[Full-disclosure] [SECURITY] [DSA 1106-1] New ppp packages fix privilege escalation

2006-07-10 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1106-1[EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze July 10th, 2006

[Full-disclosure] Postfix configuration

2006-07-10 Thread Bartlomiej Szymanski
Hello, I have a problem with message delivery via Postfix. I build a network, using VMware, consisting of three standalone FreeBSD machines. I named them: FREEBSD1, FREEBSD2 and FREEBSD3. On each of the machine I installed Postfix 2.2 and configured it. Now I have a problem: when I am

[Full-disclosure] Re: rPSA-2006-0122-1 kernel

2006-07-10 Thread Paul Starzetz
Justin M. Forbes wrote: Description: Previous versions of the kernel package are vulnerable to two denial of service attacks. The first allows any local user to fill up file systems by causing core dumps to write to directories to which they do not have write access permissions.

Re: [Full-disclosure] Postfix configuration

2006-07-10 Thread nicolas figaro
Bartlomiej Szymanski a écrit : Hello, Hi I have a problem with message delivery via Postfix. I build a network, using VMware, consisting of three standalone FreeBSD machines. I named them: FREEBSD1, FREEBSD2 and FREEBSD3. do you know postfix has also a very good mailing list ? On each of

Re: [Full-disclosure] MIMESweeper For Web 5.X Cross Site Scripting

2006-07-10 Thread Brian Eaton
On 7/9/06, Erez Metula [EMAIL PROTECTED] wrote: An example attack scenario could be that an attacker will redirect many users (by email, posting in the organization portal, etc.) to some blocked URL and an accompanying script that will steal their authentication cookies. It sounds like the net

[Full-disclosure] [SECURITY] [DSA 1107-1] New GnuPG packages fix denial of service

2006-07-10 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1107-1[EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze July 10th, 2006

[Full-disclosure] RE: MIMESweeper For Web 5.X Cross Site Scripting

2006-07-10 Thread Erez Metula
MIMESweeper For Web 5.X Cross Site Scripting I. INTRODUCTION MIMESweeper For Web is a policy-based content security for web applications. It analyzes web content and blocks pages or files that are prohibited by the organizational security policy. For more Information please refer to:

[Full-disclosure] Re: Mico crashes when contected with wrong IOR / DoS

2006-07-10 Thread Karel Gardas
Hello, I would just like to add some corrections to disclosure below. On Thu, 6 Jul 2006, tuergeist wrote: == == == TOC == == == 1. Affected Vendor 2. Affected Product 3. Vulnerability 4. Safety Hazard 5. Disclosure Timeline 6. Vendor Response 7. Patch / Workaround 8. Vulnerability Details

Re: [Full-disclosure] Postfix configuration

2006-07-10 Thread Line Noise
On 7/10/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: On Mon, 10 Jul 2006 06:21:17 -0500 Bartlomiej Szymanski [EMAIL PROTECTED] wrote: Hello, I have a problem with message delivery via Postfix... [snip] Refrain from off-topic discussions on the list. Please stop this. It isn't helpful.

[Full-disclosure] [USN-312-1] gimp vulnerability

2006-07-10 Thread Martin Pitt
=== Ubuntu Security Notice USN-312-1 July 10, 2006 gimp vulnerability CVE-2006-3404 === A security issue affects the following Ubuntu releases: Ubuntu 5.04 Ubuntu 5.10

[Full-disclosure] Re: Mico crashes when contected with wrong IOR / DoS

2006-07-10 Thread tuergeist
Hi, I would just give my 2ct I would just like to add some corrections to disclosure below. == 1. Affected Vendor == Object Security This information is incorrect. ObjectSecurity is not the vendor of the MICO ORB. MICO is a free software project licensed under LGPL/GPL licenses.

RE: [Full-disclosure] MIMESweeper For Web 5.X Cross Site Scripting

2006-07-10 Thread Erez Metula
Hi Brian, Please consider those attack scenarios: 1. Stealing user cookie. Since it requires that the client should already have such a cookie, it requires that the client visit the banned site first. This situation is minimized to the time window in which the user is logged in and the site got

[Full-disclosure] Juniper Networks DX Web Administration Persistent System Log XSS Vulnerability

2006-07-10 Thread Darren Bounds
Juniper Networks DX Web Administration Persistent System Log XSS Vulnerability July 10, 2006 Product Overview: The Juniper Networks (Redline) DX application acceleration platform delivers a complete data center acceleration solution for web-enabled and IP-based business applications.

