RE: iDefense Security Advisory

/advisory and are properly PGP signed when sent over email. Thanks, - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com > -Original Mess

iDEFENSE Security Advisory 11.19.02b: Eudora Script Execution Vulnerability

hreats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com -BEGIN PGP SIGNATURE- Version: PGP 7.1

iDEFENSE Security Advisory 11.19.02a: Denial of Service Vulnerability in Linksys Cable/DSL Routers

on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com -BEGIN PGP SIGNAT

iDEFENSE Security Advisory 11.19.02c: Netscape Predictable Directory Structure Allows Theft of Preferences File

dministrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703

Update: iDEFENSE Security Advisory 11.19.02b: Eudora Script Execution Vulnerability

to our attention. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com -BEGIN PGP SIGNATURE- Version: PGPfreeware 6.5.8 for non-commercial use

iDEFENSE Security Advisory 11.11.02: Buffer Overflow in KDE resLISa

etwork administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151

iDEFENSE Security Advisory 11.08.02b: Non-Explicit Path Vulnerability in QNX Neutrino RTOS

ovide decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, I

iDEFENSE Security Advisory 11.08.02a: File Disclosure Vulnerability in Simple Web Server

ide decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFE

Linksys security contact

Cable/DSL Router, has been udpated to reflect an official vendor response from Linksys. Also, the analysis section has been refined to address some inaccuracies from people reporting on this in the press. http://www.idefense.com/advisory/10.31.02a.txt Thanks, - -dave David Endler, CISSP

iDEFENSE Security Advisory 11.06.02: Non-Explicit Path Vulnerability in LuxMan

on support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com -BEGIN P

iDEFENSE Security Advisory 11.04.02a: Pablo FTP Server DoS Vulnerability

on support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com -BEGIN

iDEFENSE Security Advisory 11.04.02b: Denial of Service Vulnerability in Xeneo Web Server

ous code. Our security intelligence services provide decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David En

iDEFENSE Security Advisory 11.01.02: Buffer Overflow Vulnerability in Abuse

telligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.c

iDEFENSE Security Advisory 10.31.02c: PHP-Nuke SQL Injection Vulnerability

ot; About iDEFENSE: iDEFENSE is a global security intelligence company that proactively monitors sources throughout the world — from technical vulnerabilities and hacker profiling to the global spread of viruses and other malicious code. Our security intelligence services provide decision-make

iDEFENSE Security Advisory 10.31.02a: Denial of Service Vulnerability in Linksys BEFSR41 EtherFast Cable/DSL Router

gence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www

iDEFENSE Security Advisory 10.31.02b: Prometheus Application Framework Code Injection

ices provide decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligen

iDEFENSE Security Advisory 10.24.02: Directory Traversal in SolarWinds TFTP Server

ing to the global spread of viruses and other malicious code. Our security intelligence services provide decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, vi

iDEFENSE Security Advisory 10.16.02: Denial of Service in Sabre Desktop Reservation Client for Windows

intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PR

iDEFENSE Security Advisory 10.15.02: DoS and Directory Traversal Vulnerabilities in WebServer 4 Everyone

on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com -BEGIN P

iDEFENSE Security Advisory 10.03.2002: Apache 1.3.x shared memory scoreboard vulnerabilities

on-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook

iDEFENSE Security Advisory 10.02.2002: Net-SNMP DoS Vulnerability

y access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-9

iDEFENSE Security Advisory 10.01.02: Sendmail smrsh bypass vulnerabilities

T Method One was exclusively disclosed to iDEFENSE by zen-parse ([EMAIL PROTECTED]) Method Two was discovered during the verification process by Pedram Amini ([EMAIL PROTECTED]) Get paid for security research http://www.idefense.com/contributor.html Subscribe to iDEFENSE Advisories: send email to

iDEFENSE Security Advisory 09.30.2002: Buffer Overflow in WN Server

AIL PROTECTED]). Get paid for security research http://www.idefense.com/contributor.html - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com -BE

RE: iDEFENSE Security Advisory 09.26.2002: Exploitable Buffer Overflow in gv

ts I imagine would be trivial to create. - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com -BEGIN PGP SIGNATURE- Version: PGP 7.1.2 Comment: htt

Errata: iDEFENSE Security Advisory 09.26.2002: Exploitable Buffer Overflow in gv

/cvename.cgi?name=CAN-2002-0838 - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com -BEGIN PGP SIGNATURE- Version: PGP 7.1.2 Comment: http

iDEFENSE Security Advisory 09.26.2002: Exploitable Buffer Overflow in gv

DIT This issue was exclusively disclosed to iDEFENSE by zen-parse ([EMAIL PROTECTED]). Get paid for vulnerability research http://www.idefense.com/contributor.html David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 70

Now Online: OWASP Guide to Building Secure Web Applications v1.1

We are pleased to announce an updated version of the Open Web Application Security Project Guide to Building Secure Web Applications in both PDF (983K) and HTML at: http://www.owasp.org/guide/ The Guide covers various web application security topics from architecture to preventing attack sp

iDEFENSE Security Advisory 09.23.2002: Directory Traversal in Dino's Webserver

Clients 9/14/2002 - Vendor Response 9/23/2002 - Public Disclosure CREDIT This issue was exclusively disclosed to iDEFENSE by Tamer Sahin ([EMAIL PROTECTED]). Get paid for security research: http://www.idefense.com/contributor.html David Endler, CISSP Director, Technical Intelligence iDEF

iDEFENSE Security Advisory 09.18.2002: Security Vulnerabilities in OSF1/Tru64 3.

onse received from [EMAIL PROTECTED] September 18, 2002 - Public Disclosure http://www.idefense.com/contributor.html David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.i

iDEFENSE Security Advisory 09.16.2002: FreeBSD Ports libkvm Security Vulnerabilities

ENSE clients September 16, 2002 - Coordinated public disclosure by FreeBSD and iDEFENSE CREDIT This issue was exclusively disclosed to iDEFENSE by [EMAIL PROTECTED] http://www.idefense.com/contributor.html David Endler, CISSP Director, Technical Intelligence iDEFENSE,

iDEFENSE Security Advisory: Linuxconf locally exploitable buffer overflow

Briggs ([EMAIL PROTECTED]) http://www.idefense.com/contributor.html - - -dave David Endler, CISSP Director, Technical Intelligence iDEFENSE, Inc. 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 703-344-2632 fax: 703-961-1071 [EMAIL PROTECTED] www.idefense.com -BEGIN PGP SIGNATURE---

US TurboLinux Security Severely Out of Date

/7 and ftp://ftp.turbolinux.com/mirrors/ftp.turbolinux.co.jp/stable Additionally while it may be inconvenient to many non-Japanese customers, users can also get notification of new security issues in Japanese for the time being from http://the.turbolinux.co.jp/bugzilla/. David Endler, CISS

Evolution of Cross-Site Scripting Attacks

sed a great FAQ today available at: http://www.cgisecurity.com/articles/xss-faq.shtml Some of the concepts in the iDEFENSE Labs paper may be better understood after reading this FAQ. -dave David Endler, CISSP Director, iDEFENSE Labs 14151 Newbrook Drive Suite 100 Chantilly, VA 20151 voice: 70