Re: Flaw in OpenOffice.org 2.1: OpenOffice 2.1 is vulnerable to MS Word 0 day vulnerability!!!

2006-12-18 Thread Dragos Ruiu
On Friday 15 December 2006 10:07, Bruno Lustosa wrote: > On 15 Dec 2006 09:49:54 -, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > try yourself with OpenOffice.org 2.1: > > http://www.milw0rm.com/sploits/12122006-djtest.doc > > Crashed OpenOffice.org 2.1 on my Linux system (Gentoo using > ope

Odysseus 2.0 / Telemachus 1.0 (Beta)

2006-12-18 Thread Dave
Everyone's favourite native Win32 proxy: Bigger, better, faster, more... http://www.bindshell.net/odysseus And announcing Telemachus, a companion utility for Odysseus, allowing further analysis and manipulation of the HTTP transactions that have passed through Odysseus. Telemachus can co

Re: Re: Flaw in OpenOffice.org 2.1: OpenOffice 2.1 is vulnerable to MS Word 0 day vulnerability!!!

2006-12-18 Thread ox90x86
Do you happen to have a printout of the register states at the time of the crash. Also, is ncpN user definable?? as you seemed to be correct in your calculation of 6*587202560+4=3523215364 and that amount of zero's being written. But i guess you never know, if you will notice also maybe someth

Re: Flaw in OpenOffice.org 2.1: OpenOffice 2.1 is vulnerable to MS Word 0 day vulnerability!!!

2006-12-18 Thread George Yobst
Confirmed. Crashes a fresh 2.1 on W2K (fully patched). The error is 'Main Memory Shortage...' then it starts into document recovery. -George On Fri, 15 Dec 2006, Bruno Lustosa wrote: | On 15 Dec 2006 09:49:54 -, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: | > try yourself with OpenOffice.

[SECURITY] [DSA 1237-1] New Linux 2.4.27 packages fix several vulnerabilities

2006-12-18 Thread Dann Frazier
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1237-1[EMAIL PROTECTED] http://www.debian.org/security/ Dann Frazier December 17th, 2006

[SECURITY] [DSA 1238-1] New clamav packages fix several vulnerabilities

2006-12-18 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1238-1[EMAIL PROTECTED] http://www.debian.org/security/ Moritz Muehlenhoff December 17th, 2006

[SECURITY] [DSA 1239-1] New sql-ledger packages fix arbitrary code execution

2006-12-18 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1239-1[EMAIL PROTECTED] http://www.debian.org/security/ Moritz Muehlenhoff December 17th, 2006

Re: The (in)security of Xorg and DRI

2006-12-18 Thread Darren Reed
In some mail from Nicolas RUFF, sie said: > > Hello, > > You might be referring to the SMM vulnerability that has been presented > at CanSecWest'06 (?) > > http://www.cansecwest.com/slides06/csw06-duflot.ppt Yes...are there any more details related to this ? (Whitepaper, code, etc...) D

Cisco not honoring update promises?

2006-12-18 Thread Michael Scheidell
Has anyone else had a problem with Cisco not honoring their posted, advertised promise to provide updates to IOS if it's a security vulnerability? I have spend almost a month going back and forth with Cisco on this and decided to ask this question in bugtraq. Each time I get back 'your contract ex

HyperVM Cross-Site Scripting

2006-12-18 Thread Advisory
#Aria-Security Team Advisory # # #--- #Software: HyperVM #Method: Cross-Site Scripting #Vendor: http://hypervm.com # #PoC: # #victim::/display.php?frm_action=%22%3E%3Cscript%3Ealert('a')%3C/script%3E # #Contact: [EMAIL PROTECTED]

Re: The (in)security of Xorg and DRI

2006-12-18 Thread Darren Reed
In some mail from Nicolas RUFF, sie said: > > Hello, > > You might be referring to the SMM vulnerability that has been presented > at CanSecWest'06 (?) > > http://www.cansecwest.com/slides06/csw06-duflot.ppt To answer my own followup question: http://www.ssi.gouv.fr/fr/sciences/fichiers/

