-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
___
Mandriva Linux Security Advisory MDKSA-2006:081-1
http://www.mandriva.com/security/
According to WebCalendar lead developer, this will be corrected in
upcoming developer release v1.1.
david
WebCalendar is a PHP-based calendar application that can be configured
as a single-user calendar, a multi-user calendar for groups of users,
or as an event calendar viewable by visitors.
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
__ NOD32 1.1522 (20060505) Information __
This message was checked by NOD32 antivirus system.
http
Perhaps it wasn't clear in the original post. Sending:
Host: %01%02%03%04
Results in the ASCII *values* 0x01, 0x02, 0x03, 0x04 being placed in the logs.
--
beSIRT - Beyond Security's Incident Response Team
[EMAIL PROTECTED]
www.BeyondSecurity.com
On Thursday 04 May 2006 22:16, Christian
Yes i have to agree here you make a good point. Why the hell got idefense so
rich for example
By sharing knowledge ?
- Original Message -
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Cc: full-disclosure@lists.grok.org.uk
Sent: Friday, May 05, 2006 2:02 AM
Subject: Re:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Title: CAID 34013 - CA Common Services CAIRIM on z/OS LMP SVC
vulnerability
CA Vulnerability ID: 34013
CA Advisory Date: 2006-05-02
Discovered By: IBM Global Services
Impact: Local attacker can gain escalated privileges.
Summary:
A
On 5/5/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote:
What do you do for work? Are you paid to work with computers?
Ok, let's go for a bit of rant then, that's only my second on this list ...
Yes I am paid to work with computers.
Do not judge others and how they choose to make a living. I
Today, a friend of mine told me php cross site vulnerablity maybe exist, That made me shocked .Because i has never heart of it.
is there somebody well knowing of that?
your ,
azrael
___
Full-Disclosure - We believe in it.
Charter:
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Azrael: Didn't you get rm'd? HAW HAW HAWOn 5/4/06, GroundZero Security [EMAIL PROTECTED] wrote:
erm what do you mean with new documents
?
The old ones that cover shellcode, won't be any
different to a new document.
Its the same technics thereunless you want
polymorphic shellcode.
Just
I have a sure fire way to make your computer, ANY COMPUTER, YES ANY
COMPUTER!!! 100% safe from hackers, spyware, viruses, and anything else
malicious that you can think of. yes it's true, I am not lieing here.
I work in an office by day, making barely enough to afford real tomato
Sharing with this list in the interest of Full Disclosure. My response
to Thor was rejected from bugtraq, supposedly because the thread was
killed... but we all know the real reason. Since Thor was (is?) a
temporary security focus moderator it's OK for him to flame and berate
other posters
On Fri, 05 May 2006 10:02:27 EDT, Exibar said:
ROFL, I mean no disrespect man, just couldn't resist. yah, I'm sure
if you think about it a bit you'll realize what my procedure is.
Were you about to suggest that you just Turn The Damned Thing Off?
If so, note that this doesn't
hello world!,
the idle scan was just rediscovered in my lab while
i was trying to replicate a dos attack on a windowsxp ,linux(debian
sarge) and win2k workstations. I had thought that IDLE scan was a
closed chaper after the ipid0 and randomisations were applied( i think
Marco
Hi
list,
Actually, I am trying to measure security (and then security assurance)
level of a complex telecommunication network. I am looking for a
method/approach/product using sets of predefined, standard entities
(station, server, firewall, router, ...) and relations (forming
"patterns"
On Fri, May 05, 2006 at 05:30:50PM +0200, Nguyen Pham wrote:
Actually, I am trying to measure security (and then security assurance)
level of a complex telecommunication network. I am looking for a
method/approach/product using sets of predefined, standard entities
(station, server,
I do not support nor do I wish to participate in anything iDefense
does. They are the original parasites of your industry.
On Fri, 05 May 2006 02:14:49 -0700 Thor Larholm
[EMAIL PROTECTED] wrote:
Sell it to iDefense through their VCP program. A reproduceable
code
execution vulnerability
Good guess.
But no.
On Fri, 05 May 2006 02:42:25 -0700 Romain Le Guen [EMAIL PROTECTED]
wrote:
Is it a problem with digest.dll and Authentification ?
