date:20051109

Re: [Full-disclosure] sugget a small pentest distro

2005-11-09 Thread sith

Hi:

On Wed, Nov 09, 2005 at 12:41:41PM +0530, crazy frog crazy frog wrote:
 Hi,
 i know ab tlal thjose distros auditor,phlak,whax etc but what i want

I would still reccomend that you stick with whax (or whatever the name du
jour is).  It's very modular, and you can easily remove the modules that you
consider less important for your work.  You might have to cut a lot out, but
AFAIK there's nothing else that has as much functionality, is updated, and
still works well.  Even just having all the wireless driver patches in one
kernel is nice.

 is a distro whose size is much smaller among this distros.

*shrugs*.  It fits and boots fine on my USB keychain.  Are you trying to
fit it on a business card or something?

good luck, 
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Schwarzenegger Has Trouble With Voting Computers: Already Voted? How many others?

2005-11-09 Thread Jei


How can a system this badly broken still be in use and maintain control?

http://www.cbsnews.com/stories/2005/11/08/politics/main1027281.shtml

Nobody bothers to even ask how many other votes there were already
in the system or what happened to them? Who was in charge of inputting
the votes, how many people's votes did he input, who did he have them
vote for and why didn't he purge them after the test?

http://nightweed.com/usavotefacts.html

The US elections are clearly invalid, even by the lowest banana-state 
standards. Why is no accountability taking place?

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] sugget a small pentest distro

2005-11-09 Thread Robert P. McKenzie

You could ofcourse take any one of the distros and install it on a 1G thumb 
drive.. then you'd have a rightable area on
a bootable device to store your results.  And it's much smaller then even a 
mini-cd.

crazy frog crazy frog wrote:
 Hi,
 i know ab tlal thjose distros auditor,phlak,whax etc but what i want
 is a distro whose size is much smaller among this distros.
 thanks
 
 
 
 On 11/9/05, John Smith [EMAIL PROTECTED] wrote:
 
I like knoppix STD, it fits on a CD, but hasn't been updated in sometime.

First hit on google for live linux cds

http://www.frozentech.com/content/livecd.php?pick=Allshowonly=security

I even narrowed it down to the security section for your lazy ass.

crazy frog crazy frog wrote:

Hi,
can anyone suggest a small pentest liux distro.smallest means(under
250 mb.),i seen one on whax site.has any one used it?
no google please
--
ting ding ting ding ting ding
ting ding ting ding ding
i m crazy frog :)
oh yeah oh yeah...
 another wannabe, in hackerland!!!
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


 
 
 --
 ting ding ting ding ting ding
 ting ding ting ding ding
 i m crazy frog :)
 oh yeah oh yeah...
  another wannabe, in hackerland!!!
 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

-- 
Robert P. McKenzie, CSTA, MBCS |   GammaRay Technical Services Ltd
[EMAIL PROTECTED] | [EMAIL PROTECTED]
http://www.uk-experience.com   |  http://www.gammaray-tech.com
   Fancy some fun?  http://www.thewetwilly.com
Ecademy Profile:   http://www.ecademy.com/user/robertmckenzie
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] [SECURITY] [DSA 890-1] New libungif4 packages fix several vulnerabilities

2005-11-09 Thread Martin Schulze

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

- --
Debian Security Advisory DSA 890-1 [EMAIL PROTECTED]
http://www.debian.org/security/ Martin Schulze
November 9th, 2005  http://www.debian.org/security/faq
- --

Package: libungif4
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE IDs: CVE-2005-2974 CVE-2005-3350
Debian Bug : 337972

Chris Evans discovered several security related problems in libungif4,
a shared library for GIF images.  The Common Vulnerabilities and
Exposures project identifies the following vulnerabilities:

CVE-2005-2974

Null pointer dereference, that could cause a denial of service.

CVE-2005-3350

Out of bounds memory access that could cause a denial of service
or the execution of arbitrary code.

