[Full-Disclosure] Re: [security bulletin] SSRT2275 HP Tru64 UNIX - Potential Buffer Overflows SSRT2229 Potential Denial of Service (fwd)

2002-09-03 Thread Len Rose
From the How Lame Can It Get or Intellectual Levels of the Net are dropping each year Dept. The example MD5/SHA1 perl script HP/Compaq recommends on the page referenced in the below excerpt, is broken because they didn't escape the greater than/less than symbols. When the page is rendered by

[Full-Disclosure] Compaq mount patch broken

2002-09-03 Thread Paul Szabo
I have installed the latest HP/Compaq Tru64 patches T64V51B19-C0136901-15143-ES-20020817.tar Beware of the /sbin/mount in patch OSFPATC0136901510 within: using 'mount -a' kills any local mountd with log message: Sep 3 06:19:01 rome mountd[228]: aborting: received a User defined signal 1

[SECURITY] [DSA 160-1] New scrollkeeper packages fix insecure temporary file creation

2002-09-03 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 160-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze September 3rd, 2002

Re: Outlook S/MIME Vulnerability

2002-09-03 Thread Spyder
There's more to it than just Outlook. Baltimore's MailSecure, an Outlook plugin which (among other things) verifies S/MIME certs, is also vulnerable to this problem. Certificates issued by middle men appear in MailSecure's certificate information as having inherited trust. However, MailSecure

Re: CacheFlow CacheOS Cross-site Scripting Vulnerability

2002-09-03 Thread Blue
In-Reply-To: 200207250749.33496@Message-id-is-important --- Blue Coat Systems (formerly CacheFlow) Cross Site Scripting Vulnerability --- Blue Coat Systems thanks T. Suzuki of

Re: Security side-effects of Word fields

2002-09-03 Thread Woody Leonhard
In-Reply-To: [EMAIL PROTECTED] Alex - You've come up with a very clever application of field codes - one that I had never considered. I'm working with Word 2000 SR-1a and Word 2002 SP- 2. I've had a chance to converse with Dr. Vesselin Bontchev, who's using Word 97. So far, here's what

SecuRemote usernames can be guessed or sniffed using IKE exchange

2002-09-03 Thread Roy Hills
SecuRemote usernames can be guessed or sniffed using IKE exchange Introduction: - While performing a VPN security analysis for one of our customers, I discovered a potential issue with Firewall-1 SecuRemote IKE which can allow usernames to be guessed. I also observed the related

MSIEv6 % encoding causes a problem again

2002-09-03 Thread Liu Die Yu
it's about cross-site scripting at MSIEv6 client side using % encoding, but not the same as the one by PeaceFire.org which doesn't work on my PC. [tested]MSIEv6(CN version) {IEXPLORE.EXE file version: 6.0.2600.} {MSHTML.DLL file version: 6.00.2600.} [demo] at

Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities

2002-09-03 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities Revision 1.0 For Public Release 2002 September 03 at 1500 UTC -- Contents Summary

Re: SUMMARY: Disabling Port 445 (SMB) Entirely

2002-09-03 Thread Shaolin Tiger
# Port 445 - This is a highly debated area by Microsoft themselves and many others # It's uses are discussed here: http://ntsecurity.nu/papers/port445/ # # Method 1: Steps in Windows 2000 Professional, SP2: (Please read others below before proceeding as this one may prevent # # DHCP from

Re: One step easier password guessing on Windows

2002-09-03 Thread Howard Yeend
a few comments: 1) this is a known issue 2) Revelation, snitch, openPass, etc won't work in msie 3) If the password is 'remembered' by the server (ie, not cached, but sent as part of the html), you could just view source. 4) Not as relevent, but you could do some simple XSS to alert the password

[security bulletin] SSRT2310a HP Tru64 UNIX HP OpenVMS PotentialOpenSSL Security Vulnerability (fwd)

2002-09-03 Thread Dave Ahmad
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 SECURITY BULLETIN SSRT2310a - HP Tru64 UNIX HP OpenVMS Potential == OpenSSL Security Vulnerability The HP Security Bulletin has been posted to the support website - http://thenew.hp.com/country/us/eng/support.html Use

Re: Compaq mount patch broken

2002-09-03 Thread Florian Weimer
[EMAIL PROTECTED] (Paul Szabo) writes: I have reported this to Compaq (but expect no speedy resolution). I am puzzled: why patch /sbin/mount or /usr/bin/csh if they are not setuid? Paul confirmed in private email that /sbin/mount is statically linked. I guess that it contains a copy of the

Re: **maillist:: Outlook S/MIME Vulnerability

2002-09-03 Thread Thomas Seliger
Since the failure of checking certificate chain correctly seems to be buried deeper in windows (maybe in some DLL? some info from microsoft would be greatly appreciated, but their security offensive seems to be hot air anyway), i could imagine more possibilities to exploit it: * certificates

[CLA-2002:522] Conectiva Linux Security Announcement - mailman

2002-09-03 Thread secure
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- CONECTIVA LINUX SECURITY ANNOUNCEMENT - -- PACKAGE : mailman SUMMARY : Cross site scripting

Cross-Site Scripting in Aestiva's HTML/OS

2002-09-03 Thread eax
Aestiva HTML/OS is a high-performance database engine and development suite for building advanced web sites and web-based software products. SUMMARY: The Aestiva HTML/OS CGIs appear vulnerable to XSS due to poor error reporting (no metacharacter filtering). Anything you want can be appended