[Full-disclosure] [SECURITY] [DSA-2117-1] New apr-util packages fix denial of service

2010-10-04 Thread Stefan Fritsch
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-2117-1 secur...@debian.org http://www.debian.org/security/ Stefan Fritsch October 4, 2010

[Full-disclosure] [SECURITY] [DSA-2116-1] New freetype packages integer overflow

2010-10-04 Thread Stefan Fritsch
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-2116-1 secur...@debian.org http://www.debian.org/security/ Stefan Fritsch October 4, 2010

[Full-disclosure] [ MDVSA-2010:196 ] dovecot

2010-10-04 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2010:196 http://www.mandriva.com/security/ _

Re: [Full-disclosure] Facebook CSRF and XSS vulnerabilities | Destructive worms on a social network

2010-10-04 Thread Atul Agarwal
Just finished watching the videos, and I have to admit that they were quite nicely done. Very interesting demonstration of the facebook flaws. Many vulns nicely chained to create the worms. Thanks, Atul Agarwal Secfence Technologies www.secfence.com 2010/10/4 John JEAN > Facebook is a social

[Full-disclosure] [ MDVSA-2010:195 ] libesmtp

2010-10-04 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2010:195 http://www.mandriva.com/security/ _

Re: [Full-disclosure] FreeBSD 7.0 - 7.2 pseudofs null pointer dereference

2010-10-04 Thread Przemyslaw Frasunek
> FreeBSD 7.0 - 7.2 pseudofs null pointer dereference [...] > There is a working exploit, allowing to gain local root privileges. It will be > released after 14 days from this advisory. It's high time to release the exploit: http://www.frasunek.com/pseudofs_exp.c

[Full-disclosure] Facebook CSRF and XSS vulnerabilities | Destructive worms on a social network

2010-10-04 Thread John JEAN
Facebook is a social networking website with the second highest number of visits worldwide, and over 500 million active users. Our team recently performed a quick security audit of the main Facebook site along with its mobile versions. Here are the full details of our findings. I. DESCRIPTION OF T

Re: [Full-disclosure] Full-Disclosure Digest, Vol 68, Issue 5

2010-10-04 Thread Mikhail A. Utin
> ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > -- next part -- An HTML attachment was scrubbed... URL:

[Full-disclosure] Need some direction

2010-10-04 Thread James Lay
Hello all. So I've been tasked with discovering exactly how some malicious java_cache.tmp files got to a users drive. Am I on the right track by guessing these were created by a malicious .jar file? Thanks for the direction. James ___ Full-Disclosur

Re: [Full-disclosure] WikiLeaks "underoing" (sic) scheduled maintenance

2010-10-04 Thread huj huj huj
probably just assange throwing a tantrum 2010/10/3 Harry Behrens > for 5 days and nothing about this to be found on google. > > Does anybody have an idea what is happening here - it does smell > slightly fishy... > > -h > > ___ > Full-Disclosure -

Re: [Full-disclosure] WikiLeaks "underoing" (sic) scheduled maintenance

2010-10-04 Thread PsychoBilly
http://www.pgpboard.com/viewtopic.php?f=2&t=125 dadamdadam dadam fire proof @ least!!! > probably just assange throwing a tantrum > > 2010/10/3 Harry Behrens mailto:ha...@behrens.com>> > > for 5 days and nothing about this to be found on google. > > Does anybody have an idea what is ha

Re: [Full-disclosure] WikiLeaks

2010-10-04 Thread Jeffrey Walton
The latest is kind of funny ("Latest smear attempt: Chinese spy agency gave WikiLeaks $20M"). Just call it a 'PAC Contribution' and everything will be fine. On Mon, Oct 4, 2010 at 7:05 AM, Juha-Matti Laurio wrote: > And nothing related is not tweeted at > http://twitter.com/wikileaks > > Juha-Ma

[Full-disclosure] Breaking .NET encryption with or without Padding Oracle

2010-10-04 Thread Early Warning
Dear list, Since Microsoft official fix is out, we published full details about "ScriptResource.axd" vulnerability in framework 3.5 sp1 and above which leads to arbitrary file disclosure in the virtual path. In addition we have included also details about the "T" exploit that can be used to circum

Re: [Full-disclosure] Multiple vulnerabilities in WordPress 2 and 3

2010-10-04 Thread PsychoBilly
We all know you have to make a living but For all these disclosures it's needed to have a brain. Cluster #[[ MustDie ]] possibly emitted, > For all these attacks it's needed to have access to admin account ___ Full-Disclos

Re: [Full-disclosure] WikiLeaks

2010-10-04 Thread Juha-Matti Laurio
And nothing related is not tweeted at http://twitter.com/wikileaks Juha-Matti Harry Behrens [ha...@behrens.com] kirjoitti: > for 5 days and nothing about this to be found on google. > > Does anybody have an idea what is happening here - it does smell > slightly fishy... > > -h >

Re: [Full-disclosure] Multiple vulnerabilities in WordPress 2 and 3

2010-10-04 Thread Jan G.B.
Hello MustStfu, I want to warn you about a heavy inform security bug which is can be found in of any linux distribution. also, one can if he has, then you can exploit it on windows and mac os X. For this type of attack, which i classify as a new bug category: fapwhilereseach, you can log in with a

Re: [Full-disclosure] the real stuxnet authors plz stand up

2010-10-04 Thread huj huj huj
coderman its puff puff pass.. you smoked the whole thing! 2010/9/25 coderman > On Fri, Sep 24, 2010 at 11:48 PM, Kenneth Voort wrote: > > Get real... > > i did not say bushehr was not impacted; a side effect of the re-use of > same real-time PLC workflow controller there resulted in cluster fuc