For the old stable distribution (woody) these problems have been fixed in
version 4.1.0b1-2woody1.

For the stable distribution (sarge) these problems have been fixed in
version 4.1.3-2sarge1.

For the unstable distribution (sid) these problems will be fixed soon.

We recommend that you upgrade your libungif4 packages.


Upgrade Instructions
- 

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- 

  Source archives:


http://security.debian.org/pool/updates/main/libu/libungif4/libungif4_4.1.0b1-2woody1.dsc
  Size/MD5 checksum:  675 193e9d1e48023d8d8a68b6b47117bd3d

http://security.debian.org/pool/updates/main/libu/libungif4/libungif4_4.1.0b1-2woody1.diff.gz
  Size/MD5 checksum:27508 91b78e7830e28f8a249a47ec8b56

http://security.debian.org/pool/updates/main/libu/libungif4/libungif4_4.1.0b1.orig.tar.gz
  Size/MD5 checksum:   351757 20d96eb90cf818a1da093614c44ad3e5

  Alpha architecture:


http://security.debian.org/pool/updates/main/libu/libungif4/libungif-bin_4.1.0b1-2woody1_alpha.deb
  Size/MD5 checksum:   285014 9e17b79f15df1cfb9aedd60feba2afe9

http://security.debian.org/pool/updates/main/libu/libungif4/libungif4-dev_4.1.0b1-2woody1_alpha.deb
  Size/MD5 checksum:40756 8097a2e1e0fa17b39e4fdfd9bc28879d

http://security.debian.org/pool/updates/main/libu/libungif4/libungif4g_4.1.0b1-2woody1_alpha.deb
  Size/MD5 checksum:54530 4ac2a7261df16ee8d10bc21c36a295b5

  ARM architecture:


http://security.debian.org/pool/updates/main/libu/libungif4/libungif-bin_4.1.0b1-2woody1_arm.deb
  Size/MD5 checksum:   202104 46a240858733d79c0baf5ebe6c243ff1

http://security.debian.org/pool/updates/main/libu/libungif4/libungif4-dev_4.1.0b1-2woody1_arm.deb
  Size/MD5 checksum:36502 9ed4b465c89df64bba1514ce82aec53b

http://security.debian.org/pool/updates/main/libu/libungif4/libungif4g_4.1.0b1-2woody1_arm.deb
  Size/MD5 checksum:51430 06180a7e6f55d6f6e2d4db7201f4180f

  Intel IA-32 architecture:


http://security.debian.org/pool/updates/main/libu/libungif4/libungif-bin_4.1.0b1-2woody1_i386.deb
  Size/MD5 checksum:   201766 9c5ce5176dd0699241aeb96fb5546461

http://security.debian.org/pool/updates/main/libu/libungif4/libungif4-dev_4.1.0b1-2woody1_i386.deb
  Size/MD5 checksum:33840 d368a92eeff505e55277410786af1b45

http://security.debian.org/pool/updates/main/libu/libungif4/libungif4g_4.1.0b1-2woody1_i386.deb
  Size/MD5 checksum:50088 3b0fbc30998dff62708290f4c86f2d00

  Intel IA-64 architecture:


http://security.debian.org/pool/updates/main/libu/libungif4/libungif-bin_4.1.0b1-2woody1_ia64.deb
  Size/MD5 checksum:   256632 eac1e46e0c49533af5d434a9a6d8f8fa

http://security.debian.org/pool/updates/main/libu/libungif4/libungif4-dev_4.1.0b1-2woody1_ia64.deb
  Size/MD5 checksum:45352 a6f1dc47e819dfe577c8ea404e8b5276

http://security.debian.org/pool/updates/main/libu/libungif4/libungif4g_4.1.0b1-2woody1_ia64.deb
  Size/MD5 checksum:60604 3bc0eab856905cca5f9a0523a6ddaff8

  HP Precision architecture:


http://security.debian.org/pool/updates/main/libu/libungif4/libungif-bin_4.1.0b1-2woody1_hppa.deb
  Size/MD5 checksum:   217600 9037e57c508a9f57a4dd594688e218b5

http://security.debian.org/pool/updates/main/libu/libungif4/libungif4-dev_4.1.0b1-2woody1_hppa.deb
  Size/MD5 checksum:38582 52a9dd58156cf29265be55342cfe9976

http://security.debian.org/pool/updates/main/libu/libungif4/libungif4g_4.1.0b1-2woody1_hppa.deb
  Size/MD5 checksum:

AW: [Full-disclosure] sugget a small pentest distro

2005-11-09 Thread Obando, David DE - EV

Hi,

I use Damn Small Linux (http://www.damnsmalllinux.org) on a USB stick.
It's about 50MB and really helpful!


Regards,
David

 Hi,
 can anyone suggest a small pentest liux distro.smallest 
 means(under 
 250 mb.),i seen one on whax site.has any one used it?
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Security Updates Without Rebooting

2005-11-09 Thread Joachim Schipper

On Mon, Nov 07, 2005 at 10:42:11PM +, Carlos Silva aka|Danger_Man| wrote:
 Hello all,
 
 Can someone explain how to apply security patches on the system without 
 rebooting the machine?
 
 I guess that I cant patch the kernel without compiling and rebooting the 
 machine, so the only way is with iptables and keeping the daemons fresh?
 
 Regards,
 
 Carlos Silva,

If we are talking some *nix, just stop the vulnerable daemon, update,
and start it again. Not very difficult...

Patching the kernel while running is be possible, but hardly practical -
unless you are very, very good. I've never seen it done, but it does
happen in rootkits and is said to be possible in many cases.

(What seems, to me, to be more practical is just to build a modular
Linux kernel and update only the vulnerable module with the most minimal
patch you can find - however, this only works with very modular kernels,
OpenBSD wouldn't be helped much by this. Then again, patching the
OpenBSD kernel isn't required too often...)

Joachim
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] sugget a small pentest distro

2005-11-09 Thread michael tewner

metasploit?

Virtually,
mike


On Wed, 9 Nov 2005, crazy frog crazy frog wrote:

 Hi,
 can anyone suggest a small pentest liux distro.smallest means(under
 250 mb.),i seen one on whax site.has any one used it?
 no google please
 --
 ting ding ting ding ting ding
 ting ding ting ding ding
 i m crazy frog :)
 oh yeah oh yeah...
  another wannabe, in hackerland!!!
 ___
 Full-Disclosure - We believe in it.
 Charter: http://lists.grok.org.uk/full-disclosure-charter.html
 Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] [SECURITY] [DSA 891-1] New gpsdrive packages fix arbitrary code execution

2005-11-09 Thread Martin Schulze

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

- --
Debian Security Advisory DSA 891-1 [EMAIL PROTECTED]
http://www.debian.org/security/ Martin Schulze
November 9th, 2005http://www.debian.org/security/faq
- --

Package: gpsdrive
Vulnerability  : format string
Problem type   : remote
Debian-specific: no
CVE ID : CVE-2005-3523

Kevin Finisterre discovered a format string vulnerability in gpsdrive,
a car navigation system, that can lead to the execution of arbitrary
code.

The old stable distribution (woody) does not contain gpsdrive packages.

For the stable distribution (sarge) this problem has been fixed in
version 2.09-2sarge1.

For the unstable distribution (sid) this problem has been fixed in
version 2.09-2sarge1.

We recommend that you upgrade your gpsdrive package.


Upgrade Instructions
- 

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- 

  Source archives:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1.dsc
  Size/MD5 checksum:  650 7e940e752e94bdce9faa0edaa7b599a7

http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1.diff.gz
  Size/MD5 checksum: 5709 c68c7972e819dbf915309b3dff6d8d00

http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09.orig.tar.gz
  Size/MD5 checksum:  1745509 eaa52cb220f3d10312a1046dd47126bb

  Alpha architecture:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1_alpha.deb
  Size/MD5 checksum:  1341932 edb897742d7478528b35f8d977e3b617

  AMD64 architecture:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1_amd64.deb
  Size/MD5 checksum:  1309112 fe28e7fc09fabb7df65b01a6fbad7306

  ARM architecture:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1_arm.deb
  Size/MD5 checksum:  1340502 b1575cef87779bb5bd674a8570e55b81

  Intel IA-32 architecture:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1_i386.deb
  Size/MD5 checksum:  1305800 6f735e27bacc7248585eca1b9f8d3f11

  Intel IA-64 architecture:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1_ia64.deb
  Size/MD5 checksum:  1394362 1dcd199eb12a793a0d6849ef0a13ced6

  HP Precision architecture:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1_hppa.deb
  Size/MD5 checksum:  1344952 2e3fea6bf831df8a7bd2d040004c335f

  Motorola 680x0 architecture:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1_m68k.deb
  Size/MD5 checksum:  1286134 560e1f077a2699c86aa250de29e1cf49

  Big endian MIPS architecture:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1_mips.deb
  Size/MD5 checksum:  1305774 9cb3ec7b0e1745a4e13d8d58dcfaa18f

  Little endian MIPS architecture:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1_mipsel.deb
  Size/MD5 checksum:  1300386 2e434f792c53410379c1c5115fe1780b

  PowerPC architecture:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1_powerpc.deb
  Size/MD5 checksum:  1316684 c188aada3e18d94c707d9a27a8e909b1

  IBM S/390 architecture:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1_s390.deb
  Size/MD5 checksum:  1297600 18c6e478df84b060459da8ecbe8f5c11

  Sun Sparc architecture:


http://security.debian.org/pool/updates/main/g/gpsdrive/gpsdrive_2.09-2sarge1_sparc.deb
  Size/MD5 checksum:  1302592 ba2648e0afeb356323a6c65a87ba7b77


  These files will probably be moved into the stable distribution on
  its next update.

- 
-
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security 
dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show pkg' and http://packages.debian.org/pkg

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDcdXoW5ql+IAeqTIRAtNEAJ9sPURbD823DuEpdd/3ArI5jIh7sQCaA4Ns
P5fV/I49dkcecDaPbR/6kr4=
=xM3B
-END PGP SIGNATURE-

___
Full-Disclosure -

Re: [Full-disclosure] sugget a small pentest distro

2005-11-09 Thread Marlon Jabbur

You can customize WHAX (http://www.iwhax.net) so you can have it on the size 
you want.

On Wednesday 09 November 2005 03:51, crazy frog crazy frog wrote:
 Hi,
 can anyone suggest a small pentest liux distro.smallest means(under
 250 mb.),i seen one on whax site.has any one used it?
 no google please
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] CYBSEC - Security Advisory: HTTP Response Splitting in SAP WAS

2005-11-09 Thread Leandro Meiners

(The following advisory is also available in PDF format for download at:
http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf
)

CYBSEC S.A.
www.cybsec.com

Advisory Name: HTTP Response Splitting in SAP WAS (Web Application
Server)

Vulnerability Class: HTTP Response Splitting

Release Date: 11/09/2005

Affected Applications:
* SAP WAS 6.10
* SAP WAS 6.20
* SAP WAS 6.40
* SAP WAS 7.00

Affected Platforms:
* Platform-Independent

Local / Remote: Remote

Severity: High

Author: Leandro Meiners.

Vendor Status:
* Confirmed, patch released.

Reference to Vulnerability Disclosure Policy:
http://www.cybsec.com/vulnerability_policy.pdf

Product Overview:
=

SAP Web Application Server is an open standard-based platform for
developing, and implementing Web applications. SAP Web Application
Server is a crucial component of mySAP® Technology platform as it serves
as the underlying infrastructure for many SAP solutions (for example,
SAP Portal).