- Original Message -
From: [EMAIL PROTECTED]
To: full-disclosure@lists.grok.org.uk
Sent: Friday, May 05, 2006 1:46 AM
Subject:
I heart vulnerabilities.
On Fri, 05 May 2006 04:32:50 -0700 azrael goblin
[EMAIL PROTECTED] wrote:
Today, a friend of mine told me php cross site vulnerablity maybe
exist,
That made me shocked .Because i has never heart of it.
is there somebody well knowing of that?
your ,
azrael
On Fri, 05 May 2006 09:01:02 PDT, [EMAIL PROTECTED] said:
I do not support nor do I wish to participate in anything iDefense
does. They are the original parasites of your industry.
Actually, they're hardly the *original* parasites. Others had
that territory scoped out before they muscled in.
please see my page for the technical details and screenshots of my
replication of the IDLE scan attack:
http://joeljose.pbwiki.com/idlescan
Sorry, I'm having difficulty following some of the details of your
results. Are you using the Windows machines as the idle hosts only, or
is the Ubuntu
Le vendredi 05 mai 2006 à 12:33 -0400, Tim a écrit :
Sorry, I'm having difficulty following some of the details of your
results. Are you using the Windows machines as the idle hosts only, or
is the Ubuntu box also being used as an idle host in some
configurations?
As standard 2.4/2.6 kernels
On 5/5/06, Valdis Kletnieks wrote:
On Fri, 05 May 2006 10:02:27 EDT, Exibar said:
ROFL, I mean no disrespect man, just couldn't resist. yah, I'm sure
if you think about it a bit you'll realize what my procedure is.
Were you about to suggest that you just Turn The Damned Thing Off?
Le vendredi 05 mai 2006 à 18:49 +0200, Cedric Blancher a écrit :
As standard 2.4/2.6 kernels behaviour is to set DF flag to 1, and IPID
to 0, it's a very bad candidate for an idle host.
Mitigating this...
1. there's Marco Ivaldi finding posted on Bugtraq
2. There seem to be something with ACK
On 5/5/06, Nguyen Pham [EMAIL PROTECTED] wrote:
Hi list,
Actually, I am trying to measure security (and then security assurance)
level of a complex telecommunication network. I am looking for a
method/approach/product using sets of predefined, standard entities
(station, server, firewall,
Umm.. No thanks. But how much to do my yard?
Do you need the Sq ft?
Duck
On 5/4/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote:
Yes, this is a beta product but I have reason to believe that thisissue will not be discovered of fixed by M$ before it goes to gold.
Why do I believe this?Because the
Heh, couple minor corrections to the original post:
Now, let me clear few things up, ok:
- Im not talking about bruteforcing NL/NTLM/NTLMv2/NT hashes.
Im ofcourse talking about LM/NTLM/NTLMv2/NT hashes.
- HOWEVER, if you can actually GET the users password (he is currently
using) the way
This again proves the reason to do some hacking of your own system,
things like these would otherwise go unnoticed...
OK, I setup Windows XP Home, did the regular securing up (the much you
can do with Home edition), like for example setting that users must use
passwords and usernames to sign
Source: http://securityreason.com/achievement_securityalert/38
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
[phpBB 2.0.20 Full Path Disclosure and SQL Errors]
Author: Maksymilian Arciemowicz (cXIb8O3)
Date:
- -Written: 1.5.2006
- -Public: 5.5.2006
from SecurityReason.Com
CVE:
- -
On Fri, 5 May 2006 [EMAIL PROTECTED] wrote:
On Fri, 05 May 2006 09:01:02 PDT, [EMAIL PROTECTED] said:
I do not support nor do I wish to participate in anything iDefense
does. They are the original parasites of your industry.
Actually, they're hardly the *original* parasites. Others had
Got to love the cock smoking kiddies on this list. So when you say
you do penetration testing does that mean you scan networks with
Nessess and insert your company logo into a report.
Or when you say penetration testing do you mean being fucked in the
ass by a large nigger named bubba
On
2. There seem to be something with ACK packets to exploit for
idle-scanning:
hping3 -A -r host -p 80
Gives back exploitable incremental IPID on a Linux 2.6.15 box.
