[Full-disclosure] [SECURITY] [DSA 1419-1] New OpenOffice.org packages fix arbitrary Java code execution

2007-12-05 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1419-1[EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze December 5th, 2007

Re: [Full-disclosure] 0day XSS for MPAA.org

2007-12-05 Thread Ham Beast
Olá Kristian Hermafroditas you useless fagot, shoes of clown are apparent. Hambeast returned to specifically noted that, for someone who is trying really hard to find a job (and NOT find) you really are much not doing to endear themselves to potential employers. You pick a fight with Microsoft

[Full-disclosure] Nokia N95 cellphone remote DoS using the SIP Stack

2007-12-05 Thread Radu State
Nokia N95 cellphone remote DoS using the SIP Stack Severity: High – Denial of Service Hardware: Nokia N95 Firmware: Tested version: Nokia RM-159 V 12.0.013 Notification: Vulnerability found: 11 September 2007 Contact Nokia Support: 12 September 2007 / None reply Contact Nokia

Re: [Full-disclosure] Nokia N95 cellphone remote DoS using the SIP Stack

2007-12-05 Thread reepex
So almighty Phd what is your thesis exactly? To me it seems to be 'how to run a fuzzer then write crappy perl scripts to exploit DoS conditions' does this properly summarize your phd credentials? I guess you could tack on 'after writing the crappy scripts, flood mailing lists with our crap,

[Full-disclosure] Cisco Security Advisory: Cisco Security Agent for Windows System Driver Remote Buffer Overflow Vulnerability

2007-12-05 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: Cisco Security Agent for Windows System Driver Remote Buffer Overflow Vulnerability Advisory ID: cisco-sa-20071205-csa http://www.cisco.com/warp/public/707/cisco-sa-20071205-csa.shtml Revision 1.0 For Public Release 2007

Re: [Full-disclosure] GOBBLES or n3td3v

2007-12-05 Thread coderman
On Dec 5, 2007 11:31 AM, Ham Beast [EMAIL PROTECTED] wrote: ... Hambeast would like to extend Greetings and Salutations on the return of GOBBLES silly hambeast, it is not GOBBLES until blessed by his majesty, Dr. Neal Krawetz, PhD. L'enfer, c'est les autres - Sartre

Re: [Full-disclosure] Nokia N95 cellphone remote DoS using the SIP Stack

2007-12-05 Thread state
hi Reepex, I do not understand why are frustrated about a computer science degree. Maybe, someone got dropped out of a degree programm and some psychological trauma gets activated when seeing a Ph.D? If you like it or not, in order to get a computer science degree, you will have to take

Re: [Full-disclosure] Anyone have a reason for 2x the email flow today?

2007-12-05 Thread Dude VanWinkle
On Dec 4, 2007 8:27 AM, Maloney, Michael [EMAIL PROTECTED] wrote: I've noticed a 30K increase per day in traffic.. I was finally able to do the numbers: We do 1,000,000 emails a day We did 1.3 million that day.. Something must have happened... -JP

Re: [Full-disclosure] Nokia N95 cellphone remote DoS using the SIP Stack

2007-12-05 Thread reepex
On Dec 5, 2007 11:05 AM, Radu State [EMAIL PROTECTED] wrote: # Humberto J. Abdelnur (Ph.D Student) # # Radu State (Ph.D) # # Olivier Festor (Ph.D) # lol.. wow is all i can say to this.. let me enlighten you on the basics of Perl $text = '';

Re: [Full-disclosure] Nokia N95 cellphone remote DoS using the SIP Stack

2007-12-05 Thread reepex
http://hal.inria.fr/index.php?view_this_doc=inria-00172056extended_view=1version=halsid=5561bd637e62791f1744a158d907343a Could you please send me this document so i can learn from you how to nmap? I would very much appreciate reading this paper so I can learn the basics of a high level pen test.

