/security-vulnerability-disclosure-policy Legal Disclaimer:: Internet Systems Consortium (ISC) is providing this notice on an AS IS basis. No warranty or guarantee of any kind is expressed in this notice and none should be implied. ISC expressly excludes and disclaims any warranties regarding this notice or materials referred to in this notice, including, without limitation, any implied warranty of merchantability, fitness for a particular purpose, absence of hidden defects,
Aruba Advisory AID-070611 Cross Site Scripting vulnerability in ArubaOS and AirWave Administration Web Interfaces
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ADVISORY NUMBER AID-070611 Advisory # 1: TITLE Cross Site Scripting vulnerability in ArubaOS and AirWave Administration Web Interfaces. SUMMARY A persistent Cross Site Scripting vulnerability (XSS) was discovered where an attacker could plant an AP with maliciously crafted SSID in the general vicinity of the wireless LAN and might be able to trigger a XSS vulnerability in the reporting sections of the ArubaOS and AirWave Administration WebUIs. AFFECTED VERSIONS - - ArubaOS 3.3.X, 3.4.X, 5.0.X, 6.0.X, 2.4.X-FIPS, 3.3.X-FIPS and 3.4.X-FIPS - - AirWave 7.2.X DETAILS ArubaOS and AirWave maintain information on all wireless network SSIDs and APs visible on the wireless network and the general vicinity. This information is used for security and reporting purposes. An attacker could plant an AP with maliciously crafted SSID and might trigger a XSS vulnerability in certain sections of the ArubaOS and AirWave Administration WebUIs related to reporting. This vulnerability would manifest when administrator would log in to the WebUI and browse to the reporting section. This vulnerability requires the administrator to be successfully logged in with valid credentials. However the malicious AP does not have to be beaconing the SSID continuously as the SSID information is stored in the controller for sometime for reporting purposes after it is first observed. IMPACT An attacker could plant an AP with maliciously crafted SSID in the general vicinity of the wireless LAN and might trigger a XSS vulnerability in reporting section of the ArubaOS and AirWave WebUIs. This vulnerability could potentially be used to execute commands on the controller with admin credentials. NOTE: This vulnerability manifests when the administrator is successfully logged in with valid credentials and browses to the affected reporting sections of the ArubaOS and AirWave WebUIs. CVSS v2 BASE METRIC SCORE: 4.8 (AV:A/AC:L/AU:N/C:P/I:P/A:N) WORKAROUNDS Aruba Networks recommends that all customers apply the appropriate patch(es) as soon as practical. SOLUTION Aruba Networks recommends that all customers apply the appropriate patch(es) as soon as practical. The following patches have the fix (any newer patch will also have the fix): - - ArubaOS 3.3.3.10 - - ArubaOS 3.4.4.2 - - ArubaOS 5.0.3.2 - - ArubaOS 6.0.1.1 - - ArubaOS 2.4.8.27-FIPS - - ArubaOS 3.3.2.21-FIPS - - ArubaOS 3.4.4.0-FIPS - - AirWave 7.2.2 The FIPS releases noted above are currently undergoing FIPS certification and are available from Aruba on request. Please note: We highly recommend that you upgrade your Mobility Controller to the latest available patch on the Aruba support site corresponding to your currently installed release. + Advisory # 2: TITLE HTTP Response splitting vulnerability in ArubaOS Captive Portal Web Interface SUMMARY A HTTP Response splitting vulnerability was discovered in ArubaOS's Captive Portal Web Interface where an attacker might be able to force authenticated captive portal users to bypass the custom welcome page post authentication and redirect them to a site of attacker's choice. AFFECTED VERSIONS - - ArubaOS 3.3.X, 3.4.X, 5.0.X, 6.0.X, 2.4.X-FIPS, 3.3.X-FIPS and 3.4.X-FIPS DETAILS ArubaOS allows for authenticated captive portal users to be redirected to a custom welcome web page post authentication. A HTTP Response splitting vulnerability was discovered that could be exploited by an attacker to force authenticated captive portal users to completely bypass the custom welcome page and be redirected to a website of attacker's choice. Attacker might achieve this by sending a maliciously crafted URL to the user in an email. When user clicks on the link and authenticates successfully to the captive portal, he/she might be redirected to a site of attacker's choice rather than the captive portal's custom welcome page. This vulnerability does not affect the default captive portal configuration where no custom welcome page is used. IMPACT An attacker could force an authenticated captive portal user to be redirected to a website of attacker's choice rather than captive portal's custom welcome page. For this vulnerability to manifest, user would have to click on a maliciously crafted link and then authenticate successfully to the presented captive portal authentication page. NOTE: Default captive portal configuration is NOT vulnerable to this issue where no custom welcome page is configured. CVSS v2 BASE METRIC SCORE: 4.9 (AV:N/AC:M/AU:S/C:P/I:P/A:N) HOW TO IDENTIFY IF YOU ARE VULNERABLE If the following lines exist in your configuration for a particular active captive portal profile then you are vulnerable. aaa authentication captive-portal profile ... ... welcome-page custom site ! WORKAROUNDS Aruba Networks recommends that all customers apply the appropriate