Are you sure? Just because the sequences are predictable or even
incremental for your source host doesn't mean it
Wow, only the third faggot to make that joke. How original
On Fri, 05 May 2006 13:22:09 -0700 Tim Bilbro
[EMAIL PROTECTED] wrote:
I'll take two large pizza's with pepperoni and green peppers. And,
yeah,
I'll take a couple of those IE vulnerabilities on the side. Oh,
and
could you finish
Markus, if a villain has physical access to your computer you have bigger issues than this.Regards,G.R
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia -
It is very apparent to me that no one wants to buy, your 'exploit'. I don't think calling the industry 'pathetic' or the people associated with it 'stupid' is going to win you any supporters.I would suggest you either fully disclose what you found, or just save what little dignity you have left
Ahhh there we go. Yes, so because a bunch of idiots who couldn't
exploit themselves out of a paper bag are pissed off because I
won't share my exploit you assume that no one wants to buy it.
So far the bidding is up to a substantial number. The three
parties bidding on the exploit have been
I feel as an innocent bystander you have crossed the line and now you are being
rude. If someone is seriously interested in your 0'day exploit they will come.
Please, don't make this list worse than it already is.
Your not really posting valuable information to begin with.
Dave
On Friday, May
Le vendredi 05 mai 2006 à 16:11 -0400, Tim a écrit :
Gives back exploitable incremental IPID on a Linux 2.6.15 box.
Are you sure? Just because the sequences are predictable or even
incremental for your source host doesn't mean it is exploitable. This
is old information, but I would assume
Le vendredi 05 mai 2006 à 16:11 -0400, Tim a écrit :
Gives back exploitable incremental IPID on a Linux 2.6.15 box.
Are you sure? Just because the sequences are predictable or even
incremental for your source host doesn't mean it is exploitable. This
is old information, but I would assume
I'll give you 10.99+tip for it if you also throw in a large sausage
pizza.
On Thu, 4 May 2006, [EMAIL PROTECTED] wrote:
I just found a second bug that allows one to remotely retrieve the
contents of other tabs inside of IE7.
Again, for sale. Highest bidder.
Exploit example is to trick
Your assumption that the idlescan is dead where wrong.. no investigation
needed
I never said idle scans were dead. I merely dispute the half-baked
claims that current Linux systems can be used as an idle host, or that
they are somehow rediscovered.
tim
I'm aware of this fact. As I figure all my tests were done from the same
box, I'll still have to check it out. Let me test it more intensively
after this week-end and I'll let you know.
Ah, sorry, didn't mean to state the obvious.
On a side-note, I don't know if anyone has ever observed (and
Congradulations.
You have won an award for being the sixth clueless wanna-be
whitehat faggot to crack that joke.
Based on all of the feedback on this cess-pool called a mailing
list. I am now offering my vulnerabilities for sale only to those
that a.) will not report it to the vendor and b.)
Wowzers folks! I seem to be getting messages that are a cross from the
"full disclosure " group and the "Rhizome Multidispliciplinary Art
Group." If this was iontentional I am quite happy to cheer it on. If
it's a bug that's causing it I will have to track it down and see
wassup in all of
Isn't it the middle of the day. How can you send emails while mowing
lawns?
smirk
J/k. If you are so set on being right and you really do have the exploit
please stop trying to defend the fact that you actually have the exploit.
Truth stands on its own. Sometimes...most of the time does it
Johd Doe sayed:
Markus, if a villain has physical access to
your computer you have bigger issues than this.
You obiously didnt bother to read these part of my message:
- You can, for example, decrypt all EFS encrypted files
- You can, for example, try that same password in all kinds
of places
Based on all of the feedback on this cess-pool called a mailing
list.
Did you expect that subscribers to the FULL DISCLOSURE mailing list
would support your plan to make money off of withholding disclosure?
I am now offering my vulnerabilities for sale only to those
that
Wait...what about
Hey 0x80,
You are not reaching your target market. This mailing list is the
wrong place.
I happen to know for a fact that you have not posted your auction in
the places that count such as the active carding forums.
However, you are lying and you do not really have the 0day. Otherwise
you
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200605-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - -
Symantec 10 corp. immediately detetcts this as Loveletter.CI through real time protection when accessing the file within the arhive.
/N
On 5/4/06, Joxean Koret [EMAIL PROTECTED] wrote:
Sorry, the email was sended without the attachment.---Regards,Joxean Koret Attached goes a working I Love You
50 matches
Mail list logo
