Re: [Full-disclosure] Full Disclosure of What ?
On Sun, Jan 11, 2009 at 2:24 AM, Gomer Stackseg wrote: > G'day to the FD list: > > Security and vulnerability research ? It would really be of great > benefit to turn this list into something more than it currently is. > There is a wealth of very intelligent, creative and humourous people > who post to this list, and I enjoy what they have to say but there is > a lot of repetitive tedium. There is also a wealth of stupidity that > shifts the fulcrum from center. > > I find the interplay between netdev and ureleet to be a defining > element of inanity, misanthropy and sheer waste of bandwidth. Who > cares about the pissing between what appears to be two colossal noise > generating clowns ? I know this will piss someone off and I'll look > forward to the high-end feedback I will receive. I am not _trolling_ > but making clear a premise to get back to what this list is about. > Maybe there are others who are in the security arena who feel the > same, who believe in full disclosure, and are professionals with > professional reputations and (significant) contributions to the > security and vulnerability research world. Blackhats, Whitehats and > Grayhats all have something of great value to contribute when > presented in an intelligent environment. > > I am mystified by this omnipresent Andrew Wallace / netdev persona. > You say you will "go away" (for the betterment of all) then you come > right back like a spoiled child. What an infantile personality. I > hope you realize that you absolutely foster the whole "living in your > mother's basement" scenario. I have always believed strongly that > there are certain people who are placed on earth as examples to others > of what never to become. This person fills that requirement in a > superlative fashion. What an idiot to make statements about working > for an intelligence agency in an abysmal effort to inflate his > (absence of) self-worth. What a pathetic and delusional psychological > profile this presents. Again, this is the play of a little baby in a > little baby's world order, where he commands an army of 4500 straw > sycophants who are transfixed at his elemental presence. > > In any event, I hope that an attitude that fosters learning and > intelligent discussion will eclipse the "security cut-and-paste > carnival" attitude I see that prevails. Although I see this > attenuated when the threats of being sued arose. What an epically > funny thread that was ! > > But in the mean time, please continue to rant about the trivial and > cut-and-paste / link current events for us, and speak of "secret > intelligence agent" escapades I think there is hope that this will > change when people get serious about a profoundly serious topic that > affects everyone. > > Cheers to all ! > > Gomer Stackseg I don't know why people treat me the way they do its something the list has come to live with that everything I do and say is discredited. All I can do is keep going and wait for their balls to drop then they'll realise i'm a real person who isn't delusional. Thanks! ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] e-Holocaust
Wow, congratulations. While people on both sides are risking their lives and in some cases making the ultimate sacrifice by loosing their life for their friends, family and country; you've hacked some worthless Israeli websites- thus once again proving lawyers and artists in all countries don't know how to apply security patches to their servers.I'm sure the IDF is cowering in fear over your awesome power, amazing resources and limitless influence- just like every other script kiddie out there. Can we all now schedule the parade and present you with your medal for being the lamest excuse of a terrorist / freedom fighter / human being of the week? Then to prove just how pathetic you really are, you don't even have the balls to publicly show your face and have to hide behind an anonymous email address- all while real men are out there on the streets in harms way. Even the