SAP WAS provides a development infrastructure on which to develop,
distribute, and execute platform-independent Web services and business
applications. SAP Web Application Server supports ABAP, Java, and Web
services.

The vulnerability discovered only applies to the BSP runtime of SAP WAS.

Vulnerability Description:
==

SAP Web Application Server was found to be vulnerable to HTTP Response
Splitting, in the parameter sap-exiturl. For further reference regarding
HTTP Response Splitting see the whitepaper HTTP Response Splitting, Web
Cache Poisoning Attacks, and Related Topics (available at:
http://www.packetstormsecurity.org/papers/general/whitepaper_httpresponse.pdf)

Exploit (PoC):
==

If the string %0a%0dHeader:+Value is passed (omitting the double
quotes) as the value for the parameter sap-exiturl the string Header:
value (without the double quotes) is considered as another HTTP header,
indicating the presence of the vulnerability.

Solutions:
==

The solution, provided by SAP, is to disable support for the parameter
in older 6.10 releases as well as SP's in 6.20 prior to SP54. For new
6.20 and 7.00 releases the sap-exiturl parameter will be submitted to a
customer configured white-list. For further information see SAP Note
887322.

Vendor Response:

* 09/23/2005: Initial Vendor Contact.
* 09/27/2005: Technical details for the vulnerabilities sent to vendor.
* 10/14/2005: Solutions provided by vendor for all vulnerabilities.
* 11/09/2005: Coordinate release of advisory.

Contact Information:

For more information regarding the vulnerability feel free to contact
the author at lmeinersatcybsec.com.

For more information regarding CYBSEC: www.cybsec.com

Leandro Meiners
CYBSEC S.A. Security Systems
E-mail: [EMAIL PROTECTED]
Tel/Fax: [54-11] 4382-1600
Web: http://www.cybsec.com
PGP-Key: http://pgp.mit.edu:11371/pks/lookup?search=lmeinersop=index

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] CYBSEC - Security Advisory: Phishing Vector in SAP WAS

2005-11-09 Thread Leandro Meiners

(The following advisory is also available in PDF format for download at:
http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Phishing_Vector_in_SAP_WAS.pdf
)

CYBSEC S.A.
www.cybsec.com

Advisory Name: Phishing Vector in SAP WAS (Web Application Server)

Vulnerability Class: Phishing Vector / Improper Input Validation

Release Date: 11/09/2005

Affected Applications:
* SAP WAS 6.10
* SAP WAS 6.20
* SAP WAS 6.40
* SAP WAS 7.00

Affected Platforms:
* Platform-Independent

Local / Remote: Remote

Severity: Medium

Author: Leandro Meiners.

Vendor Status:
* Confirmed, patch released.

Reference to Vulnerability Disclosure Policy:
http://www.cybsec.com/vulnerability_policy.pdf

Product Overview:
=

The vulnerability discovered only applies to the BSP runtime of SAP WAS.

Vulnerability Description:

SAP Web Application Server was found to provide a vector to allow
Phishing scams against SAP WAS applications.

Exploit (Poc):
==

The parameter sap-exiturl allows absolute URLs, such as
http://www.google.com by specifying http://; as http%3a%2f%2f. This
together with the parameter sap-sessioncmd, can be used to mount a
Phishing scam by sending a link like
http://sap-was/sap/bc/BSp/sap/menu/fameset.htm?sap--essioncmd=closesapexiturl=http%3a%2f%2fwww.attacker.com
that will logout the user from the application (sap-sessioncmd=close), even if
not logged in, and redirect to the attacker site.

Solutions:
==

Vendor Response:

Contact Information:

For more information regarding the vulnerability feel free to contact
the author at lmeinersatcybsec.com.

