[Full-disclosure] Lotus expeditor rcplauncher uri handler vulnerability

2008-04-24 Thread Thomas Pollet
Hello, I have found that the lotus expeditor rcplauncher as installed by lotus symphony and possibly other products, registers a cai: uri handler. This handler executes D:\Program Files\IBM\Lotus\Symphony\framework\rcp\rcplauncher.exe -config notes -com.ibm.rcp.portal.app.ui#openCA %1 the

Re: [Full-disclosure] Lotus expeditor rcplauncher uri handler vulnerability

2008-04-24 Thread Nate McFeters
Very nice, looks a lot like some of my work in URI handler abuse. -Nate On 4/24/08, Thomas Pollet [EMAIL PROTECTED] wrote: Hello, I have found that the lotus expeditor rcplauncher as installed by lotus symphony and possibly other products, registers a cai: uri handler. This handler

[Full-disclosure] Cirque du 0day HIJACKED!!!

2008-04-24 Thread I)ruid .
Wow, that didn't take long... I released a draft of the Cirque du 0day CFP to a few closed channels a week or so ago, to float the idea around and see if anyone was interested in participating. Apparently Michael Chatner decided to hijack the idea and submit it to the public himself.

Re: [Full-disclosure] The DDoS Attacks Against CNN

2008-04-24 Thread Paul Schmehl
--On Thursday, April 24, 2008 10:45:37 +0800 www417 [EMAIL PROTECTED] wrote: Jesus! Please just review the picture of DDos tool carefully, all strings in software GUI is in English! If Chinese hacker want to make big attack to CNN.com, he(or she) have to write Chinese at the software GUI.

[Full-disclosure] Secureid using scientific calculator?

2008-04-24 Thread Gautam R. Singh
Possible/feasible? My own implementation of secure id algorithm using scientific calculator a watch? -- [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by

[Full-disclosure] Web Application Security Awareness Day

2008-04-24 Thread n3td3v
I'm considering cancelling Web Application Security Awareness Day because no one is supporting my day everyone is just saying nasty things and cloning things i've said to make fun of me and make me mad. I lost my temper http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061742.html

Re: [Full-disclosure] Cirque du 0day HIJACKED!!!

2008-04-24 Thread Nate McFeters
Honestly, I can't really blame him for stealing the idea... if he in fact did. Free 0dayz man... that's awesome! Nate On 4/24/08, I)ruid . [EMAIL PROTECTED] wrote: Wow, that didn't take long... I released a draft of the Cirque du 0day CFP to a few closed channels a week or so ago, to

Re: [Full-disclosure] Cirque du 0day HIJACKED!!!

2008-04-24 Thread I)ruid .
On Thu, Apr 24, 2008 at 11:03 AM, Nate McFeters [EMAIL PROTECTED] wrote: Honestly, I can't really blame him for stealing the idea... if he in fact did. Free 0dayz man... that's awesome! The funny thing is though, if he really just wanted free 0day, he probably should have taken out the

Re: [Full-disclosure] Web Application Security Awareness Day

2008-04-24 Thread Thomas Pollet
Hi, Web Application Security Awareness Day was supposed to be the day I could shine and the security community could shine, but I don't feel like shining anymore. I'd love to see you burn Regards, Tp ___ Full-Disclosure - We believe in it. Charter:

Re: [Full-disclosure] Web Application Security Awareness Day

2008-04-24 Thread malix
Good bye everybody Does this mean you may actually stfu permanently? Is this sad blubberfest of defeated loser indicative of you giving up and taking your bullshit elsewhere? Take your Web Application Security Awareness Day and shove it up your ass. PLEASE cancel it and while you're at it, get

[Full-disclosure] [ GLSA 200804-27 ] SILC: Multiple vulnerabilities

2008-04-24 Thread Tobias Heinlein
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200804-27 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] [ GLSA 200804-28 ] JRockit: Multiple vulnerabilities

2008-04-24 Thread Tobias Heinlein
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200804-28 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

Re: [Full-disclosure] Web Application Security Awareness Day

2008-04-24 Thread T Biehn
You can't kill an IDEA man ok, like that lives on in the minds of the people right the people you've touched with your ramblings man. Like you need to just toughen up and ignore the negative people on the list, they're just jealous of your connections and ability to strike at the heart of the

Re: [Full-disclosure] Web Application Security Awareness Day

2008-04-24 Thread null null
Hot damn, it's about time... http://www.cyberbee.com/yesteryear/oz_37.mp3 On Thu, Apr 24, 2008 at 12:54 PM, T Biehn [EMAIL PROTECTED] wrote: You can't kill an IDEA man ok, like that lives on in the minds of the people right the people you've touched with your ramblings man. Like you need to

[Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread David Litchfield
Hey all, I've just released some research that demonstrates a new class of vulnerability in Oracle and how it can be exploited by an attacker. You can grab the paper from here: http://www.databasesecurity.com/dbsec/lateral-sql-injection.pdf Cheers, David Litchfield NGSSoftware Ltd

[Full-disclosure] [SECURITY] [DSA 1556-1] New perl packages fix denial of service

2008-04-24 Thread Florian Weimer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1556-1 [EMAIL PROTECTED] http://www.debian.org/security/ Florian Weimer April 24, 2008

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread n3td3v
On Thu, Apr 24, 2008 at 5:49 PM, David Litchfield [EMAIL PROTECTED] wrote: Hey all, I've just released some research that demonstrates a new class of vulnerability in Oracle and how it can be exploited by an attacker. You can grab the paper from here:

Re: [Full-disclosure] - CALL FOR PAPERS -

2008-04-24 Thread Joel R. Helgeson
-ahem First off, if you're going to have a n+1 ring circus, you need to start your Cirque de 0day process in Ring 0. You can have the audience standing around in Ring 3. Joel From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Micheal Chatner Sent: Wednesday, April 23, 2008

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread malix
And here I thought you were canceling that piece of shit. That you even presume to believe that David Litchfield of all people gives the slightest fuck about what you have to say simply blows my mind. As always, please (and let me spell it out for you), SHUT THE FUCK UP. On Thu, 24 Apr 2008

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread n3td3v
On Thu, Apr 24, 2008 at 9:47 PM, [EMAIL PROTECTED] wrote: And here I thought you were canceling that piece of shit. That you even presume to believe that David Litchfield of all people gives the slightest fuck about what you have to say simply blows my mind. As always, please (and let me

[Full-disclosure] [SECURITY] [DSA 1534-2] New iceape packages fix regression

2008-04-24 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1534-2 [EMAIL PROTECTED] http://www.debian.org/security/ Moritz Muehlenhoff April 24, 2008

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread Kurt Dillard
I wouldn't use such harsh language as Malix, but he's correct. David has done a lot of ground-breaking research over the past decade and he's had a major impact on how Microsoft and Oracle create, test, and patch their products. You are unemployed and note that you were in some Yahoo chat groups

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread n3td3v
On Thu, Apr 24, 2008 at 9:58 PM, Kurt Dillard [EMAIL PROTECTED] wrote: I wouldn't use such harsh language as Malix, but he's correct. David has done a lot of ground-breaking research over the past decade and he's had a major impact on how Microsoft and Oracle create, test, and patch their

[Full-disclosure] [SECURITY] [DSA 1558-1] New xulrunner packages fix arbitrary code execution

2008-04-24 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1558-1 [EMAIL PROTECTED] http://www.debian.org/security/ Moritz Muehlenhoff April 24, 2008

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread Valdis . Kletnieks
On Thu, 24 Apr 2008 22:13:09 BST, n3td3v said: High up government officials are backing Web Application Application Security Awareness Day, so I would watch what you're saying. Can you cite an actual press release or other similar thing from anybody other than yourself? Pretty wimpy-ass

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread Ureleet
did u just threaten everyone? and for furthermore, did that richard dude just threaten everyone? nice move. i am sure richard didnt want his personal email posted to the list, thats why he sent it directly to you. On Thu, Apr 24, 2008 at 5:13 PM, n3td3v [EMAIL PROTECTED] wrote: On Thu, Apr

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread Ureleet
so did u or didnt u cancel it? please make up ur mind so we know whether to post anything on may 1 or not. i support the take a day off from fd day on may 1. On Thu, Apr 24, 2008 at 4:32 PM, n3td3v [EMAIL PROTECTED] wrote: On Thu, Apr 24, 2008 at 5:49 PM, David Litchfield [EMAIL PROTECTED]

Re: [Full-disclosure] May 1

2008-04-24 Thread Ureleet
how does what i said confirm a thing? On Tue, Apr 22, 2008 at 3:46 PM, n3td3v [EMAIL PROTECTED] wrote: On Tue, Apr 22, 2008 at 8:18 PM, Ureleet [EMAIL PROTECTED] wrote: i declare may 1 dont post anything to full-disclosure day. just in spite of n3td3v thinking that hes going to claim all

Re: [Full-disclosure] Researcher programmer

2008-04-24 Thread Ureleet
i dont hd gives a shit. thats where you and everyone else are different. On Wed, Apr 23, 2008 at 6:16 PM, Aaron Gray [EMAIL PROTECTED] wrote: HD Moore is gonna be pissed next time if he isn't classed as a researcher programmer, he doesn't want to be in with the security researcher crowd,