worthless politicians are doing more and taking bigger risks then you. Normally I'd suggest to go crawl back into your hiding hole, but since you've never actually came out; I'll just say shut up and let the adults deal with it, because clearly you don't have what it takes to make a real difference in the world. - Rants On Sat, Jan 10, 2009 at 3:34 PM, wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > To Whom it may concern: > > Peace be upon all you. > > Behold the e-Holocaust: > > http://israelcivillaw.com/ > http://israelcommerciallaw.com/ > http://www.israel-forum.co.il/ > http://mynotebook.co.il/ > http://ada-art.co.il/ > http://harambam.co.il/ > http://sigalit-studio.co.il/ > http://sgms.co.il/ > http://two.org.il/ > http://magia-li.co.il/ > http://plastikim.co.il/ > http://maasik.co.il/ > http://vision-art.co.il/ > http://man-go.co.il/ > http://drabba.co.il/ > http://gal-alpron.co.il/ > http://djgazala.com/ > http://eseknet.biz/ > http://michlala.co.il/ > http://yd-albert.co.il/ > http://refaeli-art.com/ > > > As for who we are, as far as the world is concerned, we do not > exist, we are not a group, we are a state of mind, do not try to > track us down, as we shall stay in the undergrounds, watching them > and taking them down where necessary... > > We do what we do because we can, and as it is the fair judgement. > As it can be implied we have access to resources that should not be > taken lightly. > > As for what we want, we want nothing but the world to see this ( > and we will make sure the world does see it ). > What we'll do is take down tens of Israeli servers daily, and burn > them to the ground, every bit of information on them will be > deleted... > > That will only be the beginning, when that is done, next step would > be the full publicising of every all information gathered. > > > This is our war now. > -BEGIN PGP SIGNATURE- > Charset: UTF8 > Version: Hush 3.0 > Note: This signature can be verified at https://www.hushtools.com/verify > > wpwEAQMCAAYFAklpMH4ACgkQiG0lprPxISpBMgQAhA5c6ydTowzBcD1EEWrYsv6dIuLx > T2ULI3W+fNstMY38G0Bp2rjc2KaVcGGUrtX5x0Ic7KNEtfFOf9UAPatnE6YOwaM5Xl27 > kpvIePf3LHirLHx36uHgkazmZwM25wpLnhgrFTFTAuFd88uO7ZEbzXjYA3BJ7KE9SJvd > tdOu234= > =H3kv > -END PGP SIGNATURE- > > -- > Become a medical transcriptionist at home, at your own pace. > > http://tagline.hushmail.com/fc/PnY6qxthN5KaG9cIzZbORL2U4Bn8ziSqE3rgbpXdvLsZgRLQdj3hG/ > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Full Disclosure of What ?
G'day to the FD list: Security and vulnerability research ? It would really be of great benefit to turn this list into something more than it currently is. There is a wealth of very intelligent, creative and humourous people who post to this list, and I enjoy what they have to say but there is a lot of repetitive tedium. There is also a wealth of stupidity that shifts the fulcrum from center. I find the interplay between netdev and ureleet to be a defining element of inanity, misanthropy and sheer waste of bandwidth. Who cares about the pissing between what appears to be two colossal noise generating clowns ? I know this will piss someone off and I'll look forward to the high-end feedback I will receive. I am not _trolling_ but making clear a premise to get back to what this list is about. Maybe there are others who are in the security arena who feel the same, who believe in full disclosure, and are professionals with professional reputations and (significant) contributions to the security and vulnerability research world. Blackhats, Whitehats and Grayhats all have something of great value to contribute when presented in an intelligent environment. I am mystified by this omnipresent Andrew Wallace / netdev persona. You say you will "go away" (for the betterment of all) then you come right back like a spoiled child. What an infantile personality. I hope you realize that you absolutely foster the whole "living in your mother's basement" scenario. I have always believed strongly that there are certain people who are placed on earth as examples to others of what never to become. This person fills that requirement in a superlative fashion. What an idiot to make statements about working for an intelligence agency in an abysmal effort to inflate his (absence of) self-worth. What a pathetic and delusional psychological profile this presents. Again, this is the play of a little baby in a little baby's world order, where he commands an army of 4500 straw sycophants who are transfixed at his elemental presence. In any event, I hope that an attitude that fosters learning and intelligent discussion will eclipse the "security cut-and-paste carnival" attitude I see that prevails. Although I see this attenuated when the threats of being sued arose. What an epically funny thread that was ! But in the mean time, please continue to rant about the trivial and cut-and-paste / link current events for us, and speak of "secret intelligence agent" escapades I think there is hope that this will change when people get serious about a profoundly serious topic that affects everyone. Cheers to all ! Gomer Stackseg ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] They don't realise I might work for MI5
On 1/9/09, andrew. wallace wrote: > You know nothing. But I know everything. ;) ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [ GLSA 200901-04 ] D-Bus: Denial of Service
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200901-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: D-Bus: Denial of Service Date: January 11, 2009 Bugs: #240308 ID: 200901-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis An error condition can cause D-Bus to crash. Background == D-Bus is a daemon providing a framework for applications to communicate with one another. Affected packages = --- Package/ Vulnerable /Unaffected --- 1 sys-apps/dbus < 1.2.3-r1 >= 1.2.3-r1 Description === schelte reported that the dbus_signature_validate() function can trigger a failed assertion when processing a message containing a malformed signature. Impact == A local user could send a specially crafted message to the D-Bus daemon, leading to a Denial of Service. Workaround == There is no known workaround at this time. Resolution == All D-Bus users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dbus-1.2.3-r1" References == [ 1 ] CVE-2008-3834 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3834 Availability This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200901-04.xml Concerns? = Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to secur...@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License === Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 signature.asc Description: This is a digitally signed message part. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [ GLSA 200901-02 ] JHead: Multiple vulnerabilities
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200901-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: JHead: Multiple vulnerabilities Date: January 11, 2009 Bugs: #242702, #243238 ID: 200901-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis Multiple vulnerabilities in JHead might lead to the execution of arbitrary code or data loss. Background == JHead is an exif jpeg header manipulation tool. Affected packages = --- Package / Vulnerable / Unaffected --- 1 media-gfx/jhead < 2.84-r1 >= 2.84-r1 Description === Marc Merlin and John Dong reported multiple vulnerabilities in JHead: * A buffer overflow in the DoCommand() function when processing the cmd argument and related to potential string overflows (CVE-2008-4575). * An insecure creation of a temporary file (CVE-2008-4639). * A error when unlinking a file (CVE-2008-4640). * Insufficient escaping of shell metacharacters (CVE-2008-4641). Impact == A remote attacker could possibly execute arbitrary code by enticing a user or automated system to open a file with a long filename or via unspecified vectors. It is also possible to trick a user into deleting or overwriting files. Workaround == There is no known workaround at this time. Resolution == All JHead users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/jhead-2.84-r1" References == [ 1 ] CVE-2008-4575 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4575 [ 2 ] CVE-2008-4639 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4639 [ 3 ] CVE-2008-4640 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4640 [ 4 ] CVE-2008-4641 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4641 Availability This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200901-02.xml Concerns? = Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to secur...