Re: [Full-disclosure] (no subject)

2009-12-16 Thread Dan Kaminsky
Easily the best environment for packet manipulation is scapy. The most guaranteed to work approach involves putting a system with two interfaces in as an attacker, and running two scapy processes that copy frames received on one interface onto the other one. Of course, your copier parses the fram

[Full-disclosure] (no subject)

2009-12-16 Thread 김무성
Hello. List. I’m pentesting IPTV. Our IPTV network structure is this. Monitor - IPTV - VDSL modem - ISP So, for packet manipulation I have to ARP spoofing or change network structure Monitor - IPTV - attacker - VDSL modem - ISP But, I don’t know IPTV SetupBox(STB)’s netmas

[Full-disclosure] The Great Aussie Firewall is dead: Long live the firewall

2009-12-16 Thread Ivan .
http://www.theregister.co.uk/2009/12/15/australian_censorship_measures/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Campus Party Eu 2010 Security Challenge - Call For Participants

2009-12-16 Thread Campus Party EU Spain
Greetings, The Spanish Ministry for Science and Innovation presents in Madrid from 14th – 18th April, and during the Spanish Presidency of the European Union, Campus Party Europe (http://www.campus-party.eu/home-en.html) : a special edition of what is considered the biggest event for technology, c

[Full-disclosure] [ MDVSA-2009:334 ] poppler

2009-12-16 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2009:334 http://www.mandriva.com/security/

[Full-disclosure] Drupal 6.x Core XSS Vulnerability

2009-12-16 Thread Justin Klein Keane
The full text of this advisory can be found at http://www.madirish.net/?article=442 Description of Vulnerability: - - - Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL that provides extensibility through various third part

[Full-disclosure] cve-2009-4324

2009-12-16 Thread exploit dev
Hi there on my blog I'm collecting and I have posted something about the sobject with links to other web site related If you are interested check http://extraexploit.blogspot.com Very important disclaimer: (I'm not a poser, I'm not a spammer) Thank you to all for attention Regards ___

[Full-disclosure] Drupal 5.x and 6.x Core XSS Vulnerability

2009-12-16 Thread Justin Klein Keane
The text of this advisory is also available at http://www.madirish.net/?article=441 Description of Vulnerability: - - - Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL that provides extensibility through various third part

[Full-disclosure] [SECURITY] [DSA 1956-1] New xulrunner packages fix several vulnerabilities

2009-12-16 Thread Moritz Muehlenhoff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1956-1 secur...@debian.org http://www.debian.org/security/ Moritz Muehlenhoff December 16, 2009

[Full-disclosure] rPSA-2009-0161-1 hwdata kernel

2009-12-16 Thread rPath Update Announcements
rPath Security Advisory: 2009-0161-1 Published: 2009-12-16 Products: rPath Appliance Platform Linux Service 1 rPath Appliance Platform Linux Service 2 rPath Linux 2 Rating: Critical Exposure Level Classification: Remote Root Non-deterministic Denial of Service Updated Versions:

[Full-disclosure] [SECURITY] [DSA 1955-1] New network-manager/network-manager-applet packages fix information disclosure

2009-12-16 Thread Steffen Joeris
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1955-1 secur...@debian.org http://www.debian.org/security/ Steffen Joeris December 16, 2009

[Full-disclosure] VideoCache 1.9.2 vccleaner root vulnerability

2009-12-16 Thread Dominick LaTrappe
[ SYNOPSIS ]= VideoCache is a Squid URL rewriter plugin written in Python for bandwidth optimization while browsing video sharing websites. Version 1.9.2 allows a user with the privileges of the Squid proxy server to append semi-arbitrary

[Full-disclosure] [SECURITY] [DSA 1954-1] New cacti packages fix insufficient input sanitising

2009-12-16 Thread Steffen Joeris
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1954-1 secur...@debian.org http://www.debian.org/security/ Steffen Joeris December 16, 2009

[Full-disclosure] [ISecAuditors Security Advisories] WP-Forum <= 2.3 SQL Injection vulnerabilities

2009-12-16 Thread ISecAuditors Security Advisories
= INTERNET SECURITY AUDITORS ALERT 2009-010 - Original release date: September 28th, 2009 - Last revised: December 15th, 2009 - Discovered by: Juan Galiana Lara - CVE ID: CVE-2009-3703 - Severity: 8.5/10 (CVSS Base Score) =

[Full-disclosure] [SECURITY] [DSA-1953-1] New expat packages fix denial of service

2009-12-16 Thread Stefan Fritsch
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1953-1 secur...@debian.org http://www.debian.org/security/ Stefan Fritsch December 15, 2009

[Full-disclosure] Google Picasa 3.5 Local DoS Buffer Overflow

2009-12-16 Thread ad...@hacktalk.net
Connection from the HackTalk team recently discovered a Buffer Overflow in Picasa 3.5 which causes the program to crash. Read all the information @ http://hacktalk.net/I6aL -- Luis Santana Admin - http://hacktalk.net ___ Full-Disclosure - We believe

[Full-disclosure] Drupal Sections Module XSS Vulnerability

2009-12-16 Thread Justin C. Klein Keane
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 The text of this announcment is also available at http://www.madirish.net/?article=440 Description of Vulnerability: - - - - Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL th

[Full-disclosure] Drupal Sections Module XSS Vulnerability

2009-12-16 Thread Justin Klein Keane
The text of this announcment is also available at http://www.madirish.net/?article=440 Description of Vulnerability: - - - Drupal (http://drupal.org) is a robust content management system (CMS) written in PHP and MySQL that provides extensibility through various third p

[Full-disclosure] Cisco Security Advisory: Multiple Cisco WebEx WRF Player Vulnerabilities

2009-12-16 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: Multiple Cisco WebEx WRF Player Vulnerabilities Advisory ID: cisco-sa-20091216-webex http://www.cisco.com/warp/public/707/cisco-sa-20091216-webex.shtml Revision 1.0 For Public Release 2009 December 16 1600 UTC (GMT

Re: [Full-disclosure] Google Chrome 3.0.195.33 leaks DNS data queries outsitde of proxy if dns pre-fetching is enabled

2009-12-16 Thread Christian Sciberras
A few words of wisdom I suppose... On Wed, Dec 16, 2009 at 2:14 PM, Jan G.B. wrote: > May I call your attention on > this: http://images.google.de/images?sourceid=chrome&q=arguing+on+the+internet > ? > Regards > > > 2009/12/16 Christian Sciberras >> >> I don't recall insulting anyone. How doe

Re: [Full-disclosure] Google Chrome 3.0.195.33 leaks DNS data queries outsitde of proxy if dns pre-fetching is enabled

2009-12-16 Thread Jan G.B.
May I call your attention on this: http://images.google.de/images?sourceid=chrome&q=arguing+on+the+internet ? Regards 2009/12/16 Christian Sciberras > I don't recall insulting anyone. How does that count as a "personal > attack" to anyone? > Regards, > Christian Sciberras. > > On Wed, Dec 16, 2

Re: [Full-disclosure] Google Chrome 3.0.195.33 leaks DNS data queries outsitde of proxy if dns pre-fetching is enabled

2009-12-16 Thread Christian Sciberras
I don't recall insulting anyone. How does that count as a "personal attack" to anyone? I'm no moderator and can't point out anything to someone in particular, I keep talking in general. If you think I'd get down low and insult anyone, spare it. Regards, Christian Sciberras. On Wed, Dec 16, 2009

Re: [Full-disclosure] Google Chrome 3.0.195.33 leaks DNS data queries outsitde of proxy if dns pre-fetching is enabled

2009-12-16 Thread Nick FitzGerald
Christian Sciberras to me: > "Disagreements, flames, arguments, and off-topic discussion should be > taken off-list wherever possible." > I wonder where I've read that... So, knowing that, you decided to post your deeply security-illuminating "Seriously, I didn't subscribe for this list just to

Re: [Full-disclosure] Google Chrome 3.0.195.33 leaks DNS data queries outsitde of proxy if dns pre-fetching is enabled

2009-12-16 Thread Christian Sciberras
Hmm. "Disagreements, flames, arguments, and off-topic discussion should be taken off-list wherever possible." I wonder where I've read that... Regards. On Wed, Dec 16, 2009 at 10:26 AM, Nick FitzGerald wrote: > Christian Sciberras wrote: > >> Seriously, I didn't subscribe for this list just t

Re: [Full-disclosure] Google Chrome 3.0.195.33 leaks DNS data queries outsitde of proxy if dns pre-fetching is enabled

2009-12-16 Thread Nick FitzGerald
Christian Sciberras wrote: > Seriously, I didn't subscribe for this list just to get personal attacks. You're on the wrong list then... Regards, Nick FitzGerald ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclos

Re: [Full-disclosure] Google Chrome 3.0.195.33 leaks DNS data queries outsitde of proxy if dns pre-fetching is enabled

2009-12-16 Thread Christian Sciberras
Can't you guys quit with the witty personal remarks and discuss security? Seriously, I didn't subscribe for this list just to get personal attacks. On Wed, Dec 16, 2009 at 9:12 AM, dramacrat wrote: > Oops, Milan - you did it again. > You remind me of those IRC users that feel the need to publicl

Re: [Full-disclosure] Google Chrome 3.0.195.33 leaks DNS data queries outsitde of proxy if dns pre-fetching is enabled

2009-12-16 Thread dramacrat
Oops, Milan - you did it again. You remind me of those IRC users that feel the need to publicly announce that they're placing someone on IGNORE... and then never actually do it, because then the ignored user might say something mean about them and the IGNORing user wouldn't be able to make their a