Re: [Full-Disclosure] bugtraq.com

2003-10-04 Thread Rodrigo Barbosa
I just registered bugtraq.com.br.

Do you think I can get US$ 0.99 for it ? :)

[]s

On Sat, Oct 04, 2003 at 09:09:41AM +0530, morning_wood wrote:
> http://www.bugtraq.com/ only 6000$ us
> hmmm...

-- 
Rodrigo Barbosa <[EMAIL PROTECTED]>
"Be excellent to each other ..." - Bill & Ted (Wyld Stallyns)



pgp0.pgp
Description: PGP signature


Re: [Full-Disclosure] Electronic Crimes Act 2003 of Pakistan

2003-10-04 Thread morning_wood
i fully agree, and India's are just as bad...
http://law.indiainfo.com/cyberlaw/ecommerce-act.html#48

morning_wood

> Look at your neighbor country, what lammer. It sounds
> like the author does not know anything about Computer
> Crimes IT IS SO FUNNY at such low profile countries
> with substandard authorities with a dictator and
> laughable democracy
> hahahahaha
>
>
http://www.tremu.gov.pk/tremu1/workingroups/pdf/Proposed%20E-Crimes%20Act.pdf
>

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] Mystery DNS Changes

2003-10-04 Thread Nick FitzGerald
"Mike O'Connor" <[EMAIL PROTECTED]> wrote:

> I have the described behaviour when visiting google.com, but have
> neither the aolfix.exe ...

Perhaps because it deletes itself after making the changes, as 
mentioned in several online virus descriptions?

> ... nor registry entries, on my XP box.  Where would
> one find the registry entry for the current DNS(s)?

I makes both registry and HOSTS fiel changes.  The "google.com effect" 
you refer to is part of the latter.


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] Has Verisign time arrived ?

2003-10-04 Thread Nick FitzGerald
> Truly sad.  I personally liked the service... I'm prone to typoz (did I
> mean typos?) with every sentence I write.  

  "I am stupid and found it useful, therefore it is good."

Sounds just like your president justifying yet another immoral war...


Regards,

Nick FitzGerald

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] Has Verisign time arrived ?

2003-10-04 Thread Poof
Hey... No need to personally bash somebody...

He's not stupid for liking it... He's just weird...

Erk!

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:full-disclosure-
> [EMAIL PROTECTED] On Behalf Of Nick FitzGerald
> Sent: Saturday, October 04, 2003 02:50
> To: [EMAIL PROTECTED]
> Subject: RE: [Full-Disclosure] Has Verisign time arrived ?
> 
> > Truly sad.  I personally liked the service... I'm prone to typoz (did I
> > mean typos?) with every sentence I write.
> 
>   "I am stupid and found it useful, therefore it is good."
> 
> Sounds just like your president justifying yet another immoral war...
> 
> 
> Regards,
> 
> Nick FitzGerald
> 
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Fw: Removal of wildcard A records from .com and .net zones

2003-10-04 Thread Michael Scheidell
> 
> So that leaves 13 hours to spam VeriSign's data mining basis
> with meaningless requests like 
> 
>   while (1) {
> ($v, $w) = two_random_words_from("/usr/share/dict/words");
> system("lynx -source http://$v.$w.net > /dev/null 2>&1");

not sure that is all that nessessary.
The spammers are actually helping DDOS verisign.

There are a lot of web sites running 'wpoision' which creates random
usernames and domain names already, ripe for the email harvesters.

See the bottom of http://www.secnap.com/contact.html for the 'Special link
for email gathering bots.'

spammers are sending email by the bizillions to verisign.
Even if verisign is dumping them, that is still bizillions of smtp
connects per second.
-- 
Michael Scheidell
SECNAP Network Security, LLC 
Main: 561-368-9561 / www.secnap.net
Looking for a career in Internet security?
http://www.secnap.net/employment/

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Electronic Crimes Act 2003 of Pakistan

2003-10-04 Thread Cael Abal
Cutthroat Truth wrote:
Look at your neighbor country, what lammer. It sounds
like the author does not know anything about Computer
Crimes IT IS SO FUNNY at such low profile countries
with substandard authorities with a dictator and
laughable democracy 
hahahahaha

http://www.tremu.gov.pk/tremu1/workingroups/pdf/Proposed%20E-Crimes%20Act.pdf
Brr.  I need a sweater, it's getting kind of stupid around here.

C

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] bugtraq.com

2003-10-04 Thread Jonathan A. Zdziarski
Wouldn't it be more appropriate to register bugtraq.biz?


On Sat, 2003-10-04 at 00:25, c.ayala wrote:
> They don't take checks?
> 
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
> morning_wood
> Sent: Friday, October 03, 2003 11:40 PM
> To: [EMAIL PROTECTED]
> Subject: [Full-Disclosure] bugtraq.com
> 
> http://www.bugtraq.com/ only 6000$ us
> hmmm...
> 
> morning_wood
> 
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
> 
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
> 
> !DSPAM:3f7e547c255251268121129!
> 
> 
> 

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] RE: UPDATE! Jamming communication [COM] ports in windows...

2003-10-04 Thread Jean-Baptiste Marchand
* Rainer Gerhards <[EMAIL PROTECTED]> [23/09/03 - 19:01]:

> Yes, that's the point. /dev/xxx in *nix is not an issue - there are
> permissions. I have done a quick search, but I think there is no easy
> way to place ACLs on devices in Windows. I hope I am wrong. Does
> somebody know how to do this?

You're right, it is not really easy for a driver to set {D,S}ACLs on
device objects.

The problem was described back in 1998 in the following article:

http://www.sysinternals.com/ntw2k/info/devsec.shtml

In recent versions of the DDK a new function, IoCreateDeviceSecure(),
can be used to set the security decriptor on device objects created by a
driver:

http://www.osr.com/ddk/kmarch/k104_1ycy.htm

Device objects security is discussed in the following DDK entry:

http://www.osr.com/ddk/kmarch/devobjts_07tz.htm

One of the 2002 issues of the NT Insider publication discussed the
IoCreateDeviceSecure() DDI (you will have to register on osronline.com
to read that article):

http://www.osronline.com/article.cfm?id=105

There is also another article discussing the
IoValidateDeviceIoControlAccess() DDI, only supported in recent Windows
systems:

http://www.osronline.com/article.cfm?id=144

I know at least one well-known Windows driver that creates its device
objects with loose security permissions, which can lead to security
problems...

Hope this helps,

Jean-Baptiste Marchand
-- 
[EMAIL PROTECTED]
HSC - http://www.hsc.fr/

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


[Full-Disclosure] ProFTPD 1.2.9rc2 Remote Root Exploit (X-Force Vuln)

2003-10-04 Thread Peter King
nothing to say ! china rox !
http://www.k-otik.com/exploits/10.04.proftpd_xforce.c.php
 
 
Do you Yahoo!?
The New Yahoo! Shopping - with improved product search

Re: [Full-Disclosure] Electronic Crimes Act 2003 of Pakistan

2003-10-04 Thread Joel R. Helgeson
Its not any worse than the DMCA...

Joel R. Helgeson
Director of Networking & Security Services
SymetriQ Corporation

"Give a man fire, and he'll be warm for a day; set a man on fire, and he'll
be warm for the rest of his life."
- Original Message - 
From: "morning_wood" <[EMAIL PROTECTED]>
To: "Cutthroat Truth" <[EMAIL PROTECTED]>;
<[EMAIL PROTECTED]>
Sent: Saturday, October 04, 2003 1:16 AM
Subject: Re: [Full-Disclosure] Electronic Crimes Act 2003 of Pakistan


> i fully agree, and India's are just as bad...
> http://law.indiainfo.com/cyberlaw/ecommerce-act.html#48
>
> morning_wood
>
> > Look at your neighbor country, what lammer. It sounds
> > like the author does not know anything about Computer
> > Crimes IT IS SO FUNNY at such low profile countries
> > with substandard authorities with a dictator and
> > laughable democracy
> > hahahahaha
> >
> >
>
http://www.tremu.gov.pk/tremu1/workingroups/pdf/Proposed%20E-Crimes%20Act.pdf
> >
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] bugtraq.com

2003-10-04 Thread KF
I am going to laugh when symantec sues you folks for squating. =]
-KF
Jonathan A. Zdziarski wrote:
Wouldn't it be more appropriate to register bugtraq.biz?

On Sat, 2003-10-04 at 00:25, c.ayala wrote:

They don't take checks?

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of
morning_wood
Sent: Friday, October 03, 2003 11:40 PM
To: [EMAIL PROTECTED]
Subject: [Full-Disclosure] bugtraq.com
http://www.bugtraq.com/ only 6000$ us
hmmm...
morning_wood

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
!DSPAM:3f7e547c255251268121129!





___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


[Full-Disclosure] verisigns overflow?

2003-10-04 Thread morning_wood
hehe

http://search.msn.com/dnserror.aspx?FORM=DNSAS&q=search.msn.com
http://search.msn.com/dnserror.aspx?FORM=DNSAS&q=google.com
heck..
http://search.msn.com/dnserror.aspx?FORM=DNSAS&q=bugtraq.com

http://search.msn.com/dnserror.aspx?FORM=DNSAS&q=ANYTHINGREALLY.ZYZ

this was fun

http://search.msn.com/dnserror.aspx?FORM=DNSAS&q=our%20buts%20k%20buthts%20thats%20just%20ok,%20we%20kun%20just%20rwite%20like%20with%20this%20har%20or%20mbey...

muhhaaahaaa

Donnie Werner
[EMAIL PROTECTED]

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Re: Geeklog Multiple Versions Vulnerabilities

2003-10-04 Thread Michael Renzmann
Hi all.

Lorenzo Hernandez Garcia-Hierro wrote:
Geeklog Multiple Versions Vulnerabilities
--
PRODUCT: Geeklog
VENDOR: Geeklog
VULNERABLE VERSIONS:
[...]

Is it just me, or did anyone else notice that this vulnerability report 
comes through once or twice every day since about the beginning of this 
week? As far as I could see it's always the same text, without any 
changes...

Bye, Mike

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [spam] Re: [Full-Disclosure] MS03-040 October cumulative patch for IE

2003-10-04 Thread Exibar
Hi Nick and all!
I think that this patch fixes the QHOSTS1 hole and perhaps the hole that
caused the Half Life 2 source code to be compromised with.  Valve software
is no doubt a big hitter for Microsoft so I'm sure they complained and MS
listened by releasing this patch.  Which in my opinion is a fix for
MS03-032

  Exibar

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Nick
FitzGerald
Sent: Saturday, October 04, 2003 1:51 AM
To: [EMAIL PROTECTED]
Subject: [spam] Re: [Full-Disclosure] MS03-040 October cumulative patch
for IE


"Jerry Heidtke" <[EMAIL PROTECTED]> wrote:

> Just when we got used to Wednesday afternoon security bulletins from
> Microsoft, they decide to release one on Friday evening.
>
> http://www.microsoft.com/technet/security/bulletin/ms03-040.asp
>
> It allegedly fixes the object tag/hta types of vulnerabilities.

Yep -- this deviation from "patches are releasesed on Wednesday"
practice presumably suggests how darn critical MS rates this bug.

You have to wonder though when they'll work out there are thirty-
something others that in various combinations are just as bad...

   http://www.pivx.com/larholm/unpatched/

Perhaps it will take more worms and clearly malicious use such as we
have seen with the Object Data Type flaw, including the associated
media coverage, to get them all fixed too??


--
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Re: Geeklog Multiple Versions Vulnerabilities

2003-10-04 Thread Daniel Bartlett

No its not just you, I was thinking it also
Does someone maybe want their name seen alot?
Daniel.


On 10/4/2003, "Michael Renzmann" <[EMAIL PROTECTED]> wrote:

>Hi all.
>
>Lorenzo Hernandez Garcia-Hierro wrote:
>> Geeklog Multiple Versions Vulnerabilities
>> --
>> PRODUCT: Geeklog
>> VENDOR: Geeklog
>> VULNERABLE VERSIONS:
>[...]
>
>Is it just me, or did anyone else notice that this vulnerability report
>comes through once or twice every day since about the beginning of this
>week? As far as I could see it's always the same text, without any
>changes...
>
>Bye, Mike
>
>___
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Re: Geeklog Multiple Versions Vulnerabilities

2003-10-04 Thread Etaoin Shrdlu
Daniel Bartlett wrote:
> On 10/4/2003, "Michael Renzmann" <[EMAIL PROTECTED]> wrote:
> 
> >Hi all.
> >
> >Lorenzo Hernandez Garcia-Hierro wrote:
> >> Geeklog Multiple Versions Vulnerabilities
> >> --
> >> PRODUCT: Geeklog
> >> VENDOR: Geeklog
> >> VULNERABLE VERSIONS:
> >[...]
> >
> >Is it just me, or did anyone else notice that this vulnerability report
> >comes through once or twice every day since about the beginning of this
> >week? As far as I could see it's always the same text, without any
> >changes...

> No its not just you, I was thinking it also
> Does someone maybe want their name seen alot?
> Daniel.

{ugh. Top posting. I reformatted.}

It isn't the original poster that was the problem (even if it was a stupid
and pointless advisory). There is a remailer whose name ends in .fr (sorry,
I don't have any of those emails, and can't remember what it was) that is
causing the problem. In addition, it was cross-posted to bugtraq, so we are
guaranteed to see it at least twice. I so wish that folk wouldn't do this,
btw, since it's really hard on any list that was posted to in addition to
bugtraq. I've removed all the CCs in this, but any discussion that makes it
onto bugtraq is going to show up at least once more here, thanks to their
brain-dead mailer.

If you still have the original message, take a look at the headers of any
of the copies. It isn't from Lorenzo, it's from the remailer in France.
Which reminds me: I've seen this same stupidity on at least one other list
from the same remailer. Whoever you are, fix it or unsubscribe! In fact,
[EMAIL PROTECTED] seems to be the one commonality in these two lists...
Guess it IS back to Lorenzo. Yep, Lorenzo's domain, novappc.com does indeed
lead back to amen.fr, which is probably where that danged remailer starts
from... Heads up, Lorenzo, boy.

--
When you wish to instruct be brief -- so that people's minds
can quickly grasp what you have to say, understand your point,
and retain it accurately. Unnecessary words just spill over the
side of a mind already crammed to the full. (Cicero)

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


[Full-Disclosure] Mystery DNS Changes

2003-10-04 Thread Mike O'Connor
I have a somewhat different strain.  Mine displays ads coming from
http://cdn2.adsdk.com, which is an alias for a1906.g.akamai.net .  There
are no registry changes that I can detect, and my DNSs remain unmolested
according to the ipconfig program.  I have looked (particularly in the
WINDOWS\Help directory) but I can find no rogue Hosts file, although
there must be one somewhere to do the google hijacking.

All of which is to say that I think my infection, although related to
the one described on McAfee and in previous posts to this thread, is
distinct from it.

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


[Full-Disclosure] Re: Fake ebay password stealer

2003-10-04 Thread Sebastian Niehaus
[EMAIL PROTECTED] writes:
 
> Following on the heels of the "very good looking" microsoft security patch
> worm, i am now in posession of an even more convincing "Ebay Request" to
> reconfirm your credit card number, PayPal account, password, etc.   This
> appears to be an excellent fake and we can expect many people to be
> tricked.
> 
> To see how good it looks, Checkout this image.  (It doesn't look like an
> image but it is actually a JPG which hides a link to the attacker's
> server.)  Many people will be fooled.  The url is fake (it is just a
> picture after all).  

Combine it with a QHosts-1 feature and you get your sensitive data
even from users looking for the URL displayed in the address field of
the browser.


Sebastian
-- 


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [Full-Disclosure] Bush Bashing (use to be Has Verisign time arrived ?)

2003-10-04 Thread Dark Avenger
This isn't the place to discuss political and personal views of our 
country and leadership, but you 2 just opened the door.

This is typical liberal dribble attacking our president for an "immoral 
war" and being "weird". Your only agenda is to try to discredit an 
administration that finally has some morals and integrity and does 
what's right for the country (and even for the ungrateful world 
community), unlike the prior administration.

Where were your criticisms when the Clinton administation launched 
cruise missles into Iraq without UN approval?
Where were your criticisms when the Clinton administation attacked 
Serbia without UN, or even Congress' approval?
Where were your criticisms when the Clinton administation bombed an 
aspirin factory?

Now this isn't about the Clinton administration, but it illustrates the 
level of hypocrisy of those that bash the current administration.

Every nation in the UN agreed that Iraq had weapons of mass destruction, 
so you can't pin the label on the Bush administration, as if they lied 
about it and used it as the only reason to liberate the Iraqi people. 
This was only 1 of many reasons for going into Iraq, and the liberals 
are trying to cast it as the only reason.

People like you seem to forget or ignore the 17 UN resolutions that Iraq 
had violated. And how the UN doesn't have enough backbone to enforce 
their own resolutions.

You seem to forget or ignore the routine and systematic torture and 
execution of political prisoners that Saddam's regime carried out.

You seem to forget or ignore their use of chemical weapons against Iran 
that resulted in an estimated 600,000 to 1,000,000 Iraqi Kurd's and 
Iranians dead in 1980 - 1988. This in itself proves he had weapons of 
mass destruction, and everyone knows it. They hid entire squads of 
fighter jets underneath the desert sands, showing how easy it would be 
to hide small barrels of chemical and biological agents.

You seem to forget or ignore their invasion of Kuwait in 1990-1991.

You seem to forget or ignore the bloody mass killings of 30,000 to 
60,000 Kurd's and Shite's in 1991.

You seem to forget or ignore the Rape rooms and imprisoned children and 
execution rooms used regularly by this regime. And how the women were 
suppressed and made 2nd class citizens by not being able to be seen in 
public, or drive, or go to school, or vote (vote? what a laugh, even for 
those who could).

Thank God we finally have an administration that is willing to do what's 
right to protect us all. This new world we live in since 9/11/2001 (of 
course you've forgotten about that too, I'm sure) requires us to take 
the battle to the terrorists and their allies before they take it to us. 
Do you actually think for one minute that Iraq wouldn't hand over WMD to 
terrorists with the intent of using them on our homeland? This is a 
pro-active approach to warding off terrorism before it hits again. If 
this administration hadn't taken this approach, and then we had an 
attack on LA, or San Francisco, or any other place in the US, then you 
would have been bashing the administration for not protecting you. If 
France, or Germany, or any other nation on this earth had been attacked 
like we were, then who do you think would be the first people they 
called upon to help them out? And we would have done it without hesitation.

I could go on and on, but this has already turned out to be longer than 
I expected. But we should all be grateful for the actions this 
administration is taking to make sure we are safer in our homes, despite 
the bashings of liberals like you.

God Bless the USA, and yes, the President too



 Original Message 
Subject:RE: [Full-Disclosure] Has Verisign time arrived ?
Date:   Sat, 4 Oct 2003 05:12:49 -0700
From:   Poof <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>


Hey... No need to personally bash somebody...

He's not stupid for liking it... He's just weird...

Erk!

-Original Message-
From: [EMAIL PROTECTED] [mailto:full-disclosure-
[EMAIL PROTECTED] On Behalf Of Nick FitzGerald
Sent: Saturday, October 04, 2003 02:50
To: [EMAIL PROTECTED]
Subject: RE: [Full-Disclosure] Has Verisign time arrived ?
> Truly sad.  I personally liked the service... I'm prone to typoz (did I
> mean typos?) with every sentence I write.
  "I am stupid and found it useful, therefore it is good."

Sounds just like your president justifying yet another immoral war...

Regards,

Nick FitzGerald

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


[Full-Disclosure] Fw: New IE crash: CSS + HTML

2003-10-04 Thread bscabl
also confirmed in XP sp1

Faulting application iexplore.exe, version 6.0.2800.1106, faulting module
mshtml.dll, version 6.0.2800.1226, fault address 0x0011475e.



- Original Message -
From: <[EMAIL PROTECTED]>
Newsgroups: muc.lists.bugtraq
Sent: Friday, October 03, 2003 11:59 AM
Subject: New IE crash: CSS + HTML


