Re: [Full-disclosure] RealVNC 4.1.1 Remote Compromise

2006-05-18 Thread Joachim Schipper
On Mon, May 15, 2006 at 07:58:10AM -0500, Dixon, Wayne wrote: > So what can be done about this exploit? Does 4.1.2 protect against this > vulnerability? And what other mitigation procedures are available for > this? The best solution is not to run a VNC service using no more than it's own authen

Re: OpenVPN 2.0.7 and below: Remote OpenVPN Management Interface Flaw

2006-05-04 Thread Joachim Schipper
On Wed, May 03, 2006 at 06:12:35PM +0100, [EMAIL PROTECTED] wrote: > Hi, > > There is a flaw (well more a stupid design than anything else) in OpenVPN > 2.0.7 (and below) in the the Remote Management Interface that allows an > attacker to gain complete control because there is NO AUTHENTICATION (Y

Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotaged hosts-file lookup

2006-04-14 Thread Joachim Schipper
On Thu, Apr 13, 2006 at 06:29:15PM +0100, Dave Korn wrote: > > Hey, guess what I just found out: Microsoft have deliberately sabotaged > their DNS client's hosts table lookup functionality. > (...) I'd try to block (Windows Media Player) it in my hosts file. > Microsoft DNS client special-