[Full-disclosure] [USN-248-1] unzip vulnerability

=== Ubuntu Security Notice USN-248-1 February 13, 2006 unzip vulnerability CVE-2005-4667 === A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty

[Full-disclosure] [USN-249-1] xpdf/poppler/kpdf vulnerabilities

=== Ubuntu Security Notice USN-249-1 February 13, 2006 xpdf, poppler, kdegraphics vulnerabilities CVE-2006-0301 === A security issue affects the following Ubuntu releases:

[Full-disclosure] [USN-250-1] Linux kernel vulnerability

=== Ubuntu Security Notice USN-250-1 February 13, 2006 linux-source-2.6.12 vulnerability CVE-2006-0454 === A security issue affects the following Ubuntu releases: Ubuntu 5.10

[Full-disclosure] [ Secuobs - Advisory ] Another kind of DoS on Nokia cell phones

[Software affected] Bluetooth Stack on Nokia cell phones [Version] Nokia N70 and maybe other models [Impact] Remote Denial of Service, cellular phones begin to be slower and then freeze after a short period (within 30 seconds). [Credits] Pierre Betouin - [EMAIL PROTECTED] - Bug found with BSS

[Full-disclosure] [SECURITY] [DSA 974-1] New gpdf packages fix denial of service

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 974-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze February 15th, 2006

Re: [Full-disclosure] Tracking with etags

iirc very similar problem was made public several years ago and there was online demo. a solution may be to disable browser cache - stops at least the privacy problem between sessions. -- where do you want bill gates to go today? On Tue, Feb 14, 2006 at 08:23:35AM -0800, Adam Gleave wrote:

[Full-disclosure] Kadu Remote Denial Of Service Fun

Hi all, Some little Kadu fun info: http://www.piotrbania.com/all/adv/kadu-fun.txt best regards, pb -- Piotr Bania - [EMAIL PROTECTED] - 0xCD, 0x19 Fingerprint: 413E 51C7 912E 3D4E A62A BFA4 1FF6 689F BE43 AC33

[Full-disclosure] CYBSEC - Security Pre-Advisory: Arbitrary File Read/Delete in SAP BC

(The following advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Arbitrary_File_Read_or_Delete_in_SAP_BC.pdf ) CYBSEC S.A. www.cybsec.com Pre-Advisory Name: Arbitrary File Read/Delete in SAP BC (Business Connector) Vulnerability

[Full-disclosure] CYBSEC - Security Pre-Advisory: Phishing Vector in SAP BC

(The following advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Phishing_Vector_in_SAP_BC.pdf ) CYBSEC S.A. www.cybsec.com Pre-Advisory Name: Phishing Vector in SAP BC (Business Connector) Vulnerability Class: Phishing Vector /

Re: [Full-disclosure] iDefense Labs Quarterly Hacking Challenge

Gee, I wonder how much money iDefense is going to make from this? -simon [EMAIL PROTECTED] wrote: iDefense Labs is pleased to announce the launch of our quarterly hacking challenge. Going forward, on a quarterly basis, we will select a new focus for the challenge and outline the rules for

Re: [Full-disclosure] CYBSEC - Security Pre-Advisory: Arbitrary File Read/Delete in SAP BC

Thats probably not a good idea... You could end up with a situation like this: http://www.idefense.com/intelligence/vulnerabilities/display.php?id=324 -KF 3. Running the JVM setuid root. ___ Full-Disclosure - We believe in it. Charter:

Re: [Full-disclosure] iDefense Labs Quarterly Hacking Challenge

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 zdi is step up to ;] Simon Smith wrote: Gee, I wonder how much money iDefense is going to make from this? -simon [EMAIL PROTECTED] wrote: iDefense Labs is pleased to announce the launch of our quarterly hacking challenge. Going forward,

[Full-disclosure] [SECURITY] [DSA 975-1] New nfs-user-server packages fix arbitrary code execution

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 975-1 [EMAIL PROTECTED] http://www.debian.org/security/ Moritz Muehlenhoff February 15th, 2006

[Full-disclosure] Forensic Analysis of a Paypal Phishing Scam

Hello all, I recently received this e-mail notifying me of a new e-mail address that was added to my Paypal account. I broke down the steps I took to analyze the e-mail first to identify that it was a phishing scam and then to track down the steps this Scammer used and identify the systems in

[Full-disclosure] [SECURITY] [DSA 976-1] New libast packages fix arbitrary code execution

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 976-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze February 15th, 2006

Re: [Full-disclosure] iDefense Labs Quarterly Hacking Challenge

$50,000 for reporting BSA that your neighbor uses an illegal version of Window$ ! https://reporting.bsa.org/usa/home.aspx ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by

[Full-disclosure] Cisco Security Advisory: TACACS+ Authentication Bypass in Cisco Anomaly Detection and Mitigation Products

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: TACACS+ Authentication Bypass in Cisco Anomaly Detection and Mitigation Products Document ID: 69073 Advisory ID: cisco-SA-20060215-guard-auth http://www.cisco.com/warp/public/707/cisco-sa-20060215-guard.shtml Revision 1.0