[Full-disclosure] Information about recent malware exploited vulnerabilities - a blog post

2007-12-05 Thread uday kumar
Hi, I wanted to share a blog post of mine about information regarding recent vulnerabilities in Windows libraries and other application software that have seen to be exploited by malware. Could be of some help to anyone who is looking to find such information. The link to my blog post is:

[Full-disclosure] [ GLSA 200712-01 ] Hugin: Insecure temporary file creation

2007-12-05 Thread Pierre-Yves Rofes
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200712-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[Full-disclosure] [ GLSA 200712-02 ] Cacti: SQL injection

2007-12-05 Thread Pierre-Yves Rofes
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security AdvisoryGLSA 200712-02:02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Re: [Full-disclosure] need help in managing administrators

2007-12-05 Thread Valdis . Kletnieks
On Sun, 02 Dec 2007 20:04:42 EST, Dude VanWinkle said: Anyone who was a security expert 30 yrs ago should be ridiculed. Their job description was I inspect all 5 1/4 disks that get mailed to us and should be a reason NOT to hire them :-P Anybody who doesn't know the history of security well

[Full-disclosure] Report: Foreign Countries Develop U.S. Defense Systems Software

2007-12-05 Thread worried security
America's reliance on security systems developed by foreign nations could pose problems in the future. Adversaries are developing key hardware and software for the United States Department of Defense. The Defense Science Board Task Force (dsbt) issued a September 2007 report warning, The United

Re: [Full-disclosure] Professional IT Security Service Providers - Exposed

2007-12-05 Thread Valdis . Kletnieks
On Tue, 04 Dec 2007 16:02:26 EST, [EMAIL PROTECTED] said: Generally our reviews are done by reading the contents of the companies website. We strip away all the marketing fluff and we look for untruths, poor grammar, quality of service, team talent and capabilities, site clarity, etc. If the

[Full-disclosure] CiscoWorks Server XSS Vulnerability

2007-12-05 Thread Liquidmatrix Security Digest
. The patch may be obtained from: http://www.cisco.com Cisco Advisory http://www.cisco.com/warp/public/707/cisco-sr-20071205-cw.shtml === Liquidmatrix Security Digest http://www.liquidmatrix.org/blog/ 2255B Queen Street East suite 156 Toronto, Ontario Canada M4E 1G3

[Full-disclosure] UPDATE: [ GLSA 200711-29 ] Samba: Execution of arbitrary code

2007-12-05 Thread Pierre-Yves Rofes
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory [UPDATE] GLSA 200711-29:02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Re: [Full-disclosure] need help in managing administrators

2007-12-05 Thread happy nino
to all who replied to my request, i thank you a lot , you advises where really helpful, i thank you very much From: [EMAIL PROTECTED]: [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED]: RE: [Full-disclosure] need help in managing administratorsDate: Sun, 2 Dec 2007 21:19:10 -0600

Re: [Full-disclosure] Professional IT Security Service Providers - Exposed

2007-12-05 Thread SecReview
There is no marketing fluff in what we write. And, there is a significant difference between taking something out of context and stripping away marketing fluff, wouldn't you agree? Marketing Fluff is really just pretty noise. Taking things out of context is political trickery. We do our best

Re: [Full-disclosure] Nokia N95 cellphone remote DoS using the SIP Stack

2007-12-05 Thread nnp
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I think you're missing his point. In fact I might be too but my take on it is this you'd think two PhD's and a PhD student might be able to do something a little more advanced than running a fuzzer and reporting DoS conditions. Do you guys even

Re: [Full-disclosure] need help in managing administrators

2007-12-05 Thread T Biehn
All that time and you still fail it at the internet? Sheesh. :) On Dec 5, 2007 5:44 PM, [EMAIL PROTECTED] wrote: On Sun, 02 Dec 2007 20:04:42 EST, Dude VanWinkle said: Anyone who was a security expert 30 yrs ago should be ridiculed. Their job description was I inspect all 5 1/4 disks

Re: [Full-disclosure] 0day XSS for MPAA.org

2007-12-05 Thread Kristian Erik Hermansen
On Dec 5, 2007 12:15 PM, [EMAIL PROTECTED] wrote: Ol? Kristian Hermafroditas you useless fagot, shoes of clown are apparent. Dude, you criticize everyone with the same hatred and bad english. Check out what you said about security researcher, and woman, Raven Adler just a few months ago. snip

Re: [Full-disclosure] Certificate spoofing issue with Mozilla, Konqueror, Safari 2

2007-12-05 Thread Alexander Klink
Hi, On Sun, Nov 18, 2007 at 10:21:18PM +0100, Nils Toedtmann wrote: DN=CN=www.example.com subjectAltName:dNSName=www.example.com subjectAltName:dNSName=www.paypal.com and lures the user to https://www.example.com/. The user gets an unknown CA warning, but

[Full-disclosure] Defense board sounds louder alarm about foreign software development

2007-12-05 Thread worried security
Software developed in foreign countries and used by the Defense Department and other agencies puts federal information systems at serious risk of being hacked and compromised, according to a recent report issued by Defense's top advisory board. The report, released last month by a Defense Science

Re: [Full-disclosure] Anyone have a reason for 2x the email flow today?

2007-12-05 Thread Dude VanWinkle
On Dec 5, 2007 6:47 PM, Jay Dephallia [EMAIL PROTECTED] wrote: Its not spam email. You can seriously make yourself bigger with this pill. [EMAIL PROTECTED] has all the info. Just email him about it. Also, ask him about the size of his cock. What a surprise you use a gmail account to send

[Full-disclosure] Cisco Phone 7940 remote DOS

2007-12-05 Thread Radu State
Cisco 7940 Denial of Service Vulnerability Hardware: Cisco 7940 SIP Phone Severity: High – Denial of Service Software: Affected version: P0S3-08-7-00 Other Versions: May be Notification: Vulnerability found: 30 August 2007 Contact Cisco: 31 August 2007 Tracked issue: 11

Re: [Full-disclosure] need help in managing administrators

2007-12-05 Thread Dude VanWinkle
On Dec 5, 2007 5:44 PM, [EMAIL PROTECTED] wrote: On Sun, 02 Dec 2007 20:04:42 EST, Dude VanWinkle said: Anyone who was a security expert 30 yrs ago should be ridiculed. Their job description was I inspect all 5 1/4 disks that get mailed to us and should be a reason NOT to hire them :-P

Re: [Full-disclosure] Anyone have a reason for 2x the email flow today?

2007-12-05 Thread Bob Bruen
Hey JP, People who live in glass houses should not throw rocks at other people, especially in public. I still have not forgotten that you stole that CD set of SUSE 9.0 from me. The CD set may not be worth much, but I loaned them to you after you begged for someone on the list to bail you out

[Full-disclosure] Inside the Ron Paul Spam Botnet

2007-12-05 Thread lsi
[Half the backstory, gg, lol, etc. And we are led to somewhere in Eastern Europe, a dead-end I hear you say! No, no no... let's think like a spammer, one who just had his botnet toasted ... he knows the identity of his sponsor. That sponsor, if exposed, stands to lose a lot, and thus that

Re: [Full-disclosure] Anyone have a reason for 2x the email flow today?

2007-12-05 Thread Dude VanWinkle
On Dec 5, 2007 10:06 PM, Bob Bruen [EMAIL PROTECTED] wrote: On Wed, 5 Dec 2007, Dude VanWinkle wrote: On Dec 5, 2007 6:47 PM, Jay Dephallia [EMAIL PROTECTED] wrote: Its not spam email. You can seriously make yourself bigger with this pill. [EMAIL PROTECTED] has all the info. Just email him

Re: [Full-disclosure] need help in managing administrators

2007-12-05 Thread Valdis . Kletnieks
On Wed, 05 Dec 2007 22:45:39 EST, Dude VanWinkle said: You are right, thanks for all the careful planning and well thought out infrastructure. I mean, who could have thought that the ability to reach into the homes of every tom dick and harry as well as every company on the planet would be

Re: [Full-disclosure] need help in managing administrators

2007-12-05 Thread Dude VanWinkle
On Dec 5, 2007 11:10 PM, [EMAIL PROTECTED] wrote: On Wed, 05 Dec 2007 22:45:39 EST, Dude VanWinkle said: You are right, thanks for all the careful planning and well thought out infrastructure. I mean, who could have thought that the ability to reach into the homes of every tom dick and

Re: [Full-disclosure] Professional IT Security Service Providers - Exposed

2007-12-05 Thread Dude VanWinkle
On Dec 5, 2007 6:02 PM, [EMAIL PROTECTED] wrote: On Tue, 04 Dec 2007 16:02:26 EST, [EMAIL PROTECTED] said: Generally our reviews are done by reading the contents of the companies website. We strip away all the marketing fluff and we look for untruths, poor grammar, quality of service,