> While designing a page today, I stumbled across a combination of HTML and
CSS
> that causes IE (6.0.2600. on 2k v5.00.2195 and 6.0.3790 on 2k3 server
> v5.2.3790 are the only versions tested so far) to crash with a GPF. After
a
> little work, I distilled the required code down to this:
>
> -
> 
> 
> 
> #three {
> position: absolute;
> }
> #one #two {
> position: absolute;
> }
> 
> 
> In 'one'
> 
> In 'two'
> 
> 
> In 'three'
> 
> 
> -
>
> A bit of experimentation revealed the following:
> The tag with id "one" can be any tag that is 'display: block' by default.
> The tag with id "two" can be any tag that is 'display: inline' by default.
> The tag with id "three" can be any tag at all, including non container
tags such
> as img.
> The tag with id "two" _must_ be left unclosed.
> The selector must be "#one #two", simply selecting on #two does not work.
>
> I'll be the first to admit that this is a bit obscure (though I came
across it
> by accident) - it seems to have something to do with opening an absolutely
> positioned block tag after an absolutely positioned inline tag wasn't
closed
> properly, but is more complicated than that.
> In windows 2000, it also crashed explorer when I clicked on the file in in
a
> file dialog (due to the auto-preview).
>
> A brief look at a debugger on the crashed IE instance reveals that the
address
> it crashes at is a RET instruction.
>
> I leave it up to people with more talent than I to refine when it occurs
and why ;).
>
> -Nick Johnson
>
> -
> Posted automagically by a mail2news gateway at muc.de e.V.
> Please direct questions, flames, donations, etc. to [EMAIL PROTECTED]

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Bush Bashing (use to be Has Verisign time arrived ?)

2003-10-04 Thread Joshua Levitsky
On Oct 4, 2003, at 9:51 PM, Dark Avenger wrote:

This isn't the place to discuss political and personal views of our 
country and leadership, but you 2 just opened the door.

This is typical liberal dribble attacking our president for an 
"immoral war" and being "weird". Your only agenda is to try to 
discredit an administration that finally has some morals and integrity 
and does what's right for the country (and even for the ungrateful 
world community), unlike the prior administration.


Bla bla bla.. nothing to do with computers... bla bla bla

Let's please talk about computers. I am on 10 different active lists 
and none of them have anything to do with politics... mostly because I 
have no interest in them. All politicians are slime-bags. All of them 
say what their party wants them to. None of your points will be 
resolved on the Full-Disclosure list unless someone is writing about an 
exploit that gets us access to George Bush's porn collection.

Please... no more bla bla bla... politics ... bla bla bla

--
Joshua Levitsky, CISSP, MCSE
System Engineer
AOL Time Warner
[5957 F27C 9C71 E9A7 274A  0447 C9B9 75A4 9B41 D4D1]
___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Re: [Full-Disclosure] Bush Bashing (use to be Has Verisign time arrived ?)

2003-10-04 Thread Cael Abal
I could go on and on, but this has already turned out to be
longer than I expected. But we should all be grateful for the
actions this administration is taking to make sure we are safer
in our homes, despite the bashings of liberals like you.
God Bless the USA, and yes, the President too 
I like you Dark Avenger, you're funny.

C

PS: Please don't liberate me.

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


RE: [spam] RE: [Full-Disclosure] Bush Bashing (use to be Has Verisign time arrived ?)

2003-10-04 Thread Exibar
Hear Hear!   did I hear the US National Anthem in the backgroud while I was
reading your post?  I think I did!  :-)

  I agree 100%!  I could care less what those who live in other countries
say, because they know deep down, that if they were the victims of a 9/11
type attack, they would be asking the good old USA for help.  And we WOULD
help them, even if they are from Austrailia, France, Germany, etc

  Exibar

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Dark Avenger
Sent: Saturday, October 04, 2003 9:52 PM
To: [EMAIL PROTECTED]
Subject: [spam] RE: [Full-Disclosure] Bush Bashing (use to be Has
Verisign time arrived ?)


This isn't the place to discuss political and personal views of our
country and leadership, but you 2 just opened the door.

This is typical liberal dribble attacking our president for an "immoral
war" and being "weird". Your only agenda is to try to discredit an
administration that finally has some morals and integrity and does
what's right for the country (and even for the ungrateful world
community), unlike the prior administration.

Where were your criticisms when the Clinton administation launched
cruise missles into Iraq without UN approval?
Where were your criticisms when the Clinton administation attacked
Serbia without UN, or even Congress' approval?
Where were your criticisms when the Clinton administation bombed an
aspirin factory?

Now this isn't about the Clinton administration, but it illustrates the
level of hypocrisy of those that bash the current administration.

Every nation in the UN agreed that Iraq had weapons of mass destruction,
so you can't pin the label on the Bush administration, as if they lied
about it and used it as the only reason to liberate the Iraqi people.
This was only 1 of many reasons for going into Iraq, and the liberals
are trying to cast it as the only reason.

