[Full-disclosure] CORE-2008-0122: MPlayer arbitrary pointer dereference

2008-02-04 Thread CORE Security Technologies Advisories
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs MPlayer arbitrary pointer dereference *Advisory Information* Title: MPlayer arbitrary pointer dereference Advisory ID:

[Full-disclosure] CORE-2007-1218: MPlayer 1.0rc2 buffer overflow vulnerability

2008-02-04 Thread CORE Security Technologies Advisories
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs MPlayer 1.0rc2 buffer overflow vulnerability *Advisory Information* Title: MPlayer 1.0rc2 buffer overflow vulnerability Advisory ID:

[Full-disclosure] iDefense Security Advisory 01.31.08: IBM Informix Dynamic Server SQLIDEBUG File Creation Vulnerability

2008-02-04 Thread iDefense Labs
iDefense Security Advisory 01.31.08 http://labs.idefense.com/intelligence/vulnerabilities/ Jan 31, 2008 I. BACKGROUND IBM Corp.'s Informix Dynamic Server is an online transaction processing data server. For more information, visit the product's homepage at the following URL.

[Full-disclosure] Immunity Debugger v1.4 Release

2008-02-04 Thread Nicolas Waisman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Immunity is proud to announce: Immunity Debugger v1.4 veni, vidi, pwn We would like to express our appreciation for the enormous amount of contributions, feedback and requests we receive daily from the Immunity Debugger community at

[Full-disclosure] Multiple vulnerabilities in WinCom LPD Total 3.0.2.623

2008-02-04 Thread Luigi Auriemma
### Luigi Auriemma Application: WinCom LPD Total - Line Printer Daemon http://clientsoftware.com.au/lpd.html Versions: = 3.0.2.623 Platforms:Windows Bugs: A]

[Full-disclosure] Socket termination in FTP Log Server 7.9.14.0

2008-02-04 Thread Luigi Auriemma
### Luigi Auriemma Application: FTP Log Server http://www.wsftp.com Versions: = 7.9.14.0 Platforms:Windows Bug: socket termination Exploitation: remote Date:

Re: [Full-disclosure] Firefox 2.0.0.12 SSL Spoofing and Domain Guessing vulnerabilities

2008-02-04 Thread steve menard
I get a warning on 2.0.0.11 Linux Ubuntu You are about to log into the site google with the username [EMAIL PROTECTED], but the website does not require authentication. this may be an attempt to trick you Is google the site you want to visit.? is this a 2.0.0.12 issue? Steve carl hardwick

Re: [Full-disclosure] Firefox 2.0.0.12 SSL Spoofing and Domain Guessing vulnerabilities

2008-02-04 Thread Rob Thompson
I only see that FF is current to version 2.0.0.11. Are you sure that you are finding this in 2.0.0.12? If so, where are you getting this version from? On Feb 4, 2008 12:10 PM, carl hardwick [EMAIL PROTECTED] wrote: Firefox seems to have trouble with defining the proper hostname when

Re: [Full-disclosure] Firefox 2.0.0.12 SSL Spoofing and Domain Guessing vulnerabilities

2008-02-04 Thread Juha-Matti Laurio
The most recent Firefox 2.0.0.12 version is RC4 still: http://www.mozilla.com/en-US/firefox/2.0.0.12/releasenotes/ You can't download Firefox 2.0.12 Final yet. Juha-Matti carl hardwick [EMAIL PROTECTED] wrote: Firefox seems to have trouble with defining the proper hostname when requesting a

[Full-disclosure] Firefox 2.0.0.12 SSL Spoofing and Domain Guessing vulnerabilities

2008-02-04 Thread carl hardwick
Firefox seems to have trouble with defining the proper hostname when requesting a ssl connection. I was able to trick Firefox in thinking the hostname behind the at-sign is legit and the same as the URI that requested an ssl connection, and this without a warning. PoC: https://[EMAIL PROTECTED]

[Full-disclosure] Multiple vulnerabilities in SAPlpd 6.28

2008-02-04 Thread Luigi Auriemma
### Luigi Auriemma Application: SAPlpd http://www.sap.com Versions: = 6.28 (included in SAP GUI 7.10) Platforms:Windows Bugs: various vulnerabilities Exploitation:

Re: [Full-disclosure] Firefox 2.0.0.12 SSL Spoofing and Domain Guessing vulnerabilities

2008-02-04 Thread reepex
I am not sure the intended point of the exploit since you have @roguehost and not a proper POC, but I believe all you have triggered is normal behavior for auto logging into .htaccess protected folders in the form username:[EMAIL PROTECTED] http://forum.sambarserver.info/viewtopic.php?p=288

[Full-disclosure] [USN-575-1] Apache vulnerabilities

2008-02-04 Thread Jamie Strandboge
=== Ubuntu Security Notice USN-575-1 February 04, 2008 apache2 vulnerabilities CVE-2006-3918, CVE-2007-3847, CVE-2007-4465, CVE-2007-5000, CVE-2007-6388, CVE-2007-6421, CVE-2007-6422, CVE-2008-0005

Re: [Full-disclosure] Firefox 2.0.0.12 SSL Spoofing and Domain Guessing vulnerabilities

2008-02-04 Thread Larry Seltzer
I get this same warning on FF 3.0 beta 2 on Vista. Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/ Contributing Editor, PC Magazine [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On

Re: [Full-disclosure] Southwest Airlines Ticket Silliness

2008-02-04 Thread Joey Mengele
LOLOLOLOLOL GLORYHOLES On Mon, 04 Feb 2008 11:42:13 -0500 Derek Buelna [EMAIL PROTECTED] wrote: It's been hard to fill all those positions in Oregon since we have manned gas stations. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of North, Quinn Sent:

Re: [Full-disclosure] Firefox 2.0.0.12 SSL Spoofing and Domain Guessing vulnerabilities

2008-02-04 Thread Rob Thompson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Juha-Matti Laurio wrote: | The most recent Firefox 2.0.0.12 version is RC4 still: | http://www.mozilla.com/en-US/firefox/2.0.0.12/releasenotes/ | | You can't download Firefox 2.0.12 Final yet. So if that's the case, did the author of this thread

Re: [Full-disclosure] Firefox 2.0.0.12 SSL Spoofing and Domain Guessing vulnerabilities

2008-02-04 Thread Joey Mengele
Confirmed on emacs on freebsd running on an alpha. J On Mon, 04 Feb 2008 18:49:59 -0500 Larry Seltzer [EMAIL PROTECTED] wrote: I get this same warning on FF 3.0 beta 2 on Vista. Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blogs.pcmag.com/securitywatch/

Re: [Full-disclosure] Firefox 2.0.0.12 SSL Spoofing and Domain Guessing vulnerabilities

2008-02-04 Thread scott
This is obviously a bug in the newest beta release and should be reported there.Why the OP chose not to do this is a matter for speculation. Regards, Scott steve menard wrote: I get a warning on 2.0.0.11 Linux Ubuntu You are about to log into the site google with the username [EMAIL

[Full-disclosure] [ MDVSA-2008:034 ] - Updated emacs packages fix vulnerabilities

2008-02-04 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2008:034 http://www.mandriva.com/security/