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread Ureleet
objection, speculation. On Thu, Apr 24, 2008 at 5:31 PM, n3td3v [EMAIL PROTECTED] wrote: On Thu, Apr 24, 2008 at 10:24 PM, [EMAIL PROTECTED] wrote: On Thu, 24 Apr 2008 22:13:09 BST, n3td3v said: High up government officials are backing Web Application Application Security

Re: [Full-disclosure] A New Class of Vulnerability in Oracle:Lateral SQL Injection

2008-04-24 Thread Fish, Patrick O HEC
I thought you cancelled it? I'm pretty sure he saw that, too. We were all waiting for it. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of n3td3v Sent: Thursday, April 24, 2008 1:33 PM To: David Litchfield; full-disclosure@lists.grok.org.uk; n3td3v

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread n3td3v
On Thu, Apr 24, 2008 at 10:24 PM, [EMAIL PROTECTED] wrote: On Thu, 24 Apr 2008 22:13:09 BST, n3td3v said: High up government officials are backing Web Application Application Security Awareness Day, so I would watch what you're saying. Can you cite an actual press release or other

Re: [Full-disclosure] Cirque du 0day HIJACKED!!!

2008-04-24 Thread Andrew A
Stop lying to everyone. Caughq.org got owned and rm'd. Looks like Michael Chatner is a more fitting individual to run the Cirque than you, buddy. On Thu, Apr 24, 2008 at 8:29 AM, I)ruid . [EMAIL PROTECTED] wrote: Wow, that didn't take long... I released a draft of the Cirque du 0day CFP to a

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread malix
Kurt, You're right, such language isn't constructive, my apologies. n3td3v, Given Richard's extraordinary credentials (http://www.linkedin.com/pub/5/04B/758) I suggest you two team up and start a new consultancy: The Asshat Stikeforce! Then you can give each other a regular stroke, both

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread nnp
On Thu, Apr 24, 2008 at 10:13 PM, n3td3v [EMAIL PROTECTED] wrote: High up government officials are backing Web Application Application Security Awareness Day, so I would watch what you're saying. -- Forwarded message -- From: Richard Golodner [EMAIL PROTECTED] Date: Thu,

Re: [Full-disclosure] Web Application Security Awareness Day

2008-04-24 Thread auto188821
I'm considering cancelling Web Application Security Awareness Day because no one is supporting my day everyone is just saying nasty things and cloning things i've said to make fun of me and make me mad. The more important you think you are, the less others are inclined to. Inciting you to

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread n3td3v
On Thu, Apr 24, 2008 at 10:46 PM, nnp [EMAIL PROTECTED] wrote: On Thu, Apr 24, 2008 at 10:13 PM, n3td3v [EMAIL PROTECTED] wrote: High up government officials are backing Web Application Application Security Awareness Day, so I would watch what you're saying. -- Forwarded

Re: [Full-disclosure] Web Application Security Awareness Day

2008-04-24 Thread n3td3v
On Thu, Apr 24, 2008 at 10:46 PM, [EMAIL PROTECTED] wrote: I'm considering cancelling Web Application Security Awareness Day because no one is supporting my day everyone is just saying nasty things and cloning things i've said to make fun of me and make me mad. The more important you

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread auto188821
High up government officials are backing Web Application Application Security Awareness Day, so I would watch what you're saying. -- Forwarded message -- From: Richard Golodner [EMAIL PROTECTED] Oh noes! The great and powerful Richard Golodner (that none of us have ever heard

Re: [Full-disclosure] Researcher programmer

2008-04-24 Thread n3td3v
On Thu, Apr 24, 2008 at 10:32 PM, Ureleet [EMAIL PROTECTED] wrote: i dont hd gives a shit. thats where you and everyone else are different. How do you know what HD Moore thinks and who he might talk to? ___ Full-Disclosure - We believe in it.