People like you seem to forget or ignore the 17 UN resolutions that Iraq
had violated. And how the UN doesn't have enough backbone to enforce
their own resolutions.

You seem to forget or ignore the routine and systematic torture and
execution of political prisoners that Saddam's regime carried out.

You seem to forget or ignore their use of chemical weapons against Iran
that resulted in an estimated 600,000 to 1,000,000 Iraqi Kurd's and
Iranians dead in 1980 - 1988. This in itself proves he had weapons of
mass destruction, and everyone knows it. They hid entire squads of
fighter jets underneath the desert sands, showing how easy it would be
to hide small barrels of chemical and biological agents.

You seem to forget or ignore their invasion of Kuwait in 1990-1991.

You seem to forget or ignore the bloody mass killings of 30,000 to
60,000 Kurd's and Shite's in 1991.

You seem to forget or ignore the Rape rooms and imprisoned children and
execution rooms used regularly by this regime. And how the women were
suppressed and made 2nd class citizens by not being able to be seen in
public, or drive, or go to school, or vote (vote? what a laugh, even for
those who could).

Thank God we finally have an administration that is willing to do what's
right to protect us all. This new world we live in since 9/11/2001 (of
course you've forgotten about that too, I'm sure) requires us to take
the battle to the terrorists and their allies before they take it to us.
Do you actually think for one minute that Iraq wouldn't hand over WMD to
terrorists with the intent of using them on our homeland? This is a
pro-active approach to warding off terrorism before it hits again. If
this administration hadn't taken this approach, and then we had an
attack on LA, or San Francisco, or any other place in the US, then you
would have been bashing the administration for not protecting you. If
France, or Germany, or any other nation on this earth had been attacked
like we were, then who do you think would be the first people they
called upon to help them out? And we would have done it without hesitation.

I could go on and on, but this has already turned out to be longer than
I expected. But we should all be grateful for the actions this
administration is taking to make sure we are safer in our homes, despite
the bashings of liberals like you.

God Bless the USA, and yes, the President too



 Original Message 
Subject:RE: [Full-Disclosure] Has Verisign time arrived ?
Date:   Sat, 4 Oct 2003 05:12:49 -0700
From:   Poof <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>



Hey... No need to personally bash somebody...

He's not stupid for liking it... He's just weird...

Erk!

> -Original Message-
> From: [EMAIL PROTECTED] [mailto:full-disclosure-
> [EMAIL PROTECTED] On Behalf Of Nick FitzGerald
> Sent: Saturday, October 04, 2003 02:50
> To: [EMAIL PROTECTED]
> Subject: RE: [Full-Disclosure] Has Verisign time arrived ?
>
> > Truly sad.  I personally liked the service... I'm prone to typoz (did I
> > mean typos?) with every sentence I write.
>
>   "I am stupi

Re: [Full-Disclosure] Electronic Crimes Act 2003 of Pakistan

2003-10-04 Thread Gregory A. Gilliss
Here, here! I second the motion.


Man, I go away for one day, and I come back and you guys are bashing each
other over the head and yelling "Your country's restrictions on freedom 
are more stupid than my country's restrictions on freedom!" Jeez, GTFU ... 

Meanwhile government agencies continue to monitor our traffic without
our consent, vulnerabilities are withheld to protect company's market
share...and you guys are yelling about how Pakistan and India's laws
are dumb? Just wait until *all* the software development is done over
there, then sit back and wait while you *try* and get someone to care
about the latest exploit...


BTW, I took the LSAT today. It's everything they say it is and more :-0

We now return you to our regularly scheduled FD discussion...

G

On or about 2003.10.04 08:34:46 +, Cael Abal ([EMAIL PROTECTED]) said:

> 
> Brr.  I need a sweater, it's getting kind of stupid around here.
> 

-- 
Gregory A. Gilliss, CISSP Telephone: 1 650 872 2420
Computer Engineering   E-mail: [EMAIL PROTECTED]
Computer SecurityICQ: 123710561
Software Development  WWW: http://www.gilliss.com/greg/
PGP Key fingerprint 2F 0B 70 AE 5F 8E 71 7A 2D 86 52 BA B7 83 D9 B4 14 0E 8C A3

___
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html