Re: [Full-disclosure] Botnet using Plesk vulnerability and takedown
wget http://botslayer.ru/final_solution.txt i've registered this domain just to save incompetent shitheads who blindly run any code which is supposed to "fix security problem". why have you included the non-existent domain in your code? thanks for your interesting investigation anyway. Cheers, Kai ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Botnet using Plesk vulnerability and takedown
What happened to the link.
On 6/8/13, kai wrote:
>> wget http://botslayer.ru/final_solution.txt
>
> i've registered this domain just to save incompetent shitheads who blindly
>
> run any code which is supposed to "fix security problem". why have you
> included the non-existent domain in your code?
>
> thanks for your interesting investigation anyway.
>
>
> Cheers,
>
> Kai
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
--
--
Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P
I.T Security Analyst and Penetration Tester
jgichuki at inbox d0t com
{FORUM}http://lists.my.co.ke/pipermail/security/
http://chuksjonia.blogspot.com/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] XSS in store.apple.com
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 After four weeks the following xss are still not fixed: Tested with IE8 / IE 10 & Google Chrome 27.0 http://store.apple.com/us/browse/home/shop_ipad#"/> http://store.apple.com/us/browse/home/shop_iphone#"/> https://secure2.store.apple.com/us/sign_in?c=aHR0cDovL3N0b3JlLmFwcGxlLmNvbS91c3wxYW9zZmU4OGZjNWIyNThhYWVhOTM5MzVjZjI2NTk1OGE3MWUwY2Y0MmI2OA&r=SDHCD9JUYKX777H9KT9JT7JJTAPAXHFKH&s=aHR0cHM6Ly9zZWN1cmUyLnN0b3JlLmFwcGxlLmNvbS91cy9hY2NvdW50L3NldHVwL3N0YXJ0P3BsdG49NjdDOTM5QUN8MWFvczYwZTU0ZmU1Y2E0Mjc1OTg4NzFiMTdjYzE5YjA1NjYxZTVkNDE4YzI&up=t#"/> Here is the advisory: Advisory: store.apple.com - DOM based Cross-site Scripting vulnerability Advisory ID: SSCHADV2013-009 Author: Stefan Schurtz Affected Software: Successfully tested on store.apple.com Vendor URL: http://www.apple.com Vendor Status: informed == Vulnerability Description == The website 'store.apple.com' is prone to a DOM based XSS vulnerability. == PoC-Exploit == // IE8 & IE 10 & Google Chrome 27.0 http://store.apple.com/us/browse/home/shop_ipad#"/> http://store.apple.com/us/browse/home/shop_iphone#"/> https://secure2.store.apple.com/us/sign_in?c=aHR0cDovL3N0b3JlLmFwcGxlLmNvbS91c3wxYW9zZmU4OGZjNWIyNThhYWVhOTM5MzVjZjI2NTk1OGE3MWUwY2Y0MmI2OA&r=SDHCD9JUYKX777H9KT9JT7JJTAPAXHFKH&s=aHR0cHM6Ly9zZWN1cmUyLnN0b3JlLmFwcGxlLmNvbS91cy9hY2NvdW50L3NldHVwL3N0YXJ0P3BsdG49NjdDOTM5QUN8MWFvczYwZTU0ZmU1Y2E0Mjc1OTg4NzFiMTdjYzE5YjA1NjYxZTVkNDE4YzI&up=t#"/> == Disclosure Timeline == 12-May-2013 - vendor informed by email 13-May-2013 - feedback from vendor 29-May-2013 - question about status 29-May-2013 - feedback from vendor 07-Jun-2013 - release date of this security advisory == Credits == Vulnerability found and advisory written by Stefan Schurtz. == References == http://www.apple.com http://www.darksecurity.de/advisories/2013/SSCHADV2013-009.txt -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.12 (MingW32) Comment: Thunderbird-Portable 3.1.20 by GnuPT - Gnu Privacy Tools Comment: Download at: http://thunderbird.gnupt.de iEYEARECAAYFAlGzq/0ACgkQg3svV2LcbMCgggCfSeoRw+JLielzk8wTjLps/TSb VioAoIrCq+w8TGVvhO1C2z7CMlApAvMS =6xb5 -END PGP SIGNATURE- 0x62DC6CC0.asc Description: application/pgp-keys ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] List Charter