Security Advisory: CVE-2011-2465 ISC BIND 9 Remote Crash with Certain RPZ Configurations
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 ISC BIND 9 Remote Crash with Certain RPZ Configurations Two defects were discovered in ISC's BIND 9 code. These defects only affect BIND 9 servers which have recursion enabled and which use a specific feature of the software known as Response Policy Zones (RPZ) and where the RPZ zone contains a specific rule/action pattern. CVE: CVE-2011-2465 Document Version: 2.0 Posting date: 05 Jul 2011 Program Impacted: BIND Versions affected: 9.8.0, 9.8.0-P1, 9.8.0-P2 and 9.8.1b1 Other versions of BIND 9 not listed here are not vulnerable to this problem. Severity: High Exploitable: Remotely Description: A defect in the affected versions of BIND could cause the named process to exit when queried, if the server has recursion enabled and was configured with an RPZ zone containing certain types of records. Specifically, these are any DNAME record and certain kinds of CNAME records. The patch release of BIND 9.8.0-P4 alters the behavior of RPZ zones by ignoring any DNAME records in an RPZ zone, and correctly returning CNAME records from RPZ zones. Note that DNAME has no defined effect on the RPZ engine and its presence in an RPZ zone is ignored. The definitive list of meaningful patterns in an RPZ zone is given in the BIND 9 Administrative Reference Manual and also in ISC Technical Note 2010-1. CVSS Score: 7.8 CVSS Equation: (AV:N/AC:L/Au:N/C:N/I:N/A:C) For more information on the Common Vulnerability Scoring System and to obtain your specific environmental score please visit: http://nvd.nist.gov/cvss.cfm?calculatoradvversion=2 Workarounds: Do not put certain CNAME or any DNAME records into an RPZ zone file until your software can be patched. If you subscribe to a service which supplies your RPZ zone data, ensure that it does not contain any DNAME or certain CNAME records. The CNAME records which must not be used are those which signal the RPZ engine to rewrite query names. CNAME records which signal the RPZ engine to forge an NXDOMAIN response are not affected by this defect. An example of an RPZ rule which causes a query name to be rewritten is: *.malicious-domain.com CNAME walled-garden.isp.net An example of an RPZ rule which causes an NXDOMAIN response to be returned is: *.malicious-domain.com CNAME . Please refer to the BIND 9 Administrative Reference Manual or to ISC Technical Note 2010-1 for more information about the Response Policy Zone (RPZ) feature which was added to BIND 9 in Version 9.8.0. Active exploits: ISC received reports of this software flaw and verified the report's accuracy. Solution: Upgrade to: 9.8.0-P4. (Note that 9.8.0-P3 is not affected but has been replaced by 9.8.0-P4 due to CVE-2011-2464) Download this version from the following location: ISC releases of BIND 9 software may be downloaded from http://www.isc.org/software/bind If you do not obtain your BIND software directly from ISC, contact your operating system or software vendor for an update. If you are participating in ISC's Beta or release candidate (RC) program, please upgrade. ISC Beta/RC testers are expected to remove vulnerable versions and upgrade. No security advisories are issued for beta / release candidates once the corresponding final release is made. Acknowledgement: ISC thanks Bryce Moore from TELUS Security Labs for finding and reporting this issue. Document Revision History Version 1.0 - 14 June 2011: Phase One Disclosure Date Version 1.1 - 20 June 2011: Phase Two Disclosure Date with updates. Version 1.2 - 21 June 2011: Updates on beta, RC, and clarity editing Version 1.3 - 24 June 2011: Added document URL Version 1.4 - 28 June 2011: Updated Solution and description (revised to recommend 9.8.0-P4 per CVE-2011-2464) Version 1.5 - 4 July 2011: Phase Three and Four Disclosure Date Version 2.0 - 5 July 2011: Public Disclosure References: Do you have Questions? Questions regarding this advisory should go to security-offi...@isc.org. Do you need Software Support? Questions on ISC's Support services or other offerings should be sent to sa...@isc.org. More information on ISC's support and other offerings are available at: http://www.isc.org/community/blog/201102/BIND-support ISC Security Vulnerability Disclosure Policy Details of our current security advisory policy and practice can be found here: https://www.isc.org/security-vulnerability-disclosure-policy Legal Disclaimer:: Internet Systems Consortium (ISC) is providing this notice on an AS IS basis. No warranty or guarantee of any kind is expressed in this notice and none should be implied. ISC expressly excludes and disclaims any warranties regarding this notice or materials referred to in this notice, including, without limitation, any implied warranty of merchantability, fitness for a particular purpose, absence of hidden defects, or of non-infringement. Your use or reliance on this notice or materials referred to in this notice is at your own risk. ISC may change this
Re: Re: Multiple Cross-Site Scripting vulnerabilities in WebCalendar
No response from vendor so far! And no I didn't request a CVE-identifier, so I'd really appreciate your help :) Best regards, Stefan
Re: [Full-disclosure] Ubuntu: reseed(8), random.org, and HTTP request
[ But for what it's worth, I am willing to bet that the script was added without analyzing these subtle considerations, and that makes it somewhat scary on its own accord. ] /mz
