Re: [Full-disclosure] Brain dead SSH scans from Italy

2005-10-28 Thread Nick FitzGerald
Etaoin Shrdlu wrote: <> > Thanks to whomever finally got through, however you did it. I had actually > allowed one host to start responding, and it had gotten to the part I > always least understand, i.e. the tries for root's password. I mean, > really, are there that many hosts out there with roo

[Full-disclosure] [USN-206-2] Fixed lynx packages for USN-206-1

2005-10-28 Thread Martin Pitt
=== Ubuntu Security Notice USN-206-2 October 29, 2005 lynx regression fix === A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (

[Full-disclosure] [USN-151-3] zlib vulnerabilities

2005-10-28 Thread Martin Pitt
=== Ubuntu Security Notice USN-151-3 October 28, 2005 aide vulnerabilities CVE-2005-1849, CVE-2005-2096 === A security issue affects the following Ubuntu releases: Ubuntu 4.10

Re: [Full-disclosure] Brain dead SSH scans from Italy

2005-10-28 Thread Vania Martino Toma
Etaoin Shrdlu wrote: >Well, I'm stumped. I mean, really stumped. > >I've had a host scanning my network for the past three days, and it >initially looked like one of the automated scans we've all become so >familiar with (unfortunately). Naturally, the automatic defense was >engaged, and I thought

Re: [Full-disclosure] Brain dead SSH scans from Italy

2005-10-28 Thread Valdis . Kletnieks
On Fri, 28 Oct 2005 13:14:31 PDT, Etaoin Shrdlu said: > always least understand, i.e. the tries for root's password. I mean, > really, are there that many hosts out there with root accounts that can be > guessed with an automated password guesser? You're new here, aren't you? :) pgpzksyA7Oqna.p

Re: [Full-disclosure] Brain dead SSH scans from Italy

2005-10-28 Thread Etaoin Shrdlu
Etaoin Shrdlu wrote: > > Well, I'm stumped. I mean, really stumped. > > I've had a host scanning my network for the past three days... > I'm at a loss. If anyone knows Italian (I don't), and can contact one of: > > [EMAIL PROTECTED] > [EMAIL PROTECTED] > [EMAIL PROTECTED] > > or anyone at ocem

[Full-disclosure] iDefense Security Advisory 10.28.05: Multiple Vendor chmlib CHM File Handling Buffer Overflow Vulnerability

2005-10-28 Thread iDEFENSE Labs
Multiple Vendor chmlib CHM File Handling Buffer Overflow Vulnerability iDefense Security Advisory 10.28.05 www.idefense.com/application/poi/display?id=332&type=vulnerabilities October 28, 2005 I. BACKGROUND chmlib is a library for dealing with Microsoft ITSS/CHM format files. II. DESCRIPTIO

[Full-disclosure] [USN-213-1] sudo vulnerability

2005-10-28 Thread Martin Pitt
=== Ubuntu Security Notice USN-213-1 October 28, 2005 sudo vulnerability CVE-2005-2959 === A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog)

[Full-disclosure] [USN-212-1] libgda2 vulnerability

2005-10-28 Thread Martin Pitt
=== Ubuntu Security Notice USN-212-1 October 28, 2005 libgda2 vulnerability CAN-2005-2958 === A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Wartho

Re: [Full-disclosure] Re: Microsoft AntiSpyware falling furtherbehind

2005-10-28 Thread Valdis Shkesters
(This is important day for you, now you know you're not alone ;) In regard to spyware, at last I hear clear and logical formulation. Theory is nice, but practice differs. "In its broader sense, Spyware is used as a synonym for what the Anti-Spyware Coalition calls "Spyware and Other Potentially U

[Full-disclosure] HHU #1: "It's secure, it's reliable, it's Swiss"

2005-10-28 Thread deepquest
___ ___ ___ /__/\ /__/\ /__/\ \ \:\\ \:\\ \:\ \__\:\\__\:\\ \:\ ___ / /::\ ___ / /::\ ___ \ \:\ /__/\ /:/\:\ /__/\ /:/\:\ /__/\ \__\:\ \ \:\/:/__\/ \ \:\/:/__\/ \ \:\ / /:/ \ \::/

[Full-disclosure] Re: Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte

2005-10-28 Thread x
Bipin Gautam said: + > Consequently, the issue that you describe is *not* a + > vulnerability issue, but rather just an example of a new + > variant that has not yet been added to an AV vendor's + > database of "known viruses". + + yap, maybe* but i consider this issue equv. to the + 'classic i

