Re: [Full-disclosure] Recall: Oracle read-only user can insert/update/delete data

2006-04-12 Thread Bill Weiss
Van Winssen, Andre A SITI-ITIBHW5([EMAIL PROTECTED])@Wed, Apr 12, 2006 at 07:56:08AM +0200: The sender would like to recall the message, Oracle read-only user can insert/update/delete data. Hey, everybody! It's that guy who uses Exchange and doesn't know that it doesn't work with the outside

Re: [Full-disclosure] RE: Oracle read-only user can insert/update/delete data

2006-04-12 Thread KF (lists)
And I have to say once again: your vendor is very careless and irresponsible for publishing so much crappy code. This is what is really endangering many customer production databases. That and the mentality that they can only offer this kind gentleman *small amount of fame* for his time had

[Full-disclosure] [SECURITY] [DSA 1032-1] New zope-cmfplone packages fix unprivileged data manipulation

2006-04-12 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1032-1[EMAIL PROTECTED] http://www.debian.org/security/ Moritz Muehlenhoff April 12th, 2006

[Full-disclosure] [SRC-Telindus advisory] - HP System Management Homepage Remote Unauthorized Access

2006-04-12 Thread SRC Telindus
HP System Management Homepage Remote Unauthorized Access [Vulnerability]: Remote Authentication Bypass [Product]: CompaqHTTPServer/9.9 HP System Management Homepage 2.1.3.132 and above [Platform]: Microsoft® Windows® - Linux operating

[Full-disclosure] ebay javascript injection

2006-04-12 Thread toppsoft
Most of the phishing emails I get for eBay are pretty obvious. Besides the typos and poor english, they usually link directly to arcane websites. Today I got one that took me to a listing on eBay which contained a login intercept. The script presents a reasonable looking signin form,

[Full-disclosure] ebay javascript injection

2006-04-12 Thread toppsoft
Most of the phishing emails I get for eBay are pretty obvious. Besides the typos and poor english, they usually link directly to arcane websites. Today I got one that took me to a listing on eBay which contained a login intercept. The script presents a reasonable looking signin form,

Re: [Full-disclosure] Shell accounts

2006-04-12 Thread poo
use an unencrypted wireless network or crack one with wep using the auditor cd and laugh all the way to the bank On 4/12/06, Joachim Schipper [EMAIL PROTECTED] wrote: On Tue, Apr 11, 2006 at 11:48:41PM +0100, Ian stuart Turnbull wrote: Ha Ha. Yes, not a proper fiend hey. But I take it that I would

Re: [Full-disclosure] Shell accounts

2006-04-12 Thread Dean Pierce
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Don't forget to spoof your mac first, and make sure there are no surveillance cameras in the area, or people that would recognize you :-p It's always good to bounce around a bit (torwise etc) first as well. There is no true anonymity these days.

[Full-disclosure] RE: info on ip spoofing please

2006-04-12 Thread Neil Davis
Hello all, At http://www.iss.net/security_center/advice/Underground/Hacking/Methods/Technical/Spoofing/default.htm was this comment :- QUOTE Examples of spoofing: man-in-the-middle packet sniffs on link between the two end points, and can therefore pretend to be one end of the

[Full-disclosure] Re: Shell accounts

2006-04-12 Thread Bruno Wolff III
On Wed, Apr 12, 2006 at 16:18:43 +0200, poo [EMAIL PROTECTED] wrote: use an unencrypted wireless network or crack one with wep using the auditor cd and laugh all the way to the bank You could probably get away with that for a little while (assuming you weren't recorded on any surveilance

RE: [Full-disclosure] RE: info on ip spoofing please

2006-04-12 Thread Ian stuart Turnbull
packet sniffs on link between the two end points, and can therefore pretend Ah! Thanks for making that a bit more obvious Neil - much appreciated. Think I might have to go back to school as this happens to me on occasion - misreading I mean. It is abundantly clear to me now. Good

[Full-disclosure] [SECURITY] [DSA 1033-1] New horde3 packages fix several vulnerabilities

2006-04-12 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1033-1[EMAIL PROTECTED] http://www.debian.org/security/ Moritz Muehlenhoff April 12th, 2006

[Full-disclosure] rainbowtables.schmoo.com dead?

