Re: [Full-disclosure] Sony: No firewall and no patches

2011-05-12 Thread Craig Miskell
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 11/05/11 23:05, phocean wrote: Also, if you filter (and you should) both inbound and outbound traffic, how do you allow legitimate responses to the server? I think Roland said earlier that outbound connections from these boxes should be going

Re: [Full-disclosure] This Afternoons Emails

2011-05-12 Thread Michael Simpson
On 8 May 2011 20:44, phocean 0...@phocean.net wrote: Now that N3td3v is back, the All-stars of FD are gathered one more time for a brain sucking discussion. Wait, I go take some pop-corn before what's coming next. Thanks for the entertainment, it is better than any comedy. Maybe it would be

Re: [Full-disclosure] Sony: No firewall and no patches

2011-05-12 Thread Thor (Hammer of God)
On 11/05/11 23:05, phocean wrote: Also, if you filter (and you should) both inbound and outbound traffic, how do you allow legitimate responses to the server? I think Roland said earlier that outbound connections from these boxes should be going out another interface, presumably (my

Re: [Full-disclosure] Sony: No firewall and no patches

2011-05-12 Thread Bruno Cesar Moreira de Souza
--- On May 11, 2011, Dobbins, Roland rdobb...@arbor.net escreveu: On May 11, 2011, at 12:52 AM, Bruno Cesar Moreira de Souza wrote: How would you block an ACK tunnel using only a packet filter? (http://ntsecurity.nu/papers/acktunneling/) You don't need to stop the httpd service to create

[Full-disclosure] NagiosXI (commerciale Nagios) Local Root

2011-05-12 Thread rootbsd
# Exploit Title: NagiosXI (Commercial Nagios) Local Root Vulnerability # Date: 2011-05-15 # Author: RootBSD # Software Link: http://www.nagios.com # Version: = 2011R1.2 # Tested on: all linux rootbsd@laptop:~$ id uid=1001(rootbsd) gid=1001(rootbsd) groupes=1001(rootbsd) rootbsd@laptop:~$ ls -l

Re: [Full-disclosure] This Afternoons Emails

2011-05-12 Thread Cal Leeming
i lol'd. On Thu, May 12, 2011 at 11:53 AM, Michael Simpson mikie.simp...@gmail.comwrote: On 8 May 2011 20:44, phocean 0...@phocean.net wrote: Now that N3td3v is back, the All-stars of FD are gathered one more time for a brain sucking discussion. Wait, I go take some pop-corn before what's

Re: [Full-disclosure] Sony: No firewall and no patches

2011-05-12 Thread Thor (Hammer of God)
Good morning, Mr. Pot!! :-p From: full-disclosure-boun...@lists.grok.org.uk [mailto:full-disclosure-boun...@lists.grok.org.uk] On Behalf Of Cal Leeming Sent: Wednesday, May 11, 2011 10:04 AM To: Dobbins, Roland Cc: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] Sony: No

[Full-disclosure] BackTrack 5 Released

2011-05-12 Thread Mati
Hi All, The BackTrack Dev team has worked furiously in the past months on BackTrack 5, code name “revolution”. We are proud to release our work to the public, and then rest for a couple of weeks. This new revision has been built from scratch, and boasts several major improvements over all

[Full-disclosure] CORE-2011-0204: Adobe Audition vulnerability processing malformed session file

2011-05-12 Thread CORE Security Technologies Advisories
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Core Security Technologies - Corelabs Advisory http://corelabs.coresecurity.com/ Adobe Audition vulnerability processing malformed session file 1. *Advisory Information* Title: Adobe Audition vulnerability processing malformed session

[Full-disclosure] [SECURITY] [DSA 2236-1] exim4 security update

2011-05-12 Thread Florian Weimer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2236-1 secur...@debian.org http://www.debian.org/security/Florian Weimer May 12, 2011

[Full-disclosure] [ MDVSA-2011:083 ] wireshark

2011-05-12 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2011:083 http://www.mandriva.com/security/

[Full-disclosure] Multiple Vendors libc/fnmatch(3) DoS (incl apache poc)

2011-05-12 Thread Maksymilian Arciemowicz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 [ Multiple Vendors libc/fnmatch(3) DoS (incl apache poc) ] Author: Maksymilian Arciemowicz http://netbsd.org/donations/ http://securityreason.com/ http://cxib.net/ Date: - - Dis.: 29.01.2011 - - Pub.: 13.05.2011 CVE: CVE-2011-0419 CWE: CWE-399