Re: [Full-disclosure] Brain dead SSH scans from Italy

2005-10-28 Thread Jeff MacDonald
On Fri, 2005-10-28 at 08:15 -0700, Etaoin Shrdlu wrote: > Well, I'm stumped. I mean, really stumped. > > I've had a host scanning my network for the past three days, and it > initially looked like one of the automated scans we've all become so > familiar with (unfortunately). Naturally, the automa

Re: [Full-disclosure] Re: Microsoft AntiSpyware falling further behind

2005-10-28 Thread Valdis . Kletnieks
On Fri, 28 Oct 2005 17:56:32 +0300, Valdis Shkesters said: (Hmm.. usually when I reply to Valdis I'm talking to myself... ;) > As today I was preparing news for a portal on IT security, > I am informed that Anti-Spyware Coalition is finalizing spyware > definition. It is last moment to finalize w

[Full-disclosure] Brain dead SSH scans from Italy

2005-10-28 Thread Etaoin Shrdlu
Well, I'm stumped. I mean, really stumped. I've had a host scanning my network for the past three days, and it initially looked like one of the automated scans we've all become so familiar with (unfortunately). Naturally, the automatic defense was engaged, and I thought that would be the end of it

Re: [Full-disclosure] Re: Microsoft AntiSpyware falling further behind

2005-10-28 Thread Valdis Shkesters
Hi, As today I was preparing news for a portal on IT security, I am informed that Anti-Spyware Coalition is finalizing spyware definition. It is last moment to finalize with spyware, because at the horizon already has appeared “crimeware”. Take a look at http://www.antiphishing.org/. I’m quoting

Re: [Full-disclosure] Re: Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte

2005-10-28 Thread Andrey Bayora
Hello x, > The AV vendors aren't going to patch their products if they > don't detect your PoC; they're just going to write a new > signature or modify an existing signature to detect your > new variants. The fact that it can and will be fixed by > AV signatures instead of product patches should

RE: [Full-disclosure] RE: Full-Disclosure Digest, Vol 8, Issue 48

2005-10-28 Thread auto445789
> The virus scanner determined the type of the file by > the header and it failed. That's bad news. I am > wondering however, when I execute that file, how does > the OS process the file? I guess my question is, if I > have a modified version of a virus, with whatever > header, if I try to execute

[Full-disclosure] Re: Microsoft AntiSpyware falling further behind

2005-10-28 Thread Valdis Shkesters
Hi, Maybe better to call the things their names and not to create havoc? Let's there be adware, Trojan horses, backdoors, viruses, etc. Hullabaloo with so called spyware has brought us up to such a state, that on September 29th PC World wrote "While adware can be a major annoyance, spyware can be

[Full-disclosure] [SECURITY] [DSA 878-1] New netpbm-free packages fix arbitrary code execution

2005-10-28 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 878-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze October 28th, 2005

Re: [Full-disclosure] Multiple Vendor Anti-Virus Software DetectionEvasion Vulnerability through forged magic byte

2005-10-28 Thread Bipin Gautam
> Consequently, the issue that you describe is *not* a > vulnerability issue, but rather just an example of a new variant > that has not yet been added to an AV vendor's database of "known > viruses". > yap, maybe* but i consider this issue equv. to the 'classic issue' of adding NOP to the shell-c

[Full-disclosure] [ GLSA 200510-24 ] Mantis: Multiple vulnerabilities

2005-10-28 Thread Thierry Carrez
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200510-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 200510-23 ] TikiWiki: XSS vulnerability

2005-10-28 Thread Thierry Carrez
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200510-23 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ GLSA 200510-22 ] SELinux PAM: Local password guessing attack

2005-10-28 Thread Thierry Carrez
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200510-22 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] British Telecom remote landline hijack - NCR (No Crocodile-clips Required)

2005-10-28 Thread Betty Duz
Overview British Telecom (BT) operates an automated fault detection and reporting system that allows anyone to test any line. If the line is found to be faulty the caller is given an option to divert all incoming calls for that line to another number, including mobile phones. No authentica

[Full-disclosure] [SECURITY] [DSA 877-1] New gnump3d packages fix several vulnerabilities

2005-10-28 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 877-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze October 28th, 2005