Re: [Full-disclosure] iDefense Labs Quarterly Hacking Challenge

On 2/15/06, Jerome Athias [EMAIL PROTECTED] wrote: $50,000 for reporting BSA that your neighbor uses an illegal version of Window$ ! That is entirely inaccurate. The $5 reward with numerous strings attached is for reporting a company using multiple pirated copies of software, reporting

Re: [Full-disclosure] iDefense Labs Quarterly Hacking Challenge

Yeah, if Grandma next door gets hit with a $1,000,000 judgment. https://reporting.bsa.org/usa/rewardsconditions.aspx That's only 5%. The lawyers at the BSA probably take 40%. /mike. Jerome Athias wrote: $50,000 for reporting BSA that your neighbor uses an illegal version of Window$ !

[Full-disclosure] Re: Re: Fun with Foundstone

[EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 what LOL ? what is surprising ? Not 'lol surprising', just 'lol amusing'. I'm a happy guy, I laugh a lot, and don't need much of a reason to! And two hours is a fairly fast reaction time to notice a post on one of

[Full-disclosure] Re: Re: Fun with Foundstone

Debasis Mohanty wrote: Does this mean, Dave's age is inbetween 3 - 4 yrs ?? =) - D :-) That's so much more flattering than when people mistake me for the grey-haired man in his 60's who used to work for AT+T! Say, Deb, next time people ask me if I wrote the Korn Shell, can I quote

Re: [Full-disclosure] iDefense Labs Quarterly Hacking Challenge

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 nop totally wrong, I got 50k yesterday reporting my sister .. ;D Stan Bubrouski wrote: On 2/15/06, Jerome Athias [EMAIL PROTECTED] wrote: $50,000 for reporting BSA that your neighbor uses an illegal version of Window$ ! That is entirely

Re: [Full-disclosure] iDefense Labs Quarterly Hacking Challenge

Class, I just made 50k reporting you ;) /str0ke On 2/15/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 nop totally wrong, I got 50k yesterday reporting my sister .. ;D Stan Bubrouski wrote: On 2/15/06, Jerome Athias [EMAIL PROTECTED] wrote:

Re: [Full-disclosure] iDefense Labs Quarterly Hacking Challenge

haha wish you had I could sue you ;-) -sb On 2/15/06, str0ke [EMAIL PROTECTED] wrote: Class, I just made 50k reporting you ;) /str0ke On 2/15/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 nop totally wrong, I got 50k yesterday

[Full-disclosure] Re: What can a Remote Vulnerability Scanner do in Future?

Nessus can do local checks on windows/unix from remote. nessus.org. Dont let the good looking web site scare you either. It is still free afaik. :) --Aaron On Mon, 13 Feb 2006 10:16:22 +1100 (EST) Tim Nelson [EMAIL PROTECTED] wrote: On Mon, 6 Feb 2006, Alice Bryson wrote: ... Eeye

[Full-disclosure] iUser Ecommerce - Remote Command Execution Vulnerability

===XOR Crew :: Security Advisory 1/10/2006=== iUser Ecommerce - Remote Command

[Full-disclosure] Web Calendar Pro - Denial of Service SQL Injection Vulnerability

===XOR Crew :: Security Advisory 1/12/2006=== Web Calendar Pro - Denial of Service

[Full-disclosure] HostAdmin - Remote Command Execution Vulnerability

===XOR Crew :: Security Advisory 2/11/2006=== HostAdmin - Remote Command Execution

[Full-disclosure] Wimpy MP3 Player - Text file overwrite vulnerability

===XOR Crew :: Security Advisory 2/10/2006=== Wimpy MP3 Player - Text file

Re: [Full-disclosure] Internet Explorer dragdrop 0day

Hi Thierry, I think I understand now. You did it for the `shock` effect. I guess it is nothing more than a matter of opinion. ( I mean this to be nothing more than... a free bit of market research I suppose. ) My opinion being that; most users would find it an invasive and deceptive tactic. e.g.

RE: [Full-disclosure] Re: Re: Fun with Foundstone

Sure !! With the credits intact ;o) - Deb -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Korn Sent: Thursday, February 16, 2006 12:46 AM To: full-disclosure@lists.grok.org.uk Subject: [Full-disclosure] Re: Re: Fun with Foundstone Debasis Mohanty

[Full-disclosure] Kyocera Network Printers

Hi, Please see the link below for an example of compromising Kyocera Network Printers. http://evader.wordpress.com/2006/02/16/kyocera-printers/ Hope someone finds this useful. ___ Full-Disclosure - We believe in it. Charter:

[Full-disclosure] What is the state of vulnerability research?

This is a series of open questions to people who consider themselves to be vulnerability researchers. Hopefully this will open a number of fruitful public discussions. 1) What is the state of vulnerability research? 2) What have researchers accomplished so far? 3) What are the greatest

[Full-disclosure] [SECURITY] [DSA 977-1] New heimdal packages fix several vulnerabilities

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 977-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze February 16th, 2006