Re: Help Please

2002-11-09 Thread Patrick Oonk
On Fri, Nov 08, 2002 at 12:31:05AM -0800, Mark Litchfield wrote: Does any one have or know of a security contact within www.real.com, as I have a serious issue to report. Tried the website, only have technical support and the web forms don't allow for much content.

[SECURITY] [DSA 188-1] New Apache-SSL packages fix several vulnerabilities

2002-11-09 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 188-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze November 5th, 2002

Re: Accesspoints disclose wep keys, password and mac filter (fwd)

2002-11-09 Thread Tollef Fog Heen
* Tom Knienieder | Possibly vulnerable, not tested, OEM Version from GlobalSunTech: | D-Link DWL-900AP+ B1 version 2.1 and 2.2 2.2 seems vulnerable, but has different offsets. sendto(3, gstsearch, 9, 0, {sin_family=AF_INET, sin_port=htons(27155),

Re: Accesspoints disclose wep keys, password and mac filter (fwd)

2002-11-09 Thread tenty
Quoting [EMAIL PROTECTED]: In-Reply-To: [EMAIL PROTECTED] Possibly vulnerable, not tested, OEM Version from GlobalSunTech: D-Link DWL-900AP+ B1 version 2.1 and 2.2 snip The D-Link DWL-900AP+ B1 2.1 isn't affected. I'm sorry, this device IS vulnerable, I believe ALL

NetBSD Security Advisory 2002-024: IPFilter FTP proxy

2002-11-09 Thread NetBSD Security Officer
-BEGIN PGP SIGNED MESSAGE- NetBSD Security Advisory 2002-024 = Topic: IPFilter FTP proxy Version:NetBSD-current: source prior to September 20, 2002 NetBSD 1.6: affected

Oracle iSQL*Plus buffer Overflow..

2002-11-09 Thread deadbeat
-BEGIN PGP SIGNED MESSAGE- Hiya, I was wondering if anyone could post a stack trace of this to me or to the group, as it would be very useful in testing.. Thanks. -BEGIN PGP SIGNATURE- Version: Hush 2.2 (Java) Note: This signature can be verified at

Re: Motorola Cable Modem DOS

2002-11-09 Thread Peter Arnts
In-Reply-To: 1036008147.22818.31.camelryans I wasn't able to reproduce this on an SB4200 running SB4200-0.4.4.0-SCM06- NOSH firmware. What version of NMAP are you using? Also, when you said Simply nmap'ing the cable user's IP address, ie: # nmap -sS -p 1-1024 12.x.x.x, which IP address

Potential Denial of Service Vulnerability in IRIX RPC-based libc

2002-11-09 Thread SGI Security Coordinator
-BEGIN PGP SIGNED MESSAGE- __ SGI Security Advisory Title: Potential Denial of Service Vulnerability in RPC-based libc Number : 20021103-01-P Date : November 7, 2002 Reference:

Re: When scrubbing secrets in memory doesn't work

2002-11-09 Thread Michael Zimmermann
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 At Dienstag, 5. November 2002 23:13 Michael Howard wrote: During the Windows Security Push in Feb/Mar 2002, we noticed an 'interesting' anomaly with code to scrub passwords that looks like this: bool DoSensitiveStuff() { bool fOK = false;

Cisco PIX SSH/telnet dDOS vulnerability CSCdy51810

2002-11-09 Thread Nils Reichen
Security Advisory 05.11.02: Title : Cisco PIX SSH/telnet DOS vulnerability CSCdy51810 Reporter : Nils Reichen LANexpert SA Affected software : PIX OS 6.2.2 (and probably old version) Risk : High Date : November 5, 2002 URL: Full description should be posted in few days on

Finding Vendor Security Contacts

2002-11-09 Thread Ed Ravin
Mark Litchfield writes: Does any one have or know of a security contact within www.real.com, as I have a serious issue to report. Tried the website, only have technical support and the web forms don't allow for much content. At one of the BOF forums at LISA 2002, a representative from CERT,

Zeus Admin Server v4.1r2 index.fcgi XSS bug

2002-11-09 Thread euronymous
=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: Zeus Admin Server v4.1r2 index.fcgi XSS bug product: Zeus Admin Server v4.1r2 for linux/x86 vendor: http://www.zeus.co.uk risk: very low (authorisation required) date: 11/8/2k2 discovered by: euronymous /F0KP /HACKRU Team advisory urls:

Securing OWA on public computers.

2002-11-09 Thread Alex T.
I've noticed that when accessing Outlook web access (through https) and opening word attachment the attachment remain in cache. The cache is still here even after closing browser. When accessing confidential documents from public computers this present security risk. Any way to prevent this

RhinoSoft Serv-U FTP Anonymous Remote DoS Vulnerability

2002-11-09 Thread [secondmotion]-Matt Thompson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 = secondmotion-SM-SA-02-03Security Advisory = Topic: RhinoSoft Serv-U FTP Anonymous

Re: How to execute programs with parameters in IE - Sandblad advisory #10

2002-11-09 Thread hysterix1
In-Reply-To: 006001c28704$a3c1ef10$a600a8c0LocalHost Doesnt work on my, yours or Andreas. I get a This operation can only function in HTML Help. Also i since i have debugging on, I get a line 0 permission denied error from IE. location.replace('mk:MSITStore:C:') Only that line code is

[SECURITY] [DSA 192-1] New html2ps packages fix arbitrary code execution

2002-11-09 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 192-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze November 8th, 2002