@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License === Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 signature.asc Description: This is a digitally signed message part. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [ GLSA 200901-03 ] pdnsd: Denial of Service and cache poisoning
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200901-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: pdnsd: Denial of Service and cache poisoning Date: January 11, 2009 Bugs: #231285 ID: 200901-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis Two errors in pdnsd allow for Denial of Service and cache poisoning. Background == pdnsd is a proxy DNS server with permanent caching that is designed to cope with unreachable DNS servers. Affected packages = --- Package/ Vulnerable /Unaffected --- 1 net-dns/pdnsd < 1.2.7 >= 1.2.7 Description === Two issues have been reported in pdnsd: * The p_exec_query() function in src/dns_query.c does not properly handle many entries in the answer section of a DNS reply, related to a "dangling pointer bug" (CVE-2008-4194). * The default value for query_port_start was set to 0, disabling UDP source port randomization for outgoing queries (CVE-2008-1447). Impact == An attacker could exploit the second weakness to poison the cache of pdnsd and thus spoof DNS traffic, which could e.g. lead to the redirection of web or mail traffic to malicious sites. The first issue can be exploited by enticing pdnsd to send a query to a malicious DNS server, or using the port randomization weakness, and might lead to a Denial of Service. Workaround == Port randomization can be enabled by setting the "query_port_start" option to 1024 which would resolve the CVE-2008-1447 issue. Resolution == All pdnsd users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-dns/pdnsd-1.2.7" References == [ 1 ] CVE-2008-1447 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1447 [ 2 ] CVE-2008-4194 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4194 Availability This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200901-03.xml Concerns? = Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to secur...@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License === Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 signature.asc Description: This is a digitally signed message part. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [ GLSA 200901-01 ] NDISwrapper: Arbitrary remote code execution
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200901-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: NDISwrapper: Arbitrary remote code execution Date: January 11, 2009 Bugs: #239371 ID: 200901-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis Multiple buffer overflows might lead to remote execution of arbitrary code with root privileges. Background == NDISwrapper is a Linux kernel module that enables the use of Microsoft Windows drivers for wireless network devices. Affected packages = --- Package / Vulnerable / Unaffected --- 1 net-wireless/ndiswrapper < 1.53-r1>= 1.53-r1 Description === Anders Kaseorg reported multiple buffer overflows related to long ESSIDs. Impact == A physically proximate attacker could send packets over a wireless network that might lead to the execution of arbitrary code with root privileges. Workaround == There is no known workaround at this time. Resolution == All NDISwrapper users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=net-wireless/ndiswrapper-1.53-r1" References == [ 1 ] CVE-2008-4395 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4395 Availability This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200901-01.xml Concerns? = Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to secur...@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License === Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 signature.asc Description: This is a digitally signed message part. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] e-Holocaust