Re: [Full-disclosure] need help in managing administrators

2007-12-05 Thread Dude VanWinkle
On Dec 6, 2007 1:12 AM, [EMAIL PROTECTED] wrote: On Wed, 05 Dec 2007 23:57:19 EST, Dude VanWinkle said: try this hey boss, you will cause regulation, expose national secrets to commies, Umm.. hate to break it to you, but the design was for an *open* research network. If you said you'd be

[Full-disclosure] [SECURITY] [DSA 1420-1] New zabbix packages fix privilege escalation

2007-12-05 Thread Thijs Kinkhorst
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1420-1 [EMAIL PROTECTED] http://www.debian.org/security/ Thijs Kinkhorst December 05, 2007

Re: [Full-disclosure] Anyone have a reason for 2x the email flow today?

2007-12-05 Thread Kosala Atapattu
as a percentage? On Dec 4, 2007 4:27 PM, Maloney, Michael [EMAIL PROTECTED] wrote: I've noticed a 30K increase per day in traffic.. Mike Maloney Sr. System Engineer Middlesex County College 2600 Woodbridge Avenue Edison, NJ 08818 Phone:

Re: [Full-disclosure] Anyone have a reason for 2x the email flow today?

2007-12-05 Thread Jerry L. Ivey
Can you determine the nature of the increase? Is it just spam/junk? I'm seeing a significant increase in my personal mail due to Spam/Junk mail just within the last week. -Original Message- From: Dude VanWinkle [mailto:[EMAIL PROTECTED] Sent: Wednesday, December 05, 2007 2:00 PM To:

Re: [Full-disclosure] Anyone have a reason for 2x the email flow today?

2007-12-05 Thread James C. Slora Jr.
The cause was massive cross-posting to security lists. Just kidding. Are your numbers pre-filtering or post-filtering? Pre-filtering counts are really spam counts, so if your numbers are pre-filtering you are just seeing a basic bot-driven spam run. And basic bot-driven spam runs are far more

Re: [Full-disclosure] need help in managing administrators

2007-12-05 Thread Nick FitzGerald
[EMAIL PROTECTED] wrote: snippety, snip Or you could go the EEPROM/CDROM route like most game consoles did. That's easier on the practicality side, but still isn't as flexible as a general-purpose PC. Which, of course, raises the question _today_, do _most_ computer users for _all_ their

Re: [Full-disclosure] need help in managing administrators

2007-12-05 Thread Valdis . Kletnieks
On Thu, 06 Dec 2007 19:36:30 +1300, Nick FitzGerald said: likelihood of those problems being permanently addressed, why were these issues not addressed at some point when the cost/performance points started to be more favourable? Because when the price/performance shifted to make lots of

[Full-disclosure] Avast! AntiVirus TAR Processing Remote Heap Corruption

2007-12-05 Thread Sowhat
Avast! AntiVirus TAR Processing Remote Heap Corruption Sowhat of Nevis Labs http://www.nevisnetworks.com http://secway.org/advisory/AD20071206.txt BID: 26702 Vendor: ALWIL Software Affected: Avast! Home/Professional 4.7.1098 This vulnerability has been confirmed on Avast! Professional

Re: [Full-disclosure] need help in managing administrators

2007-12-05 Thread T Biehn
I guess there's only one real alternative to this terrible circle of doom then: stop feeding in to the man's machine and become a blackhat and stop disclosing. *waits for Valdis to hand in his hat authorization to use FD. On Dec 6, 2007 2:12 AM, [EMAIL PROTECTED] wrote: On Thu, 06 Dec 2007

[Full-disclosure] pcap flow extraction

2007-12-05 Thread Ivan .
Hi, Does anyone have any ideas for flow information extraction from a rather large pcap file, 6 gigs? I am after the standard stuff, source, destination, service. Ethereal/wireshark is a no go, as it won't process the file due to size, tcpflow is OK, but a little untidy. any suggestions are

Re: [Full-disclosure] [UPDATE]CA BrightStor ARCServe BackUp Message Engine Remote Stack Overflow Vulnerability

2007-12-05 Thread Code Audit Labs
About half year ago , We decided to NOT audit CA BrightStor ARCServe Backup any longer, Just because the produce have too many vulnerability that's not hard to be discovered. I think CA had better to full code audit for their produces . cocoruder 写道: [UPDATE]CA BrightStor ARCServe BackUp