[EMAIL PROTECTED] writes:
> When you specify ns1.jsnet.com as an NS for
> your domain, the IP address NSI already holds for this hostname is used.
As I said before, NSI isn't holding an IP address for this name.
On the other hand, as David Terrell pointed out, NSI won't accept
ns1.jsnet.com host
Michal Zalewski wrote:
>
> On Mon, 13 Mar 2000, Maurycy Prodeus wrote:
>
> > 1. In "Lotus Notes POP 1.0X" on NT platform. I'm not really sure ...
> > if you send a very long username ( about 2kb ) it disconnects without
> > any message. So it looks like classic buffer overflow :) I don't have
> >
A brief rundown of the problem.
If you run routable ips on your internal interface on your pix, and
routeable ips on your external interface, so the pix is not running nat,
the pix keeps a state table of everything going on. Anything that is not
in your state table that attempts to come in from
Once upon a time, Sanford Whiteman <[EMAIL PROTECTED]> said:
> Dave, you are certainly correct. We just performed a giant name server
> migration and can verify that NSI's database has dual primary keys, or
> what-have-you, that prevent the attack. A name server's IP address can only
> be associ
Hi all,
(This is a copy of a message I sent to the linux-kernel list.)
Attached is a patch I created to address the "extended FTP ALG"
vulnerability discussed on Bugtraq in the past few days (there's an URL in
the patch comments). It prevents bogus (and legitimate) PORT commands from
creating b
FYI...
It's not from /etc/services that FW1 uses to match a service, FW-1 has an
internal database of predefined services many of which aren't in the
services file
david grimes
> -Original Message-
> From: Bugtraq List [mailto:[EMAIL PROTECTED]]On Behalf Of
> [EMAIL PROTECTED]
Geert Altena <[EMAIL PROTECTED]> writes:
> > http://www.deja.com/getdoc.xp?AN=591804116
>
> Comes out as (copy/paste from netscape):
>
> >> Forum: alt.test
> >> Thread: >> src="http://www.in-design.com/~nsmart/foo.js"> >> onLoa
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Well,
After talking to SBC (including the CIO's gimp and the head of
security and a few of the people who run the ISP side). They have no
plans to upgrade the end users to Cisco do to price. The
Alcatel/Cayman is clearly cheaper. I am swbell c
HP Support Information Digests
===
o HP Electronic Support Center World Wide Web Service
---
If you subscribed through the HP Electronic Supp
The following is a Security Bulletin from the Microsoft Product Security
Notification Service.
Please do not reply to this message, as it was sent from an unattended
mailbox.
-BEGIN PGP SIGNED MESSAGE-
Microsoft Security Bulletin
Hi!
> > /proc/pid allows strange tricks (2.3.49):
>
> > pavel@bug:~/misc$ ps aux | grep grep
> > Warning: /boot/System.map has an incorrect kernel version.
> > Warning: /usr/src/linux/System.map has an incorrect kernel version.
>
> ... interesting bits about /proc/$PID/status interface and how ha
On Thu, Mar 16, 2000 at 02:38:47PM +0100, Sebastian([EMAIL PROTECTED]) wrote:
: TESO Security Advisory
: 2000/03/13
:
: imwheel local root compromise
The Slackware package available from Linuxmafia.org
(http://linuxmafia.org/pcentral/search_view.php3?name=imwheel) is not
effected by this
Andy Caus wrote:
>
> You should ALWAYS use:
>
> if exist net use /d
>
> before you use "net use" in such a script.
>
This will not catch a SUBST entry, though. You could also add the
line to be sure:
if exist H: subst H: /d
Good day,
--
Daniel B. Harter [EMAIL PROTECTED] The MITRE
Title: RE: The out-of-domain NS registration attack
Dave, you are certainly correct. We just performed a giant name server migration and can verify that NSI's database has dual primary keys, or what-have-you, that prevent the attack. A name server's IP address can only be associated with one
Hi,
Way back in August of 1998 I posted a message to this list about a
handful of buffer overflows in various utilities that shipped with SuSE
Linux 6.2. It seems that after a year and half a few of these bugs
STILL exist. None of these utilities are harmful by themselves, just
they may open a
Greetings,
I sent this to Cisco about 2 weeks ago, and have received a few responses.
Apparentlly a fix is in the works, and may already have been released by
this time unbeknownst to me (although I looked for it and have not found
it yet). In any case, I thought it would be valuable to eventual
On Mon, 13 Mar 2000, Maurycy Prodeus wrote:
> 1. In "Lotus Notes POP 1.0X" on NT platform. I'm not really sure ...
> if you send a very long username ( about 2kb ) it disconnects without
> any message. So it looks like classic buffer overflow :) I don't have
> enough time to check it ( to downloa
Tested systems..
Redhat 6.0 w/pam-0.68-10- didnt work
Redhat 6.1 w/pam-0.68-7 - worked
Then on the same machine (having root and being the nice 'hacker' i was,
upgraded pam for him.. Then retested).
Redhat 6.1 w/pam-0.68-10- didnt work
And that
Noam Rathaus wrote:
>
> Try pressing escape and be amazed ... mine executed it.
Yes.. You are right.. I check my %TEMP% and there it was :-((
George's page doesn't execute it because my %TEMP% is other
than C:\TEMP or C:\WINDOWS\TEMP..
--
pozdrawiam..
## ## | Sylwester Zarębski - IS
You can get v4.0 SP5 from Nokia now.
Regards,
Miles.