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 To Whom it may concern: Peace be upon all you. Behold the e-Holocaust: http://israelcivillaw.com/ http://israelcommerciallaw.com/ http://www.israel-forum.co.il/ http://mynotebook.co.il/ http://ada-art.co.il/ http://harambam.co.il/ http://sigalit-studio.co.il/ http://sgms.co.il/ http://two.org.il/ http://magia-li.co.il/ http://plastikim.co.il/ http://maasik.co.il/ http://vision-art.co.il/ http://man-go.co.il/ http://drabba.co.il/ http://gal-alpron.co.il/ http://djgazala.com/ http://eseknet.biz/ http://michlala.co.il/ http://yd-albert.co.il/ http://refaeli-art.com/ As for who we are, as far as the world is concerned, we do not exist, we are not a group, we are a state of mind, do not try to track us down, as we shall stay in the undergrounds, watching them and taking them down where necessary... We do what we do because we can, and as it is the fair judgement. As it can be implied we have access to resources that should not be taken lightly. As for what we want, we want nothing but the world to see this ( and we will make sure the world does see it ). What we'll do is take down tens of Israeli servers daily, and burn them to the ground, every bit of information on them will be deleted... That will only be the beginning, when that is done, next step would be the full publicising of every all information gathered. This is our war now. -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAklpMH4ACgkQiG0lprPxISpBMgQAhA5c6ydTowzBcD1EEWrYsv6dIuLx T2ULI3W+fNstMY38G0Bp2rjc2KaVcGGUrtX5x0Ic7KNEtfFOf9UAPatnE6YOwaM5Xl27 kpvIePf3LHirLHx36uHgkazmZwM25wpLnhgrFTFTAuFd88uO7ZEbzXjYA3BJ7KE9SJvd tdOu234= =H3kv -END PGP SIGNATURE- -- Become a medical transcriptionist at home, at your own pace. http://tagline.hushmail.com/fc/PnY6qxthN5KaG9cIzZbORL2U4Bn8ziSqE3rgbpXdvLsZgRLQdj3hG/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] They don't realise I might work for MI5
Everything to you on full-disclosure is fake or a lie. On Sat, Jan 10, 2009 at 11:23 PM, j-f sentier wrote: > Don't play like you post on your real name, everyone here know that it's > fake shit. > > > > >> >> 2009/1/9 andrew. wallace >>> >>> You know nothing. >>> >>> On Sat, Jan 10, 2009 at 1:54 AM, ghost wrote: >>> > If someone as incompetent as you works (this is me rolling my eyes >>> > like a 14 year old girl) for MI5 then the UK is in an even sadder >>> > state of affairs that I had originally believed. >>> > >>> > On Fri, Jan 9, 2009 at 8:47 PM, andrew. wallace >>> > wrote: >>> >> And then again, I might work for MI5. >>> >> >>> >> On Sat, Jan 10, 2009 at 1:43 AM, Ed Carp wrote: >>> >>> Yup. And I might be married to the Queen of Sheba, too... ;) >>> >>> >>> >>> ___ >>> >>> Full-Disclosure - We believe in it. >>> >>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>> >>> Hosted and sponsored by Secunia - http://secunia.com/ >>> >>> >>> >> >>> >> ___ >>> >> Full-Disclosure - We believe in it. >>> >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>> >> Hosted and sponsored by Secunia - http://secunia.com/ >>> >> >>> > >>> > ___ >>> > Full-Disclosure - We believe in it. >>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>> > Hosted and sponsored by Secunia - http://secunia.com/ >>> > >>> >>> ___ >>> Full-Disclosure - We believe in it. >>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>> Hosted and sponsored by Secunia - http://secunia.com/ >> >> > > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] They don't realise I might work for MI5