For more information regarding CYBSEC: www.cybsec.com

Leandro Meiners
CYBSEC S.A. Security Systems
E-mail: [EMAIL PROTECTED]
Tel/Fax: [54-11] 4382-1600
Web: http://www.cybsec.com
PGP-Key: http://pgp.mit.edu:11371/pks/lookup?search=lmeinersop=index

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] CYBSEC - Security Advisory: Multiple XSS in SAP WAS

2005-11-09 Thread Leandro Meiners

(The following advisory is also available in PDF format for download at:
http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf
)

CYBSEC S.A.
www.cybsec.com

Advisory Name: Multiple XSS in SAP WAS (Web Application Server)

Vulnerability Class: Cross-Site Scripting

Release Date: 11/09/2005

Affected Applications:
* SAP WAS 6.10
* SAP WAS 6.20
* SAP WAS 6.40
* SAP WAS 7.00

Affected Platforms:
* Platform-Independent

Local / Remote: Remote

Severity: Medium

Author: Leandro Meiners.

Vendor Status:
* Confirmed, patch released.

Reference to Vulnerability Disclosure Policy:
http://www.cybsec.com/vulnerability_policy.pdf

Product Overview:
=

The vulnerability discovered only applies to the BSP runtime of SAP WAS.

Vulnerability Description:

SAP Web Application Server was found to be vulnerable to JavaScript
injection, allowing for Cross-Site Scripting attacks. Three different
vectors for script injection where discovered:
* Error Pages (in error messages displayed) (SAP WAS 6.20 and above not
Vulnerable)
* The syscmd parameter
* SYSTEM PUBLIC (Test Application)

Exploit (Poc):
==

Following is a Proof of Concept for each script injection vector:
* Error Pages:
http://sap-was/sap/bc/BSp/sap/index.html%3Cscript%3Ealert('xss')%
3C/script%3E
* The syscmd parameter:
http://sap-was/sap/bc/BSp/sap/menu/fameset.htm?sap-sessioncmd=opensap-syscmd=%3Cscript%3Ealert('xss')%3C/script%3E
* Test Application (SYSTEM PUBLIC):
In BspApplication field it is possible to inject JavaScript code such
as: scriptalert('xss')/script.

Solutions:
==

For solutions regarding Error Pages and the syscmd parameter as attack
vectors please see SAP Note 887323, which indicates Service Packs to
apply.

For solutions regarding SYSTEM PUBLIC Test Application please see SAP
Note 887164 which lists all test applications that shouldn't be
activated on production systems. Regarding XSS issues the BSP compiler
has been extended to have a new forceEncode=HTML page directive, for
more information see SAP Note 887168. This new feature will be applied
to test applications in the next SP cycle. All test applications should
always be removed from production systems, customers can use transaction
SMICM to disable the test applications.

Vendor Response:

Thanks:
===

Special thanks go to Mariano Nuñez Di Croce.

Contact Information:

For more information regarding the vulnerability feel free to contact
the author at lmeinersatcybsec.com.

For more information regarding CYBSEC: www.cybsec.com

Leandro Meiners
CYBSEC S.A. Security Systems
E-mail: [EMAIL PROTECTED]
Tel/Fax: [54-11] 4382-1600
Web: http://www.cybsec.com
PGP-Key: http://pgp.mit.edu:11371/pks/lookup?search=lmeinersop=index

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Re: sugget a small pentest distro

2005-11-09 Thread José Luis González


Maybe you can try SLAX LIVE CD (http://slax.linux-live.org).
Great useful desktop distro (185mb).

Kind regards,
JLG


crazy frog crazy frog wrote:


Hi,
can anyone suggest a small pentest liux distro.smallest means(under
250 mb.),i seen one on whax site.has any one used it?
no google please
--
ting ding ting ding ting ding
ting ding ting ding ding
i m crazy frog :)
oh yeah oh yeah...
another wannabe, in hackerland!!!

--
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
futile against web application hacking. Check your website for vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers do! 
Download Trial at:


http://www.securityfocus.com/sponsor/pen-test_050831
---


 



___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

50 matches

Mail list logo