Re: [Full-disclosure] RE: OT - Check this out - Full disclosure is apt for this

2006-09-12 Thread c0ntex
Good sir, if what you say be true, show me your proof. Also, using your medical training, explain the injuries to the bodies in Falluja. Thanks :-) On 12/09/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Contex - If you consider that America

RE: [Full-disclosure] Re: OT - Check this out - Full disclosure is aptfor this

2006-09-12 Thread Goencz, Otto
You're wrong; even citizens with clues have to pay for their administration's mistakes... -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Denis Jedig Sent: Tuesday, September 12, 2006 4:59 AM To: full-disclosure@lists.grok.org.uk Subject:

Re: [Full-disclosure] OT - Check this out - Full disclosure is apt for this

2006-09-12 Thread b . hines
I don't think I shall forget, as I watched my coworkers jump to theirgod from the 110 floor. Anders B Jansson wrote: And on this day when we remember the 3000 unarmed civilians who died inthe US I just hope that we don't forget the 3 unarmed civilians whodied in Afghanistan shortly after.

Re: [Full-disclosure] RE: OT - Check this out - Full disclosure is apt for this

2006-09-12 Thread bkfsec
[EMAIL PROTECTED] wrote: If you consider that America are able to lie about the weapons of mass destruction and then admit it, America never lied about WMD. America is not in a position to prove that any WMD

[Full-disclosure] Session Token Remains Valid After Logout in IBM Lotus Domino Web Access

2006-09-12 Thread Ferguson, David
I. SYNOPSIS Title: Session Token Remains Valid After Logout in IBM Lotus Domino Web Access 7.0.1 Release Date: 09/12/2006 Affected Application: IBM Lotus Domino Web Access 7.0.1 (versions prior to 7.0.1 were not tested but may still be vulnerable). Nominal Severity: Low Severity If Successfully

[Full-disclosure] Re: RSA SecurID SID800 Token vulnerable

2006-09-12 Thread Jeb Osama
In security it's always about raising that bar a bit more. You should be in the movies :)BojanThat's jan, Bo Jan ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia -

Re: [Full-disclosure] RE: OT - Check this out - Full disclosure is apt for this

2006-09-12 Thread c0ntex
On 12/09/06, bkfsec [EMAIL PROTECTED] wrote: I think you two are using different definitions for Chemical Weapons, perhaps. I think so, though chemical weapons have been used. There are hundereds / thousands of bodies that have been melted almost to the bone, while their clothes are in

Re: [Full-disclosure] RE: OT - Check this out - Full disclosure is apt for this

2006-09-12 Thread Paul Schmehl
--On Tuesday, September 12, 2006 09:12:14 +0100 c0ntex [EMAIL PROTECTED] wrote: Good sir, if what you say be true, show me your proof. Also, using your medical training, explain the injuries to the bodies in Falluja. This is stupid. There's tons of documentation in the public domain that

[Full-disclosure] ERRATA: [ GLSA 200609-05 ] OpenSSL, AMD64 x86 emulation base libraries: RSA signature forgery

2006-09-12 Thread Sune Kloppenborg Jeppesen
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory [ERRATA UPDATE]GLSA 200609-05:02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] [ GLSA 200609-06 ] AdPlug: Multiple vulnerabilities

2006-09-12 Thread Raphael Marichez
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200609-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] Apple QuickTime Player H.264 Codec Remote Integer Overflow

2006-09-12 Thread Piotr Bania
Apple QuickTime Player H.264 Codec Remote Integer Overflow by Piotr Bania [EMAIL PROTECTED] http://www.piotrbania.com All rights reserved. Severity: Critical - potencial remote code execution. CVE:CVE-2006-4386

Re: [Full-disclosure] Session Token Remains Valid After Logout in IBM Lotus Domino Web Access

2006-09-12 Thread Trey Keifer
How is this a vulnerability? this is a common design trade-off of SSO tokens. In order to support the user opening and closing multiple applications and not requiring them to login again to individual applications (which is the point of SSO) they must invalidate the token in specific instances

[Full-disclosure] Apple QuickTime H.264 Integer Overflow Vulnerability

2006-09-12 Thread Sowhat
Apple QuickTime H.264 Integer Overflow Vulnerability By Sowhat of Nevis Labs Date: 2006.09.12 http://www.nevisnetworks.com http://secway.org/advisory/AD20060912.txt CVE:CVE-2006-4381 Vendor: Apple Inc. Affected Versions: Apple QuickTime versions 7.1.3 Overview: By carefully crafting

[Full-disclosure] iDefense Security Advisory 09.12.06: Multiple Vendor X Server CID-keyed Fonts 'scan_cidfont()' Integer Overflow Vulnerability

2006-09-12 Thread iDefense Labs
Multiple Vendor X Server CID-keyed Fonts 'scan_cidfont()' Integer Overflow Vulnerability iDefense Security Advisory 09.12.06 http://www.idefense.com/intelligence/vulnerabilities/ Sep 12, 2006 I. BACKGROUND The X Window System is a graphical windowing system based on a client/server model. More