RateMe <= all versions => ( main.inc.php ) Remote File Include Vulnerability

2006-12-18 Thread saudi
+ + ;;ii,,:: + + :: ;;t

SYMSA-2006-013: Multiple Vulnerabilities in Mandiant First Response

2006-12-18 Thread research
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Symantec Vulnerability Research http://www.symantec.com/research Security Advisory Advisory ID: SYMSA-2006-013 Advisory Title: Multiple Vulnerabilities in Mandiant First Respons

Secunia Research: MailEnable POP Service "PASS" Command Buffer Overflow

2006-12-18 Thread Secunia Research
== Secunia Research 18/12/2006 - MailEnable POP Service "PASS" Command Buffer Overflow - == Table of Contents Affected Software...

Checkpoint NG3 ICMP Flood

2006-12-18 Thread bdmoraes
Dear All, I have one checkpoint NG3 in my company and verifying in Tracking i have tousands of events with ICMP type 8 and type 17. The events has origin in my internal networks, with one problem .. the Source IP is my PAT address for internal hosts to internet. Is there any bug of Checkpoint

Re: Flaw in OpenOffice.org 2.1: OpenOffice 2.1 is vulnerable to MS Word 0 day vulnerability!!!

2006-12-18 Thread p . kerr
OOo 2.1.0rc2 MacOS-X (10.4.6) complains of "Main memory shortage", then crashes and goes into automatic recovery

Re: Flaw in OpenOffice.org 2.1: OpenOffice 2.1 is vulnerable to MS Word 0 day vulnerability!!!

2006-12-18 Thread Kamchybek Jusupov
It's openoffice-2.0.4 (gentoo), and it did crashed with the below error... synack ~ $ oowriter2 12122006-djtest.doc Application ErrorApplication Error Fatal exception: Signal 6 Stack: /usr/lib/openoffice/program/libuno_sal.so.3[0xb71b0424] /lib/libc.so.6(malloc+0x7f)[0xb6b52cff] /usr/lib/openof

Re: Flaw in OpenOffice.org 2.1: OpenOffice 2.1 is vulnerable to MS Word 0 day vulnerability!!!

2006-12-18 Thread Marcus Meissner
On Sun, Dec 17, 2006 at 06:05:14PM +0800, Kamchybek Jusupov wrote: > > It's openoffice-2.0.4 (gentoo), and it did crashed with the below > error... > > synack ~ $ oowriter2 12122006-djtest.doc > Application ErrorApplication Error > > Fatal exception: Signal 6 > Stack: > /usr/lib/openoffice/prog

Re: Cisco not honoring update promises?

2006-12-18 Thread rsmoak
Michael, This message came to my attention this morning via your posting to bugtraq. Apologies for the trouble you are having. Cisco gives specific guidance in each of our public security advisories regarding software upgrades. If the bug that you are trying to obtain an upgrade for is docu

Re: Checkpoint NG3 ICMP Flood

2006-12-18 Thread Michael Schwartzkopff
Am Montag, 18. Dezember 2006 12:14 schrieb [EMAIL PROTECTED]: > Dear All, > > I have one checkpoint NG3 in my company and verifying in Tracking i have > tousands of events with ICMP type 8 and type 17. > > The events has origin in my internal networks, with one problem .. the > Source IP is my PAT

Re: Checkpoint NG3 ICMP Flood

2006-12-18 Thread Hugo van der Kooij
On Mon, 18 Dec 2006, [EMAIL PROTECTED] wrote: I have one checkpoint NG3 in my company and verifying in Tracking i have tousands of events with ICMP type 8 and type 17. The events has origin in my internal networks, with one problem .. the Source IP is my PAT address for internal hosts to inte

[ GLSA 200612-18 ] ClamAV: Denial of Service

2006-12-18 Thread Sune Kloppenborg Jeppesen
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200612-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[security bulletin] HPSBUX02178 SSRT061267 rev.2 - HP-UX Secure Shell Remote Unauthorized Denial of Service (DoS)

2006-12-18 Thread security-alert
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c00815112 Version: 2 HPSBUX02178 SSRT061267 rev.2 - HP-UX Secure Shell Remote Unauthorized Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon