===
HPUX disable buffer overflow vulnerability
===
Davide Del Vecchio Adv#4
Date: 13/02/2003
Tested on HP-UX B.11.00
Description:
The enable command activates the named printers,
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
- --
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --
PACKAGE : mozilla
SUMMARY : Several vulnerabilities
Hello Ronald and all others
You might be correct with the issue of
escape_dangerous_chars but instead of the technic you
showed
open (SM, |/usr/sbin/sendmail -f rfg $recipient);
I would use
open(SM, |/usr/sbin/sendmail -oi -t) || die
sendmail;
...
print SM To: $recipient\n;
I think an
-
Red Hat, Inc. Red Hat Security Advisory
Synopsis: Updated PAM packages fix bug in pam_xauth module
Advisory ID: RHSA-2003:035-10
Issue date:2003-02-07
Updated on:2003-02-12
At 08:37 2003-02-11 +0100, you wrote:
Ericsson HM220dp ADSL modem Insecure Web Administration Vulnerability
Discussion:
Ericsson HM220dp is a small office enviroment ADSL modem, distributed
by many Carriers such as Telecom Italia to thousand users.
It may be administered remotely through a number
Hi,
As a couple of people have pointed out off list when we discussed it, the
situation I am basically describing generally comes down to that you
shouldn't stick sensitive information in binaries - that was the
fundamental point - I think I was confusing a couple of things I have been
looking at
On Wed, Feb 12, 2003 at 03:21:49AM +, Jon Masters wrote:
We all know that old chestnut about tracing setuid programs or scripts,
but what about non-setuid scripts which have been installed for users and
given execute only permission. For example, a lot of sites provide scripts
for users to
-
Red Hat, Inc. Red Hat Security Advisory
Synopsis: Updated fileutils package fixes race condition in recursive
operations
Advisory ID: RHSA-2003:015-05
Issue date:2003-01-21
Updated on:
As I followed the trail described by Mr. Szor and Mr. Chiens article
(http://www.peterszor.com/blended.pdf), it became clear to me the following
was the transfer point to the abused exception handler like Code Red. For a
normal C/C++ function, it was OK to assume that sub-functions will not
Better would be...
snip
And better still would be no command execution at all:
use Net::SMTP;
my $email = EOM;
To: $to
From: $from
Subject: $subject
...
...
EOM
my $smtp = Net::SMTP-new(mailsever.host.com);
$smtp-mail($from);
$smtp-to($to);
$smtp-data();
$smtp-datasend($email);
At 15.51 13/02/2003, Davide Del Vecchio wrote:
===
HPUX disable buffer overflow vulnerability
===
I sent an e-mail to [EMAIL PROTECTED] beacause the url
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
- --
Debian Security Advisory DSA 250-1 [EMAIL PROTECTED]
http://www.debian.org/security/ Martin Schulze
February 12th, 2003
A bug exists in CheetaChat which lets an attacker with access to the
yaliases.dat
to get users yahoo passwords in plain text.
I. BACKGROUND
CheetaChat is a free and full-featured chatting client that works with
Yahoo! Chat, CheetaServ and Ichat sites. It lets users use solid
Faz [EMAIL PROTECTED] wrote:
Through some testing against some Lotus Domino web servers (verified in
version 5 6), if you append a period to the end of a non-default Lotus
file type (non .NSF, .NTF, etc) via your browser URL request, you will be
prompted to download the file.
I have been
On Tue, 11 Feb 2003 16:11:15 -0500, Peter Huang wrote:
As I followed the trail described by Mr. Szor and Mr. Chiens article
(http://www.peterszor.com/blended.pdf), it became clear to me the following
was the transfer point to the abused exception handler like Code Red. For a
normal C/C++
15 matches
Mail list logo