Don't play like you post on your real name, everyone here know that it's fake shit. > 2009/1/9 andrew. wallace > > You know nothing. >> >> On Sat, Jan 10, 2009 at 1:54 AM, ghost wrote: >> > If someone as incompetent as you works (this is me rolling my eyes >> > like a 14 year old girl) for MI5 then the UK is in an even sadder >> > state of affairs that I had originally believed. >> > >> > On Fri, Jan 9, 2009 at 8:47 PM, andrew. wallace >> > wrote: >> >> And then again, I might work for MI5. >> >> >> >> On Sat, Jan 10, 2009 at 1:43 AM, Ed Carp wrote: >> >>> Yup. And I might be married to the Queen of Sheba, too... ;) >> >>> >> >>> ___ >> >>> Full-Disclosure - We believe in it. >> >>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> >>> Hosted and sponsored by Secunia - http://secunia.com/ >> >>> >> >> >> >> ___ >> >> Full-Disclosure - We believe in it. >> >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> >> Hosted and sponsored by Secunia - http://secunia.com/ >> >> >> > >> > ___ >> > Full-Disclosure - We believe in it. >> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> > Hosted and sponsored by Secunia - http://secunia.com/ >> > >> >> ___ >> Full-Disclosure - We believe in it. >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> Hosted and sponsored by Secunia - http://secunia.com/ >> > > > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] AST-2009-001: Information leak in IAX2 authentication
*stiffles a giggle* What an interesting advisory/patch this is. I would humbly suggest having another go as gold stars will be awarded next time for correctness! On Thu, Jan 8, 2009 at 7:28 PM, Asterisk Security Team wrote: > Asterisk Project Security Advisory - AST-2009-001 > > ++ > | Product| Asterisk| > |--+-| > | Summary| Information leak in IAX2 authentication | > |--+-| > | Nature of Advisory | Unauthorized data disclosure| > |--+-| > |Susceptibility| Remote Unauthenticated Sessions | > |--+-| > | Severity | Minor | > |--+-| > |Exploits Known| Yes | > |--+-| > | Reported On | October 15, 2008| > |--+-| > | Reported By | http://www.unprotectedhex.com | > |--+-| > | Posted On | January 7, 2009 | > |--+-| > | Last Updated On| January 7, 2009 | > |--+-| > | Advisory Contact | Tilghman Lesher < tlesher AT digium DOT com > | > |--+-| > | CVE Name | CVE-2009-0041 | > ++ > > ++ > | Description | IAX2 provides a different response during authentication | > | | when a user does not exist, as compared to when the | > | | password is merely wrong. This allows an attacker to | > | | scan a host to find specific users on which to | > | | concentrate password cracking attempts. | > | | | > | | The workaround involves sending back responses that are | > | | valid for that particular site. For example, if it were | > | | known that a site only uses RSA authentication, then | > | | sending back an MD5 authentication request would | > | | similarly identify the user as not existing. The | > | | opposite is also true. So the solution is always to send | > | | back an authentication response that corresponds to a| > | | known frequency with which real authentication responses | > | | are returned, when the user does not exist. This makes | > | | it very difficult for an attacker to guess whether a | > | | user exists or not, based upon this particular | > | | mechanism. | > ++ > > ++ > | Resolution | Upgrade to revision 167259 of the 1.2 branch or 167260 of | > || the 1.4 branch or one of the releases noted below.| > ++ > > ++ > | Affected Versions| > || > | Product | Release | | > || Series | | > |+-+-| > |Asterisk Open Source| 1.2.x | All version prior to 1.2.31 | > |+-+-| > |Asterisk Open Source| 1.4.x | All versions prior to | > || | 1.4.23-rc4 | > |+---
[Full-disclosure] [ MDVSA-2009:002 ] bind