[Full-disclosure] Re: Mico crashes when contected with wrong IOR / DoS

2006-07-10 Thread Karel Gardas
Hi Christoph, I'm not angry at all and I hope you are neither. Thank you for taking time and provide us with nice way how to duplicate the issue. Also to give us time to fix it before full disclosure which has not been used due to communication/organization issues. Anyway, points taken, we

[Full-disclosure] Gracenote buffer overflow

2006-07-10 Thread MNV
Hi, I'm writing in regards to: GraceNote CDDBControl ActiveX Control (from CERT and SANS) Buffer overflow in GraceNote CDDBControl ActiveX Control, as used by multiple products that use Gracenote CDDB, allows remote attackers to execute arbitrary code via a long option string.

Re: [Full-disclosure] Re: Google and Yahoo search engine zero-day code

2006-07-10 Thread ninjadaito
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear N3tN00dle, The more you post, the more convinced I become that you are complete moron. The one saving grace is that you provide so many free laughs!! Talk about delusions of grandeur. LOL. Given enough rope, you'll eventually hang yourself.

[Full-disclosure] [SECURITY] [DSA 1108-1] New mutt packages fix arbitrary code execution

2006-07-10 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1108-1[EMAIL PROTECTED] http://www.debian.org/security/ Moritz Muehlenhoff Jul 11th, 2006

[Full-disclosure] New CVE number states Excel Style handling as a separate issue

2006-07-10 Thread Juha-Matti Laurio
New CVE http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3431 published recently confirms the information that Microsoft Excel Style handling vulnerability aka Nanika.xls issue is a separate vulnerability. This vulnerability mentioned affects only to Simplified Chinese, Traditional

Re: [Full-disclosure] Postfix configuration

2006-07-10 Thread Dude VanWinkle
On 7/10/06, Line Noise [EMAIL PROTECTED] wrote: On 7/10/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: On Mon, 10 Jul 2006 06:21:17 -0500 Bartlomiej Szymanski [EMAIL PROTECTED] wrote: Hello, I have a problem with message delivery via Postfix... [snip] Refrain from off-topic discussions

[Full-disclosure] Vhoning

2006-07-10 Thread n3td3v
What (I and) the underground call it: Vhoning The reason: (I and) the underground are calling it vhoning, because it sounds like owning. The breakdown: v = voice over internet protocol honing = phoning > vhoning = hackersby use of (internet phoning with)voice over internet protocol to

Re: [Full-disclosure] Vhoning

2006-07-10 Thread ninjadaito
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Tue, 11 Jul 2006 11:10:57 +1000 n3td3v [EMAIL PROTECTED] wrote: What (I and) the underground call it: Eeek! It's the big, bad *WANNABE* underground n3td1ck..err..n3td00dle. And another thing; what's this 'underground' and who's in it? You should

[Full-disclosure] Newest Phishing Technique:

2006-07-10 Thread Joel R. Helgeson
Joel Helgeson ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Yahoo IM spoofing

2006-07-10 Thread James Lay
Hey all! Just saw this today for the first time...someone actually spoofing IM's in yahoo chat. Is this a new exploit or did I miss something? Thank you. James ___ Full-Disclosure - We believe in it. Charter:

Re: [Full-disclosure] Newest Phishing Technique:

2006-07-10 Thread mikeiscool
On 7/11/06, Joel R. Helgeson [EMAIL PROTECTED] wrote: Joel Helgesoncool; someone followed my advice then. http://archives.neohapsis.com/archives/fulldisclosure/2006-07/0030.html -- mic ___ Full-Disclosure - We believe in it. Charter:

RE: [Full-disclosure] Yahoo IM spoofing

2006-07-10 Thread Patrick Nolan
-Original Message- Hey all! Just saw this today for the first time...someone actually spoofing IM's in yahoo chat. Is this a new exploit or did I miss something? Thank you. James Describe the IM a little further. Receiving garbage in an IM message isn't new, and is commonly

[Full-disclosure] [ MDKA-2006:119 ] - Updated ppp packages fix plugin vulnerability

2006-07-10 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDKA-2006:119 http://www.mandriva.com/security/

[Full-disclosure] [ MDKSA-2006:120 ] - Updated samba packages fix DoS vulnerability

2006-07-10 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDKSA-2006:120 http://www.mandriva.com/security/