[Full-Disclosure] Mailing List Charter John Cartwright - Introduction & Purpose - This document serves as a charter for the [Full-Disclosure] mailing list hosted at lists.grok.org.uk. The list was created on 9th July 2002 by Len Rose, and is primarily concerned with security issues and their discussion. The list is administered by John Cartwright. The Full-Disclosure list is hosted and sponsored by Secunia. - Subscription Information - Subscription/unsubscription may be performed via the HTTP interface located at http://lists.grok.org.uk/mailman/listinfo/full-disclosure. Alternatively, commands may be emailed to full-disclosure-requ...@lists.grok.org.uk, send the word 'help' in either the message subject or body for details. - Moderation & Management - The [Full-Disclosure] list is unmoderated. Typically posting will be restricted to members only, however the administrators may choose to accept submissions from non-members based on individual merit and relevance. It is expected that the list will be largely self-policing, however in special circumstances (eg spamming, misappropriation) then offending members may be removed from the list by the management. An archive of postings is available at http://lists.grok.org.uk/pipermail/full-disclosure/. - Acceptable Content - Any information pertaining to vulnerabilities is acceptable, for instance announcement and discussion thereof, exploit techniques and code, related tools and papers, and other useful information. Gratuitous advertisement, product placement, or self-promotion is forbidden. Disagreements, flames, arguments, and off-topic discussion should be taken off-list wherever possible. Humour is acceptable in moderation, providing it is inoffensive. Politics should be avoided at all costs. Members are reminded that due to the open nature of the list, they should use discretion in executing any tools or code distributed via this list. - Posting Guidelines - The primary language of this list is English. Members are expected to maintain a reasonable standard of netiquette when posting to the list. Quoting should not exceed that which is necessary to convey context, this is especially relevant to members subscribed to the digested version of the list. The use of HTML is discouraged, but not forbidden. Signatures will preferably be short and to the point, and those containing 'disclaimers' should be avoided where possible. Attachments may be included if relevant or necessary (e.g. PGP or S/MIME signatures, proof-of-concept code, etc) but must not be active (in the case of a worm, for example) or malicious to the recipient. Vacation messages should be carefully configured to avoid replying to list postings. Offenders will be excluded from the mailing list until the problem is corrected. Members may post to the list by emailing full-disclosure@lists.grok.org.uk. Do not send subscription/ unsubscription mails to this address, use the -request address mentioned above. - Charter Additions/Changes - The list charter will be published at http://lists.grok.org.uk/full-disclosure-charter.html. In addition, the charter will be posted monthly to the list by the management. Alterations will be made after consultation with list members and a consensus has been reached. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Botnet using Plesk vulnerability and takedown
We put that domain in as example, obviously we not disclose our real
domain. On that domain is the clean.pl script, obvious enough.
Also, thanks to person who register domain, you now have badass domain
name. Perhaps host the clean.pl as final_solution.txt in webroot?
> What happened to the link.
>
> On 6/8/13, kai wrote:
>>> wget http://botslayer.ru/final_solution.txt
>>
>> i've registered this domain just to save incompetent shitheads who
>> blindly
>>
>> run any code which is supposed to "fix security problem". why have you
>> included the non-existent domain in your code?
>>
>> thanks for your interesting investigation anyway.
>>
>>
>> Cheers,
>>
>> Kai
>>
>> ___
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>
> --
> --
> Gichuki John Ndirangu, C.E.H , C.P.T.P, O.S.C.P
> I.T Security Analyst and Penetration Tester
> jgichuki at inbox d0t com
>
> {FORUM}http://lists.my.co.ke/pipermail/security/
> http://chuksjonia.blogspot.com/
>
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Bluetooth Chat Connect v1.0 iOS - Multiple Vulnerabilities
Title: == Bluetooth Chat Connect v1.0 iOS - Multiple Vulnerabilities Date: = 2013-05-31 References: === http://www.vulnerability-lab.com/get_content.php?id=960 VL-ID: = 960 Common Vulnerability Scoring System: 3.9 Introduction: = Bluetooth application has small but pleasant features that promise to facilitate your life a little and add charm to it. Firstly, it allows user to turn on Bluetooth easily and quickly with just one tap without entering device settings. And that means that you can manage your Bluetooth distantly i.e. more conveniently and quickly. Secondly, the application allows managing your private on-line chat between two devices where you can chat with your talker freely and with no limits locating pretty far away from him/her. You don’t need to stop an interesting talk to your friend, business partner or beloved person during lectures, business meetings or at somebody’s presence. Bluetooth will let you have a talk quietly and without being noticed, to discuss what’s going on, to exchange your ideas and to send prompts and correct answers to each other. Bluetooth chat let you exchange quick messages with a friend of yours conveniently, amazingly and for free. Easy and compact interface allows you typing and sending your messages without any difficulties and connection problems. Bluetooth will make you and your talker feel private in everyone’s hearing allowing to talk to each other silently and without being noticed staying in a public place. Feel double happy – enjoy free and virtual talk and artfully turn on and off your Bluetooth for a pretty short period of time. (Copy of the Homepage: https://itunes.apple.com/app/bluetooth-chat/id608328404 ) Abstract: = The Vulnerability Laboratory Research Team discovered multiple vulnerabilities in the in the Bluetooth Connect Chat v1.0 iOS Application (Apple - iPad & iPhone). Report-Timeline: 2013-05-31: Public Disclosure Status: Published Affected Products: == Apple AppStore Product: Bluetooth Chat Connect 1.0 Exploitation-Technique: === Remote Severity: = Medium Details: 1.1 A persistent input validation web vulnerability is detected in the in the Bluetooth Connect Chat v1.0 iOS Application (Apple - iPad & iPhone). The vulnerability typus allows remote attackers to inject own malicious persistent (application-side) script codes to compromise the iOS application. The persistent input validation web vulnerability is located in the message board listing when processing to display manipulated messages. Attacker can inject own malicious script code to execute the context persistent from the message listing. To inject the code the remote attacker needs to bypass the basic validation of the client which is possible with a standard obfuscated char to char injection. Exploitation of the persistent web vulnerability requires low user interaction and a free but low privilege application user account. Successful exploitation of the persistent input validation web vulnerability results in persistent session hijacking, persistent web phishing, persistent external redirects or persistent module context manipulation. Vulnerable Module(s): [+] Message Board - Chat Vulnerable Parameter(s): [+] message (context) Affected Module(s): [+] Message Board Listing 1.2 A denial of service vulnerability is detected in the Bluetooth Connect Chat v1.0 iOS Application for Apples iPad & iPhone. The vulnerability typus allows remote attackers to freeze, block or stable crash down the application or software. The remote DoS vulnerability is located in the chat name and chat message encoding when processing to load a message special crafted message. The remote attacker uses any random html or quote tag as chat name. After including the tag as name the attacker connects to an existing chatroom via bluetooth or w-lab. Now he writes the name (used to logon for chatting) as message. The result is a stable iOS app crash (shutdown) on both sides because of a collision in the message client when processing to load both strings with an unknown exception. Exploitation of the remote vulnerability requires no user interaction and a free but low privilege application user account. Successful exploitation of the remote denial of service bug results in stable application crash and unauthorized shutdowns. Vulnerable Module(s): [+] Message Board - Chat Vulnerable Module(s): [+] Chatname [+] Message Context Solution: = 1.1 The persistent issue can be addressed by a restriction to the chat-name input fields. Parse the chat name input fields itself and encode the chat
[Full-disclosure] Paypal Bug Bounty #12 - PayPal Manager Persistent Listing Vulnerability
Title: == Paypal Bug Bounty #12 - PPM Listing Vulnerability Date: = 2013-05-31 References: === http://www.vulnerability-lab.com/get_content.php?id=649 VL-ID: = 649 Common Vulnerability Scoring System: 4.2 Introduction: = PayPal is a global e-commerce business allowing payments and money transfers to be made through the Internet. Online money transfers serve as electronic alternatives to paying with traditional paper methods, such as checks and money orders. Originally, a PayPal account could be funded with an electronic debit from a bank account or by a credit card at the payer s choice. But some time in 2010 or early 2011, PayPal began to require a verified bank account after the account holder exceeded a predetermined spending limit. After that point, PayPal will attempt to take funds for a purchase from funding sources according to a specified funding hierarchy. If you set one of the funding sources as Primary, it will default to that, within that level of the hierarchy (for example, if your credit card ending in 4567 is set as the Primary over 1234, it will still attempt to pay money out of your PayPal balance, before it attempts to charge your credit card). The funding hierarchy is a balance in the PayPal account; a PayPal credit account, PayPal Extras, PayPal SmartConnect, PayPal Extras Master Card or Bill Me Later (if selected as primary funding source) (It can bypass the Balance); a verified bank account; other funding sources, such as non-PayPal credit cards. The recipient of a PayPal transfer can either request a check from PayPal, establish their own PayPal deposit account or request a transfer to their bank account. PayPal is an acquirer, performing payment processing for online vendors, auction sites, and other commercial users, for which it charges a fee. It may also charge a fee for receiving money, proportional to the amount received. The fees depend on the currency used, the payment option used, the country of the sender, the country of the recipient, the amount sent and the recipient s account type. In addition, eBay purchases made by credit card through PayPal may incur extra fees if the buyer and seller use different currencies. On October 3, 2002, PayPal became a wholly owned subsidiary of eBay. Its corporate headquarters are in San Jose, California, United States at eBay s North First Street satellite office campus. The company also has significant operations in Omaha, Nebraska, Scottsdale, Arizona, and Austin, Texas, in the United States, Chennai, Dublin, Kleinmachnow (near Berlin) and Tel Aviv. As of July 2007, across Europe, PayPal also operates as a Luxembourg-based bank. On March 17, 2010, PayPal entered into an agreement with China UnionPay (CUP), China s bankcard association, to allow Chinese consumers to use PayPal to shop online.PayPal is planning to expand its workforce in Asia to 2,000 by the end of the year 2010. Between December 4ñ9, 2010, PayPal services were attacked in a series of denial-of-service attacks organized by Anonymous in retaliation for PayPal s decision to freeze the account of WikiLeaks citing terms of use violations over the publication of leaked US diplomatic cables. (Copy of the Homepage: www.paypal.com) [http://en.wikipedia.org/wiki/PayPal] Abstract: = The Vulnerability Laboratory Research Team discovered a Web Vulnerability in the official Paypal ecommerce website application. Report-Timeline: 2012-07-06: Researcher Notification & Coordination 2012-07-06: Vendor Notification 2012-08-29: Vendor Response/Feedback 2012-05-30: Vendor Fix/Patch 2012-06-01: Public Disclosure Status: Published Affected Products: == Exploitation-Technique: === Remote Severity: = High Details: Multiple persistent input validation vulnerabilities are detected in the official Paypal ecommerce website content management system (Customer/Pro/Seller). The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent) of the paypal web service. The vulnerability is located in the Paypal Manager > vtOrderTransaction module with the bound vulnerablebillingAddress1, billingAddress2 & billingAddress1Optional parameter. The bug affects the important Add formular & transactions listing. The vulnerability can be exploited by remote attackers with low required user inter action and privileged Customer/Pro/Seller account. Successful exploitation of the vulnerability can lead to session hijacking (customers), account steal via persistent web attack, persistent phishing or stable (persistent) context manipulation. Vulnerable Type(s): [+] Customer/Pro/Seller Accounts Vulnerable Section(s): [+] Paypal Manager Vulnerable Module(s):
[Full-disclosure] Linkedin Social Network - Persistent Web Vulnerability
Title: == Linkedin Social Network - Persistent Web Vulnerability Date: = 2013-06-08 References: === http://www.vulnerability-lab.com/get_content.php?id=962 Linkedin Security Ticket ID: 130429-005211 VL-ID: = 962 Common Vulnerability Scoring System: 3.8 Introduction: = LinkedIn is a social networking website for people in professional occupations. Founded in December 2002 and launched on May 5, 2003, it is mainly used for professional networking. As of January 2013, LinkedIn reports more than 200 million acquired users in more than 200 countries and territories. The site is available in English, French, German, Italian, Portuguese, Spanish, Dutch, Swedish, Romanian, Russian, Turkish, Japanese, Czech, Polish, Korean, Indonesian, and Malay. Quantcast reports LinkedIn has 21.4 million monthly unique U.S. visitors and 47.6 million globally.[10] In June 2011, LinkedIn had 33.9 million unique visitors, up 63 percent from a year earlier and surpassing MySpace. LinkedIn filed for an initial public offering in January 2011 and traded its first shares on May 19, 2011, under the NYSE symbol \\\"LNKD\\\". (Copy of the Homepage: http://en.wikipedia.org/wiki/LinkedIn ) Abstract: = An independent Vulnerability Laboratory Researcher (Ismail Kaleem) discovered a persistent vulnerability in the Linkedin Social Network Community. Report-Timeline: 2013-04-28: Researcher Notification & Coordination 2013-04-29: Vendor Notification 2013-08-30: Vendor Response/Feedback 2013-05-23: Vendor Fix/Patch 2013-06-08: Public Disclosure Status: Published Affected Products: == Linkedin Product: Social Network Application 2013 Q2 Exploitation-Technique: === Remote Severity: = Medium Details: A persistent script code injection web vulnerability is detected in the groups name add function of the linkedin social network application. The web-server does not use HTTP only cookies so it is possible for an attacker to hijackcookies or inject frames with malicious context or malware. Solution: = 2013-05-23: Vendor Fix/Patch Risk: = The security risk of the persistent web vulnerability in the social network is estimated as medium(+). Credits: Ismail Kaleem - Senior Security Developer | IT Security Department National Centre for Information Technology | Republic of Maldives Disclaimer: === The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains:www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact:ad...@vulnerability-lab.com - supp...@vulnerability-lab.com - resea...@vulnerability-lab.com Section:video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (ad...@vulnerability-lab.com or supp...@vulnerability-lab.com) to get a permission. Copyright © 2013 | Vulnerability Laboratory -- VULNERABILITY RESEARCH LABORATORY LABORATORY RESEARCH TEAM CONTACT: resea...@vulnerability-lab.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.
[Full-disclosure] [SECURITY] [DSA 2703-1] subversion security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-2703-1 secur...@debian.org http://www.debian.org/security/ Salvatore Bonaccorso June 09, 2013 http://www.debian.org/security/faq - - Package: subversion Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2013-1968 CVE-2013-2112 Debian Bug : 711033 Several vulnerabilities were discovered in Subversion, a version control system. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-1968 Subversion repositories with the FSFS repository data store format can be corrupted by newline characters in filenames. A remote attacker with a malicious client could use this flaw to disrupt the service for other users using that repository. CVE-2013-2112 Subversion's svnserve server process may exit when an incoming TCP connection is closed early in the connection process. A remote attacker can cause svnserve to exit and thus deny service to users of the server. For the oldstable distribution (squeeze), these problems have been fixed in version 1.6.12dfsg-7. For the stable distribution (wheezy), these problems have been fixed in version 1.6.17dfsg-4+deb7u3. For the unstable distribution (sid), these problems will be fixed soon. We recommend that you upgrade your subversion packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-annou...@lists.debian.org -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBCgAGBQJRtB5GAAoJEHidbwV/2GP+I8UP/RuShUL3wDaLm8YTM2JlKCHy iaed1q3/kecWdYDRVc3JI6tudURQFvn5lrPKC2G62YUTEiZ4DnkOn8T+697XSxwN 6Mwie3+awcuhgOp54JQk+J4GnvV8GCky1uHVLmkzRy8C9dYTxwy2vPp1xo6na9VC 939MLCfqdYte+CHiQBrsVcTVKu91vPfCGaHpAZNNkAUkXzBFD5J24CIafiLyxAwI TeIh+ZNS1mRb90TXc2hYrWj4UIWGEnsi6MHHHrbOWAaZhMdthHhu39kp92mbWzVS JRYlkW/HtmKzLm/raTmMSPoorSmG4k2t6ZrNLSS4wAHunaayMCMyrPS24BoT87lX b+Lbx0VDTqo8rrBUyyClJE6DnHBN+8g7rcn8R8Q20nLVuSbn1uUVmcECvio31vh2 jfm3ATxCDG0W25IjIOxMlfEuah9H5CEWyDi06TOlfEyWe+UCAzzwKQa+fXK1gtwK S7pv0PInYh0YCtkfByUAiyfwGAMTU28LoNXigpAKk+18bdbHGTGBnFPk1rhyJbku UCttBXs3Fg/b7wy2vgb7253X9opQ/tuz85m8CwzVscviBV7PDKPSXJ4FP9+Rba8m 0/0jYdNSEcRvOFPy++PnvNoNG8x9Phl3y9oajOJF1rujN3FdW9jsiGsnXMOQjFSB TKPLcvqvqnW71dcw/pP8 =Tnvw -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