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2009:002 http://www.mandriva.com/security/ ___ Package : bind Date: January 9, 2009 Affected: 2008.0, 2008.1, 2009.0, Corporate 3.0, Corporate 4.0, Multi Network Firewall 2.0 ___ Problem Description: A flaw was found in how BIND checked the return value of the OpenSSL DSA_do_verify() function. On systems that use DNSSEC, a malicious zone could present a malformed DSA certificate and bypass proper certificate validation, which would allow for spoofing attacks (CVE-2009-0025). The updated packages have been patched to prevent this issue. ___ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0025 ___ Updated Packages: Mandriva Linux 2008.0: 4d8bb615d789fb539b9d1734c491c478 2008.0/i586/bind-9.4.2-1.2mdv2008.0.i586.rpm 87c1b2fbff77643a31aafdf9c6c09f25 2008.0/i586/bind-devel-9.4.2-1.2mdv2008.0.i586.rpm 6f4dc7ed71be367751ecac86554a32b8 2008.0/i586/bind-utils-9.4.2-1.2mdv2008.0.i586.rpm df296465880320a5acc53474d218a8fe 2008.0/SRPMS/bind-9.4.2-1.2mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: 5c884852aa09f3025ffe058cb54b9f88 2008.0/x86_64/bind-9.4.2-1.2mdv2008.0.x86_64.rpm 69a06c999d5123b56581cacbee4d6501 2008.0/x86_64/bind-devel-9.4.2-1.2mdv2008.0.x86_64.rpm 3e87d9dd7029295d61ff49c745380c68 2008.0/x86_64/bind-utils-9.4.2-1.2mdv2008.0.x86_64.rpm df296465880320a5acc53474d218a8fe 2008.0/SRPMS/bind-9.4.2-1.2mdv2008.0.src.rpm Mandriva Linux 2008.1: 3fcf472a623f98f6b29a16e5ee6413ea 2008.1/i586/bind-9.5.0-3.2mdv2008.1.i586.rpm 27cd99fef44c70694b884dec497034f9 2008.1/i586/bind-devel-9.5.0-3.2mdv2008.1.i586.rpm c0d3c204df9747afd3e2ecbc73e38a1c 2008.1/i586/bind-doc-9.5.0-3.2mdv2008.1.i586.rpm 1351f683acbbcb69372b57a65dcbbb2b 2008.1/i586/bind-utils-9.5.0-3.2mdv2008.1.i586.rpm 0a6584bc3845c30ce94d810eec3477e1 2008.1/SRPMS/bind-9.5.0-3.2mdv2008.1.src.rpm Mandriva Linux 2008.1/X86_64: 75e03449461a9b6397e3cc272d9b0ae6 2008.1/x86_64/bind-9.5.0-3.2mdv2008.1.x86_64.rpm 4accb3cac93749d2ffcf4ebb1f215e0f 2008.1/x86_64/bind-devel-9.5.0-3.2mdv2008.1.x86_64.rpm 2f392f0c8bf78794e0ab7331b8f9088a 2008.1/x86_64/bind-doc-9.5.0-3.2mdv2008.1.x86_64.rpm 6498639799f3e01b456408690577a136 2008.1/x86_64/bind-utils-9.5.0-3.2mdv2008.1.x86_64.rpm 0a6584bc3845c30ce94d810eec3477e1 2008.1/SRPMS/bind-9.5.0-3.2mdv2008.1.src.rpm Mandriva Linux 2009.0: ffe2f0861d8756c9b3ed9d14ad4a 2009.0/i586/bind-9.5.0-6.1mdv2009.0.i586.rpm e5cb25e86d6b6eb8cb11af2d35b79338 2009.0/i586/bind-devel-9.5.0-6.1mdv2009.0.i586.rpm 9525660813ecb71afbfa1c1a2752fa81 2009.0/i586/bind-doc-9.5.0-6.1mdv2009.0.i586.rpm 4dd77bef985adbcca799e9c91dff46a9 2009.0/i586/bind-utils-9.5.0-6.1mdv2009.0.i586.rpm 7c6cce8de90bae608e5ce4303a496347 2009.0/SRPMS/bind-9.5.0-6.1mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 879156944fa297b3e031effd85321a50 2009.0/x86_64/bind-9.5.0-6.1mdv2009.0.x86_64.rpm 83010c9835b1999368d06bc0eea1e7e4 2009.0/x86_64/bind-devel-9.5.0-6.1mdv2009.0.x86_64.rpm f1a9cb081c1f8623bc989405f616fa94 2009.0/x86_64/bind-doc-9.5.0-6.1mdv2009.0.x86_64.rpm ddee11a2ab8ba4cc4f110a137f2e23c3 2009.0/x86_64/bind-utils-9.5.0-6.1mdv2009.0.x86_64.rpm 7c6cce8de90bae608e5ce4303a496347 2009.0/SRPMS/bind-9.5.0-6.1mdv2009.0.src.rpm Corporate 3.0: bc30691c6e5090346b7b204ec5702b2b corporate/3.0/i586/bind-9.2.3-6.6.C30mdk.i586.rpm 36f94ef2e1ab87fbb0d0039a870377ac corporate/3.0/i586/bind-devel-9.2.3-6.6.C30mdk.i586.rpm 1afb8d0888ead2090dc90b261b76acc7 corporate/3.0/i586/bind-utils-9.2.3-6.6.C30mdk.i586.rpm a5fc0a956fd0c43b6358ce8d3f00ac0c corporate/3.0/SRPMS/bind-9.2.3-6.6.C30mdk.src.rpm Corporate 3.0/X86_64: 01aabfe65e5ad6cf2cd211ce180e30a4 corporate/3.0/x86_64/bind-9.2.3-6.6.C30mdk.x86_64.rpm 2981532cd1f67dcf453e0639c32a7444 corporate/3.0/x86_64/bind-devel-9.2.3-6.6.C30mdk.x86_64.rpm db5dc5dec31f79b9f66b012ccea864ad corporate/3.0/x86_64/bind-utils-9.2.3-6.6.C30mdk.x86_64.rpm a5fc0a956fd0c43b6358ce8d3f00ac0c corporate/3.0/SRPMS/bind-9.2.3-6.6.C30mdk.src.rpm Corporate 4.0: adbb89552fe47bedca9510c4dc5afb2b corporate/4.0/i586/bind-9.3.5-0.5.20060mlcs4.i586.rpm c97730040fc5fdec50b27af01400a654 corporate/4.0/i586/bind-devel-9.3.5-0.5.20060mlcs4.i586.rpm cda9dbdf5812985e082791b6d42d7d63 corporate/4.0/i586/bind-utils-9.3.5-0.5.20060mlcs4.i586.rpm 850659a5404cd6e73e5052d614b4416f corporate/4.0/SRPMS/bind-9.3.5-0.5.20060mlcs4.src.rpm Corporate 4.0/X86_64: fb0661018bc620472223e91e0ef04b6f corporate/4.0/x86_64/bind-9.3.5-0.5.20060mlcs4.x86_64.rpm f53884c61cb11ad2
