On Mon, 19 Feb 2007, Peter Dawson wrote:
> just asking... Is this std practice by vendor to state ??? "[..] we
> ask you respect responsible disclosure guidelines and not report this
> publicly"
It's a common and pretty shameless practice for Microsoft. They also
openly criticize such res
Timo Schoeler napisał(a):
> a friend of mine contacted me because he saw lots of emails (60) to
> [EMAIL PROTECTED] starting at about 5:00 am (US east coast
> time).
Indeed, I've started receiving it yesterday at 10:00 am (CET) and it stopped at
08:00 pm. To: header contained [EMAIL PROTECTED] and
Dear Rajesh Sethumadhavan,
As Michal Zalewski pointed, there is no "critical" security impact,
because you (as attacker) can force browser to open files (it's common
thing, you can do it in any browser), but you can not access content of
these files. The only security impact in few cases i
Suggested severity level: Medium.
Type of Risk: Denial of Service, Privilege Elevation, Un-authorize Access.
Affected Software: VMware Workstation, version 5.5.3 build 34685 (including
installation of "VMware Tools" of the same version, in the guest OS).
(Older versions and other products by
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Thanks.
This is what I am struggling with
1. On my firefox I have the router password saved:
http://192.168.0.1";> from remote site brings up
password manager all nicely filled in, I still have to hit ok
http://foo:[EMAIL PROTECTED]"> remote site
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Thanks.
I'm sure there are many ways to achieve each step separately (see
my reply to Andrew), to build this each and everything into
functional "drive by" attack seems far fetched. Your details below
add even more hurdles IMO. You'll be build a monst
This is a periodic public report from the ISOTF's affiliated group 'DA'
(Drone Armies (botnets) research and mitigation mailing list / TISF
DA) with the ISOTF affiliated ASreport project (TISF / RatOut).
For this report it should be noted that we base our analysis on the data
we have accumulated
hi Rajesh,
Maybe it is too early in the morning in UK and that's why I may act
like a stupid, but how come this is a vulnerability? For sure you can
open files from the file system by using various HTML elements but can
you really read their content, I don't think so.
Firefox has done a good job
http://www.gnucitizen.org/blog/firefox-offline
This post is probably totally useless and most likely waste of your
time and my time but it brings some points that you may find
intriguing.
--
pdp (architect) | petko d. petkov
http://www.gnucitizen.org
[EMAIL PROTECTED] wrote:
> I am curious as to how one "automatically" logs on?
>
> 1. Internet Explorer disallows username:[EMAIL PROTECTED]://192.168.1.0
> 2. Opera has a very clear warning that you are logging on
> 3. Firefox has a very clear warning that you are logging on
>
> Are there any ot
Hi all,
I'd like to announce the availability of a new kernel rootkit detection toolkit
for Linux called Rootkit Profiler LX (RKProfiler LX).
RKProfiler LX is divided into two parts: a data collection component called
"Rootkit Profiler Module" (RKPmod) and a data interpretation component calle
On Tue, 20 Feb 2007 11:11:56 + pdp (architect) wrote:
> http://www.gnucitizen.org/blog/firefox-offline
| If GMAIL is affected by some kind of Cross-site scripting vulnerability,
| can the attacker permanently plug malicious code inside the application
| offline source base.
Where is the spec
Hello full-disclosure,
> So is there anyone who can help me or who already implemented
> a more chroot-like jail with microsoft windows?
I've found such interesting tool named WinJail: www.winquota.com/wj/
Did anybody seen it?
--
Best regards,
Victor
___
On Feb 12th 2007, Gadi Evron wrote:
> Most web servers are being compromised by these attacks as a result of an
> insecure web application written in PHP, although attacks for other
> scripting languages such as Perl and ASP are also in-the-wild.
>
> The main reason for this is that many different
Hello, it is my new advisory:
Problem:Blind sql injection attack in INSERT syntax
Product:PHP-nuke <=8.0
Web page:http://phpnuke.org/
Credit:Maciej `krasza` Kukla
@mail:[EMAIL PROTECTED]
homepage:www.krasza.int.pl
1.Description
(...)PHP-Nuke 8.0 Final version. This version includes a new anti-
You can duplicate this behavior by using multiple accounts and using runas
(which is essentially, from what I gather, what winquota does.)
You can granularly adjust your user's permissions, not only the file
permissions but also some of the 'windows api permissions' (I don't know
their correct nam
Hello,
TB> You can duplicate this behavior by using multiple accounts
TB> and using runas (which is essentially, from what I gather, what
TB> winquota does.)
Hmm, it is not the same as I see. WinJail also provides way to re-map such folders like c:\* -> c:\NewPlace\* at file system level for
There is something called "sandboxie" that seems to do this same kind of thing.
Programs run inside the sandbox
can read whatever you allow, but writes get done to other directories so that
it is more difficult for a rogue app to corrupt
anything outside the area it is allowed to write to.
---
TSRT-07-02: Trend Micro ServerProtect eng50.dll Stack Overflow
Vulnerabilities
http://www.tippingpoint.com/security/advisories/TSRT-07-02.html
February 20, 2007
-- CVE ID:
CVE-2007-1070
-- Affected Vendor:
Trend Micro
-- Affected Products:
ServerProtect for Windows 5.58
ServerProtect
TSRT-07-01: Trend Micro ServerProtect StCommon.dll Stack Overflow
Vulnerabilities
http://www.tippingpoint.com/security/advisories/TSRT-07-01.html
February 20, 2007
-- CVE ID:
CVE-2007-1070
-- Affected Vendor:
Trend Micro
-- Affected Products:
ServerProtect for Windows 5.58
ServerProt
===
Ubuntu Security Notice USN-423-1 February 20, 2007
moin, moin1.3 vulnerabilities
CVE-2007-0901, CVE-2007-0902
===
A security issue affects the following Ubuntu releases:
U
Mea culpa. A stupid little bug crept into linux-ftpd for Debian, and
some other Linux distros. Some may have fixed it, but Debian hasn't.
The effect is that ftpd now runs /bin/ls (for DIR and similar commands)
with GID=0. Does not seem terribly dangerous as I do not seem able to
trick ls into runni
22 matches
Mail list logo