[Full-disclosure] iDefense Security Advisory 09.12.06: Multiple Vendor X Server CID-keyed Fonts 'CIDAFM()' Integer Overflow

2006-09-12 Thread iDefense Labs
Multiple Vendor X Server CID-keyed Fonts 'CIDAFM()' Integer Overflow Vulnerability iDefense Security Advisory 09.12.06 http://www.idefense.com/intelligence/vulnerabilities/ Sep 12, 2006 I. BACKGROUND The X Window System is a graphical windowing system based on a client/server model. More

[Full-disclosure] iDefense Security Advisory 09.12.06: Apple QuickTime FLIC File Heap Overflow Vulnerability

2006-09-12 Thread iDefense Labs
Apple QuickTime FLIC File Heap Overflow Vulnerability iDefense Security Advisory 09.12.06 http://www.idefense.com/intelligence/vulnerabilities/ Sep 12, 2006 I. BACKGROUND Quicktime is Apple's media player product used to render video and other media. For more information visit

[Full-disclosure] Computer Terrorism (UK) :: Incident Response Centre - Microsoft Publisher Font Parsing Vulnerability

2006-09-12 Thread CTUK :: Incident Response Centre
Computer Terrorism (UK) :: Incident Response Centre www.computerterrorism.com Security Advisory: CT12-09-2006-2.htm == Microsoft Publisher Font Parsing Vulnerability == Advisory Date: 12th, September

[Full-disclosure] Computer Terrorism (UK) :: Incident Response Centre - Adobe/Macromedia Flash Player Vulnerability

2006-09-12 Thread CTUK :: Incident Response Centre
Computer Terrorism (UK) :: Incident Response Centre www.computerterrorism.com Security Advisory: CT12-09-2006 Adobe/Macromedia Flash Player - Remote Code Execution Advisory Date: 12th, September 2006

RE: [Full-disclosure] Session Token Remains Valid After Logout in IBM Lotus Domino Web Access

2006-09-12 Thread Ferguson, David
Trey, I understand what you mean about a design trade-off. In this case I believe IBM has a conflicting design. They clear the cookie, which makes the user appear to be logged out of all applications. However, they leave the token valid on the server, which doesnt serve any useful

[Full-disclosure] Re: Linux kernel source archive vulnerable

2006-09-12 Thread coderpunk
On 9/11/06, Joe Feise [EMAIL PROTECTED] wrote: coderpunk writes: The standard recommendation is to never compile the kernel as root. Which obviously doesn't help you when a non-root user edits the kernel, you compile it as 'jerry' but still have to install it as 'root'. You're still

Re: [Full-disclosure] Re: Linux kernel source archive vulnerable

2006-09-12 Thread Chris Umphress
On 9/12/06, coderpunk [EMAIL PROTECTED] wrote: The standard recommendation is to never compile the kernel as root. Which obviously doesn't help you when a non-root user edits the kernel, you compile it as 'jerry' but still have to install it as 'root'. You're still hosed. Geez, of

[Full-disclosure] [EEYEB-20080824] Internet Explorer Compressed Content URL Heap Overflow Vulnerability #2

2006-09-12 Thread eEye Advisories
Internet Explorer Compressed Content URL Heap Overflow Vulnerability #2 http://research.eeye.com/html/advisories/published/AD20060912.html Release Date: September 12, 2006 Date Reported: August 24, 2006 Severity: High (Code Execution) Systems Affected: Internet Explorer 5 SP4 with MS06-042 -

[Full-disclosure] [EEYEB-20080824] Internet Explorer Compressed Content URL Heap Overflow Vulnerability #2

2006-09-12 Thread eEye Advisories
Internet Explorer Compressed Content URL Heap Overflow Vulnerability #2 http://research.eeye.com/html/advisories/published/AD20060912.html Release Date: September 12, 2006 Date Reported: August 24, 2006 Severity: High (Code Execution) Systems Affected: Internet Explorer 5

Re: [Full-disclosure] RE: OT - Check this out - Full disclosure is apt for this

2006-09-12 Thread Nick FitzGerald
[EMAIL PROTECTED] wrote: snip tirade But anyone who FIRST decides what they want to believe and THEN tries to find supporting evidence for it is an IDIOT. People who are NOT idiots do it the other way around: Evidence First, Conclusion Second. So you agree with the thinking part of the world

Re: [Full-disclosure] FYI: MS06-049 patch (920958) corrupts NTFS compression files

2006-09-12 Thread KOJIMA Hajime
In [EMAIL PROTECTED], KOJIMA Hajime wrote: | just FYI... | | MS06-049 patch (920958) corrupts NTFS compression files. …… | Official information from Microsoft | --- | | Not yet, but they are working to fix problem. Now, you can read it from: