Re: [Full-disclosure] security industry software license

2008-10-14 Thread AaRoNg11
On Wed, Oct 15, 2008 at 7:37 AM, AaRoNg11 <[EMAIL PROTECTED]> wrote: > Society doesn't care, just n3td3v :P > > >> Why does society care about doing this? >> >> Or is it just that you can't figure out how to use it, so you don't want >> others to have access to it? >> >> > -- > Aaron Goulden >

Re: [Full-disclosure] security industry software license

2008-10-14 Thread Valdis . Kletnieks
On Wed, 15 Oct 2008 00:57:45 BST, n3td3v said: > half the reason is because they don't need to, there are no laws in > place to say, *you need to do more* Please explain the *full* cost-benefit analysis of passing such a law, taking into account the following: 1) The fact that the Internet is mul

Re: [Full-disclosure] Circuit Switched Data in the US?

2008-10-14 Thread Miller Grey
Interesting... On Tue, Oct 14, 2008 at 7:25 AM, Fabio Pietrosanti (naif) <[EMAIL PROTECTED]> wrote: > Hi all, > > i am evaluating how the CSD (Circuit Switched Data) service is available > in the USA to make mobilephone<-->mobilephone data calls. > > This because encrypted mobile phone calls in o

[Full-disclosure] [USN-655-1] exiv2 vulnerabilities

2008-10-14 Thread Kees Cook
=== Ubuntu Security Notice USN-655-1 October 15, 2008 exiv2 vulnerabilities CVE-2007-6353, CVE-2008-2696 === A security issue affects the following Ubuntu releases: Ubuntu 7.0

[Full-disclosure] [USN-654-1] libexif vulnerabilities

2008-10-14 Thread Kees Cook
=== Ubuntu Security Notice USN-654-1 October 14, 2008 libexif vulnerabilities CVE-2007-6351, CVE-2007-6352 === A security issue affects the following Ubuntu releases: Ubuntu 6

[Full-disclosure] iDefense Security Advisory 10.14.08: Sun Java Web Proxy Server FTP Resource Handling Heap-Based Buffer Overflow

2008-10-14 Thread [EMAIL PROTECTED]
iDefense Security Advisory 10.09.08 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 09, 2008 I. BACKGROUND Sun Microsystems Inc's Java System is a collection of server applications bundled together. One such server application included is the Web Proxy Server. This software implements

[Full-disclosure] TPTI-08-07: Microsoft Windows Message Queuing Service Heap Overflow and Memory Disclosure Vulnerability

2008-10-14 Thread dvlabs
TPTI-08-07: Microsoft Windows Message Queuing Service Heap Overflow and Memory Disclosure Vulnerability http://dvlabs.tippingpoint.com/advisory/TPTI-08-07 October 14, 2008 -- CVE ID: CVE-2008-3479 -- Affected Vendors: Microsoft -- Affected Products: Microsoft OS -- TippingPoint(TM) IPS Customer

Re: [Full-disclosure] security industry software license

2008-10-14 Thread n3td3v
metasploit doesn't do enough to stop the bad guys downloading it, infact metasploit does nothing to stop the bad guys downloading it. half the reason is because they don't need to, there are no laws in place to say, *you need to do more* ___ Full-Disclos

[Full-disclosure] iDefense Security Advisory 10.14.08: Microsoft Visual Basic for Applications - Multiple Vulnerabilities

2008-10-14 Thread [EMAIL PROTECTED]
iDefense Security Advisory 10.14.08 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 14, 2008 I. BACKGROUND Microsoft VBA is an implementation of Microsoft Visual Basic programming language for developing client desktop packaged applications and integrating them with existing data and s

[Full-disclosure] ZDI-08-068: Microsoft Office Excel BIFF File Format Parsing Stack Overflow Vulnerability

2008-10-14 Thread zdi-disclosures
ZDI-08-068: Microsoft Office Excel BIFF File Format Parsing Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-068 -- CVE ID: CVE-2008-3471 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Office Excel -- TippingPoint(TM) IPS Customer Protection: Tipp

[Full-disclosure] ZDI-08-069: Microsoft Internet Explorer componentFromPoint Memory Corruption Vulnerability

2008-10-14 Thread zdi-disclosures
ZDI-08-069: Microsoft Internet Explorer componentFromPoint Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-069 -- CVE ID: CVE-2008-3475 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Internet Explorer 6 -- TippingPoint(TM) IPS Customer Protect

[Full-disclosure] CORE-2008-1010: VLC media player XSPF Memory Corruption

2008-10-14 Thread CORE Security Technologies Advisories
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ VLC media player XSPF Memory Corruption 1. *Advisory Information* Title: VLC media player XSPF Memory Corruption Advisory ID: CORE-2008-1

[Full-disclosure] iDefense Security Advisory 10.14.08: Microsoft Host Integration Server 2006 Command Execution Vulnerability

2008-10-14 Thread iDefense Labs
iDefense Security Advisory 10.14.08 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 14, 2008 I. BACKGROUND The Host Integration Server is an application suite that is used to communicate with IBM mainframe servers. One of the components of the suite is a remote management interface. Th

[Full-disclosure] [SECURITY] [DSA 1653-1] New Linux 2.6.18 packages fix several vulnerabilities

2008-10-14 Thread dann frazier
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA-1653-1[EMAIL PROTECTED] http://www.debian.org/security/ dann frazier Oct 13, 2008htt

[Full-disclosure] [SECURITY] [DSA 1654-1] New libxml2 packages fix execution of arbitrary code

2008-10-14 Thread Steve Kemp
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1654-1 [EMAIL PROTECTED] http://www.debian.org/security/ Steve Kemp October 14, 2008

[Full-disclosure] script that was used to flood FD a few years ago?

2008-10-14 Thread Kevin Finisterre (lists)
Does anyone have an archive of the script that was being used to send furry porn to the list via spoofed list members? I recall it was using a mysql db on the backend. It was sent out during this time frame: http://www.security-express.com/archives/fulldisclosure/2006-08/thread.html thanks

Re: [Full-disclosure] IBM DB2

2008-10-14 Thread Troy Bollinger
On Tue, Oct 14, 2008 at 04:22:10PM +0300, Dennis Yurichev wrote: > Anybody know right method to report vulnerability in IBM DB2? Is this > email correct? [EMAIL PROTECTED] That would work, although that's the AIX Security team address. You can also use [EMAIL PROTECTED] for reporting vulnerabili

[Full-disclosure] [USN-653-1] D-Bus vulnerabilities

2008-10-14 Thread Kees Cook
=== Ubuntu Security Notice USN-653-1 October 14, 2008 dbus vulnerabilities CVE-2008-0595, CVE-2008-3834 === A security issue affects the following Ubuntu releases: Ubuntu 6.06

[Full-disclosure] [USN-652-1] LittleCMS vulnerability

2008-10-14 Thread Kees Cook
=== Ubuntu Security Notice USN-652-1 October 14, 2008 lcms vulnerability CVE-2007-2741 === A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS This adviso

[Full-disclosure] Mini MySqlat0r release

2008-10-14 Thread MiniMySqlat0r
Mini MySqlat0r is a multi-platform application used to audit web sites in order to discover and exploit SQL injection vulnerabilities in applications that use MySQL for storing data. It is written in Java and is used through a user-friendly GUI that contains three distinct modules. The Crawler mod

[Full-disclosure] [RISE-2008001] Sun Solstice AdminSuite sadmind adm_build_path() Buffer Overflow Vulnerability

2008-10-14 Thread RISE Security
RISE-2008001 Sun Solstice AdminSuite sadmind adm_build_path() Buffer Overflow Vulnerability http://risesecurity.org/advisories/RISE-2008001.txt Published: October 14, 2008 Updated: October 14, 2008 INTRODUCTION There exists a vulnerability within a function of the Sun Solstice AdminSuite sadmin

Re: [Full-disclosure] security industry software license

2008-10-14 Thread n3td3v
On Tue, Oct 14, 2008 at 3:07 PM, <[EMAIL PROTECTED]> wrote: > On Tue, 14 Oct 2008 13:03:50 BST, n3td3v said: > >> The FBI should investigate me as well, you can't have someone like me >> not investigated. > > http://en.wikipedia.org/wiki/Narcissistic_personality_disorder > hahahaha ___

Re: [Full-disclosure] IBM DB2

2008-10-14 Thread Juha-Matti Laurio
Yes, it's correct (and it is mentioned at http://osvdb.org/vendor/1/International%20Business%20Machines%20Corporation too. Very probably you'll receive a reply from security/product team too. Juha-Matti Dennis Yurichev [EMAIL PROTECTED] kirjoitti: > -BEGIN PGP SIGNED MESSAGE- > Hash: SH

Re: [Full-disclosure] IBM DB2

2008-10-14 Thread Jeroen Massar
Dennis Yurichev wrote: > Hi. > > Anybody know right method to report vulnerability in IBM DB2? > Is this email correct? [EMAIL PROTECTED] For a long time already. Do format your mail properly though. Greets, Jeroen signature.asc Description: OpenPGP digital signature

[Full-disclosure] IBM DB2

2008-10-14 Thread Dennis Yurichev
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi. Anybody know right method to report vulnerability in IBM DB2? Is this email correct? [EMAIL PROTECTED] - -- My PGP public key: http://yurichev.com/dennis.yurichev.asc -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.8 (MingW32) Comment: Using Gn

Re: [Full-disclosure] security industry software license

2008-10-14 Thread Valdis . Kletnieks
On Tue, 14 Oct 2008 13:03:50 BST, n3td3v said: > The FBI should investigate me as well, you can't have someone like me > not investigated. http://en.wikipedia.org/wiki/Narcissistic_personality_disorder pgphnLMkET8ON.pgp Description: PGP signature ___

Re: [Full-disclosure] security industry software license

2008-10-14 Thread n3td3v
On Tue, Oct 14, 2008 at 1:28 PM, M. B. Jr. <[EMAIL PROTECTED]> wrote: > And by the way, why insistently and specifically targeting Metasploit? i don't like hd moore ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosur

Re: [Full-disclosure] security industry software license

2008-10-14 Thread n3td3v
On Tue, Oct 14, 2008 at 1:21 PM, Michael Simpson <[EMAIL PROTECTED]> wrote: > On 10/14/08, n3td3v <[EMAIL PROTECTED]> wrote: >> On Tue, Oct 14, 2008 at 10:23 AM, Michael Simpson >> <[EMAIL PROTECTED]> wrote: >> >> * I'm not a criminal >> >> >> > >> > Just because you haven't been caught doing somet

Re: [Full-disclosure] security industry software license

2008-10-14 Thread M . B . Jr .
Again, you're trying to solve an issue looking at the consequences, whereas your "license scheme" suggestion should lay on the causes; as I wrote before, focusing consequences in this case, brings along no easy solutions. And by the way, why insistently and specifically targeting Metasploit? That

[Full-disclosure] Circuit Switched Data in the US?

2008-10-14 Thread Fabio Pietrosanti (naif)
Hi all, i am evaluating how the CSD (Circuit Switched Data) service is available in the USA to make mobilephone<-->mobilephone data calls. This because encrypted mobile phone calls in order to be done without intermediate registration servers, required CSD calls (point-to-point data path). I

Re: [Full-disclosure] security industry software license

2008-10-14 Thread Michael Simpson
On 10/14/08, n3td3v <[EMAIL PROTECTED]> wrote: > On Tue, Oct 14, 2008 at 10:23 AM, Michael Simpson > <[EMAIL PROTECTED]> wrote: > >> * I'm not a criminal > >> > > > > Just because you haven't been caught doing something illegal doesn't > > mean you are haven't engaged in illegal acts > > > > mike t

Re: [Full-disclosure] security industry software license

2008-10-14 Thread n3td3v
On Tue, Oct 14, 2008 at 3:16 AM, Paul Ferguson <[EMAIL PROTECTED]> wrote: > For what it's worth, the FBI now does not need a reason to investigate > anyone: > > http://centerforinvestigativereporting.org/blogpost/20081006broaderfbipower > snowsetinstone > > Enjoy! > > - - ferg The FBI should inve

Re: [Full-disclosure] security industry software license

2008-10-14 Thread n3td3v
On Tue, Oct 14, 2008 at 10:23 AM, Michael Simpson <[EMAIL PROTECTED]> wrote: >> * I'm not a criminal >> > > Just because you haven't been caught doing something illegal doesn't > mean you are haven't engaged in illegal acts > mike thinks i carry out illegal acts >> * I'm not mentally ill >> > > B

Re: [Full-disclosure] security industry software license

2008-10-14 Thread n3td3v
Mike, you're a good troll, now GTFO. n3td3v On Tue, Oct 14, 2008 at 10:23 AM, Michael Simpson <[EMAIL PROTECTED]> wrote: >> * I'm not a criminal >> > > Just because you haven't been caught doing something illegal doesn't > mean you are haven't engaged in illegal acts > >> * I'm not mentally ill

Re: [Full-disclosure] security industry software license

2008-10-14 Thread Michael Simpson
> * I'm not a criminal > Just because you haven't been caught doing something illegal doesn't mean you are haven't engaged in illegal acts > * I'm not mentally ill > BZZZT! Wrong Checkout your psychopathology in DSM-IV. > * I'm not a terrorist > Certainly not in the classic model but where doe

Re: [Full-disclosure] security industry software license

2008-10-14 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Fiat licensure laws are invariably used (if not intended) to restrict new entrants in a profession. The idea is to benefit existing members in that profession (who are "grandfathered" into licensure by virtue of having worked in that profession for a d