-Original Message-
From: Chris Brenton [mailto:[EMAIL PROTECTED]]
Sent: 15 March 2000 14:50
To: [EMAIL PROTECTED]
Subject: Re: Our old friend Firewall-1
[EMAIL PROTECTED] wrote:
>
> Please provide exact patchlevels. I know the probl
At 10:29 AM 3/15/00 -0800, Oliver Friedrichs wrote:
>While we're on the issue of creating known devices under Windows. An
>issue I remember noting awhile back is that under Windows NT, it's
>possible to create and remove most of these devices over a file
>share. They aren't treated as special f
At 09:32 09/03/2000 -0600, you wrote:
>BugTraq,
>
> I was recently auditing the security on one of my web servers when I came
>across a new Extension Enumerate Root Web Server Directory Vulnerability for
>IIS 4.0. Going to the main website and asking for anything.idq I get the
>page cannot be fo
Aleph1,
These are some more exploits for the wmcdplay originaly
advisory posted on bugtraq by the TESO crew 3/11/2000. I
wrote the exploit for most of the arguments wmcdplay
accepts. Please excuse any formatting issues my normal
server is awaitng a cable modem.
-- Larry W. Cashdollar
On Thu, 16 Mar 2000, Sven Dietrich wrote:
> Note: this is also available at:
> http://sled.gsfc.nasa.gov/~spock/shaft_analysis.txt
> An analysis of the ``Shaft'' distributed denial of service tool
>
Hi,
There is a minor error in the detection code that will keep ddos-shaft.c
from compilin
On Fri, 17 Mar 2000, Michal Zalewski wrote:
> <...> assuming there's no interesting data in daemon address space (I
> don't think so - it is not performing any authorization, etc, only
> reads utmp entries), I don't think it might lead to anything except
> crash. And, as it's started from inetd,
Due to the apparent blackout of information about the "SQL Query Abuse"
advisory http://www.microsoft.com/technet/security/bulletin/ms00-014.asp I
wanted to point any interested parties to an English description of the
vulnerability by Sven Hammesfahr. The detailed description is on his
website a
At 11:44pm Mar 15, 2000, Pavel Machek wrote:
> /proc/pid allows strange tricks (2.3.49):
> pavel@bug:~/misc$ ps aux | grep grep
> Warning: /boot/System.map has an incorrect kernel version.
> Warning: /usr/src/linux/System.map has an incorrect kernel version.
... interesting bits about /proc/$PI
Oliver Friedrichs wrote:
[...]
> For example, you can create known devices with random extensions over
> a file share, com1.1 com1.2 com1.3 com1.4, and you cannot remove them
> locally. It's probably a good thing that the CIFS layer doesn't
> provide direct access to these devices, otherwise an a
on 3/14/00 5:14 PM, Paulo Ribeiro at [EMAIL PROTECTED] wrote:
> * DESCRIPTION:
> * ---
> * Mandrake Linux 6.1 has the same problem as Red Hat Linux 6.x but its
> * exploit (pamslam.sh) doesn't work on it (at least on my machine). So,
> * I created this C program based on it which exploits
-BEGIN PGP SIGNED MESSAGE-
=
FreeBSD-SA-00:07 Security Advisory
FreeBSD, Inc.
Topic: mh/nmh/exmh/
On Tue, 14 Mar 2000, H D Moore wrote:
> BeOS 4.0 also has a shoddy tcp/ip stack which increases the ISS by 1 per
> connection. This may been fixed by now, I haven't tested it in over a
> year.
I ran across a few systems like this in an audit last year. As of the
current BeOS release (R4.5.2),
Title: RE: IE and Outlook 5.x allow executing arbitrary programs using .eml files
It also works on NT Workstation 4.0 SP4, IE 5.00.2314.1003, Outlook 2000. It prompts to save or run - if I choose Run, it works. If I choose Cancel, it works. If I close the box with Esc, it still works.
Ch
You, Niall Smart, <[EMAIL PROTECTED]>, wrote:
> deja.com does not always escape meta-characters when displaying
^^
> Usenet articles. Specifically, the article view page
> (http://www.deja.com/getdoc.xp) and the thread view page
> (http://www.deja.com/viewthread.xp) displ
With Firewall-1 all ports defined in the /etc/services file will be denied
connections to during an ftp session. This is defined in the file base.def
as follows:
// ports which are dangerous to connect to
#define NOTSERVER_TCP_PORT(p) {
(not
(
( p in tcp_services, set
When running a Nessus security scan I've discovered that Norton AntiVirus for Internet
Email Gateways for Windows NT will crash with an unusually long URL on it's webserver.
This service is a SMTP agent used to screen email attachments for viruses. It seems
like a great idea, but it uses an e
__
S.A.F.E.R. Security Bulletin 000317.EXP.1.5
__
TITLE: Netscape Enterprise Server and '?wp' tags
DATE : March 17, 2000
NATURE : Remote user can obtain list of direct
David LeBlanc wrote:
>
> There's a couple of things that aren't clear here -
>
> >IE and Outlook 5.x allow executing arbitrary programs using .eml files
>
> >Description:
> >There is a vulnerability in IE and Outlook 5.x for Win9x/WinNT (probably
> >others) which allows executing arbitrary program
The following is a Security Bulletin from the Microsoft Product Security
Notification Service.
Please do not reply to this message, as it was sent from an unattended
mailbox.
Microsoft Security Bulletin (MS00-017)
-
The following is a Security Bulletin from the Microsoft Product Security
Notification Service.
Please do not reply to this message, as it was sent from an unattended
mailbox.
-BEGIN PGP SIGNED MESSAGE-
Microsoft Security Bulletin
-BEGIN PGP SIGNED MESSAGE-
Cisco Secure PIX Firewall FTP Vulnerabilities
Revision 1.3
For public release 2000 March 16 05:00 PM US/Pacific (UTC+0800)
===
Summary
===
The Cisco Secure PIX Firewall interprets FTP (F
40 matches
Mail list logo