2006-04-12 Thread Ron
Hello, I found myself in a situation today where I needed to crack a Windows password. I decided that, since I have enough room to store them now, I'd grab a table from http://rainbowtables.schmoo.com. When I went there, I discovered, my horror, that I was redirected to a search engine

Re: [Full-disclosure] rainbowtables.schmoo.com dead?

2006-04-12 Thread Gridmark
Actually, its http://rainbowtables.shmoo.com, but it's currently down for maintenance.As per Shmoo.com:Some of our previous website content may be unavailable while we are performing updates.-GridmarkOn 4/12/06, Ron [EMAIL PROTECTED] wrote: Hello,I found myself in a situation today where I needed

Re: [Full-disclosure] rainbowtables.schmoo.com dead?

2006-04-12 Thread [EMAIL PROTECTED]
I doubt you will find a website offering this for free for download because they will be bandwith killed... and if do you need rainbowtables , start requesting firstly for wich algorithm... Ron wrote: Hello, I found myself in a situation today where I needed to crack a Windows password. I

Re: [Full-disclosure] Shell accounts

2006-04-12 Thread Ron DuFresne
On Tue, 11 Apr 2006 [EMAIL PROTECTED] wrote: On Tue, 11 Apr 2006 23:48:41 BST, Ian stuart Turnbull said: Ha Ha. Yes, not a proper fiend hey. But I take it that I would be anonymous technically. Nope. Hint - if you send a packet *out* from the shell account, it's probably as a result of

RE: [Full-disclosure] Recall: Oracle read-only user caninsert/update/delete data

2006-04-12 Thread Krpata, Tyler
Ha ha! /nelson -Original Message- From: Bill Weiss [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 12, 2006 2:11 AM To: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] Recall: Oracle read-only user caninsert/update/delete data Van Winssen, Andre A SITI-ITIBHW5([EMAIL

Re: [Full-disclosure] rainbowtables.schmoo.com dead?

2006-04-12 Thread B Potter
"shmoo" has no "c".  that was the first problem :)Also, we are right now in the process of migrating the tables to a new server.  Another 48 hours and you should be good to go.  Note that the tables are available via torrent so it doesn't kill the bandwidth nearly as bad as you would

Re: [Full-disclosure] Re: Shell accounts

2006-04-12 Thread Micheal Turner
You have no privacy anymore, get over it. Send instant messages to your online friends http://uk.messenger.yahoo.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by

RE: [Full-disclosure] RE: info on ip spoofing please

2006-04-12 Thread Ian stuart Turnbull
very informative - thanks, time for another google or two methinks From: Arley Barros Leal [EMAIL PROTECTED] To: Neil Davis [EMAIL PROTECTED],full-disclosure@lists.grok.org.uk Subject: RE: [Full-disclosure] RE: info on ip spoofing please Date: Wed, 12 Apr 2006 18:34:18 +0100 MIME-Version: 1.0

Re: [Full-disclosure] Shell accounts

2006-04-12 Thread poo
where i live the wireless networks roam wild, there's no public surveillance and the FBI have zero jurisdiction On 4/12/06, Ron DuFresne [EMAIL PROTECTED] wrote: On Tue, 11 Apr 2006 [EMAIL PROTECTED] wrote: On Tue, 11 Apr 2006 23:48:41 BST, Ian stuart Turnbull said: Ha Ha. Yes, not a proper

Re: [Full-disclosure] rainbowtables.schmoo.com dead?

2006-04-12 Thread Ron
Aha, the C killed me. That's exactly why I should never trust my memory! :) Thanks for putting my mind at ease! Ron B Potter wrote: shmoo has no c. that was the first problem :) Also, we are right now in the process of migrating the tables to a new server. Another 48 hours and you

Re: [Full-disclosure] Recall: Oracle read-only user can insert/update/delete data

2006-04-12 Thread Mike Owen
On 4/11/06, Bill Weiss [EMAIL PROTECTED] wrote: Van Winssen, Andre A SITI-ITIBHW5([EMAIL PROTECTED])@Wed, Apr 12, 2006 at 07:56:08AM +0200: The sender would like to recall the message, Oracle read-only user can insert/update/delete data. Hey, everybody! It's that guy who uses Exchange