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread nnp
On Thu, Apr 24, 2008 at 10:57 PM, n3td3v [EMAIL PROTECTED] wrote: On Thu, Apr 24, 2008 at 10:46 PM, nnp [EMAIL PROTECTED] wrote: On Thu, Apr 24, 2008 at 10:13 PM, n3td3v [EMAIL PROTECTED] wrote: High up government officials are backing Web Application Application Security Awareness

[Full-disclosure] [SECURITY] [DSA 1557-1] New phpmyadmin packages fix several vulnerabilities

2008-04-24 Thread Thijs Kinkhorst
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1557-1 [EMAIL PROTECTED] http://www.debian.org/security/ Thijs Kinkhorst April 24, 2008

Re: [Full-disclosure] Researcher programmer

2008-04-24 Thread Ureleet
for that matter, how do you? my penis is bigger. On Thu, Apr 24, 2008 at 6:06 PM, n3td3v [EMAIL PROTECTED] wrote: On Thu, Apr 24, 2008 at 10:32 PM, Ureleet [EMAIL PROTECTED] wrote: i dont hd gives a shit. thats where you and everyone else are different. How do you know what HD Moore

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread Ureleet
are you again threatening us? in america, thats enuff to call the police. and no, i am not threatening to do so. On Thu, Apr 24, 2008 at 5:57 PM, n3td3v [EMAIL PROTECTED] wrote: On Thu, Apr 24, 2008 at 10:46 PM, nnp [EMAIL PROTECTED] wrote: On Thu, Apr 24, 2008 at 10:13 PM, n3td3v [EMAIL

Re: [Full-disclosure] Web Application Security Awareness Day

2008-04-24 Thread Ureleet
same to you. my penis is still bigger. On Thu, Apr 24, 2008 at 6:01 PM, n3td3v [EMAIL PROTECTED] wrote: On Thu, Apr 24, 2008 at 10:46 PM, [EMAIL PROTECTED] wrote: I'm considering cancelling Web Application Security Awareness Day because no one is supporting my day everyone is just saying

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread n3td3v
On Fri, Apr 25, 2008 at 12:09 AM, Ureleet [EMAIL PROTECTED] wrote: are you again threatening us? in america, thats enuff to call the police. and no, i am not threatening to do so. I live in UK under British rule, all the best with the extradition. n3td3v

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread Ureleet
no, you idiot, i was telling you to quit threatening ppl. god you are thick. On Thu, Apr 24, 2008 at 7:19 PM, n3td3v [EMAIL PROTECTED] wrote: On Fri, Apr 25, 2008 at 12:09 AM, Ureleet [EMAIL PROTECTED] wrote: are you again threatening us? in america, thats enuff to call the police. and

Re: [Full-disclosure] A New Class of Vulnerability in Oracle: Lateral SQL Injection

2008-04-24 Thread n3td3v
On Fri, Apr 25, 2008 at 12:22 AM, Ureleet [EMAIL PROTECTED] wrote: no, you idiot, i was telling you to quit threatening ppl. god you are thick. In Britian, we reject people like you. All the best at passport control. ___ Full-Disclosure - We believe

[Full-disclosure] [ MDVSA-2008:091 ] - Updated wireshark packages fix denial of service vulnerabilities

2008-04-24 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2008:091 http://www.mandriva.com/security/

[Full-disclosure] Researcher programmer

2008-04-24 Thread Ricardo Giorgi
Hi folks, Let's stop the low level of this discussion because it don't takes to any place besides generate more flames. What do you think to change the matter of this discussion to a more constructive theme, like exploits, for example ? ;-) Have a nice day, Richard De: [EMAIL

[Full-disclosure] To the I)ruid

2008-04-24 Thread Micheal Chatner
Dear Sir, I find it incredibly curious that you would try to pass off my CFP as your own. I did a little research into the matter and found that you are a subpar security researcher for the subpar BreakingPoint Systems. I found this picture of you and I believe you have the appearance of a downs

Re: [Full-disclosure] To the I)ruid

2008-04-24 Thread scott
Doctor this, Welcome to my killfile. Micheal Chatner wrote: Dear Sir, I find it incredibly curious that you would try to pass off my CFP as your own. I did a little research into the matter and found that you are a subpar security researcher for the subpar BreakingPoint Systems. I

Re: [Full-disclosure] Cirque du 0day HIJACKED!!!

2008-04-24 Thread reepex
how is the botnet linked with services.caughq.org doing? Still spamming aim clients? On Thu, Apr 24, 2008 at 10:29 AM, I)ruid . [EMAIL PROTECTED] wrote: Wow, that didn't take long... I released a draft of the Cirque du 0day CFP to a few closed channels a week or so ago, to float the idea

Re: [Full-disclosure] Cirque du 0day HIJACKED!!!

2008-04-24 Thread coderman
On Thu, Apr 24, 2008 at 2:40 PM, Andrew A [EMAIL PROTECTED] wrote: Stop lying to everyone. Caughq.org got owned and rm'd. lol on related tangent, churchofwifi.org got pwned by aLpTurkTegin kiddie. alas, zone-h.org unable to note the event for posterity. what is with all these DEF CON poseurs