Re: [Full-disclosure] [SECURITY] [DSA 2200-1] nss security update

2011-09-05 Thread Henri Salo
On Fri, Sep 02, 2011 at 11:03:17AM +0200, Dimitry Andric wrote: On 2011-08-31 20:37, Packet Storm wrote: Is this supposed to be DSA-2201-1 and not DSA-2200-1? DSA-2200-1 already exists as an Iceweasel advisory.. You would really expect DSA-2299 to be followed by DSA-2300, but apparently

Re: [Full-disclosure] Cybsec Advisory 2011 0901 Windows Script Host DLL Hijacking

2011-09-05 Thread Mario Vilas
Paul, Those file extensions correspond to scripts. If a file contains a script that runs when the file is double clicked, and the scripting engine is not sandboxed (meaning the script can do the same things an executable file can do) then the attack is meaningless. You can simply have the script

[Full-disclosure] [ MDVSA-2011:131 ] libxml

2011-09-05 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2011:131 http://www.mandriva.com/security/

Re: [Full-disclosure] XSS Vulnerability in www.emerson.com

2011-09-05 Thread Mr. Hinky Dink
That... ahem... particular company has had that particular page (/MCS/email.apsx) in one form or another for a long time, since the late 90s at least, when it was a cgi app. IIRC, at one time you could SPAM anyone through it, but they learned their lesson and now you can only SPAM the

Re: [Full-disclosure] XSS Vulnerability in www.emerson.com

2011-09-05 Thread Madhur Ahuja
The URL is publically visible in address bar if you open the site on Chrome. Not sure how are you categorizing it as no one knows the url Try the Email this Article link on the page below:

Re: [Full-disclosure] XSS Vulnerability in www.emerson.com

2011-09-05 Thread Valdis . Kletnieks
On Mon, 05 Sep 2011 09:46:23 EDT, Mr. Hinky Dink said: I'm guessing you're a contractor for that particular company because, after all, no one knows the URL. Google is a subcontractor for them? :) (It's *amazing* how many sites rely on nobody knows the URL, but the URL in question is known to

[Full-disclosure] [Announcement] ClubHack Mag Issue 20- September 2011 Released

2011-09-05 Thread Abhijeet Patil
Hello Readers, here we are with issue20 of ClubHack Mag for the month of September 2011. This time the theme is Malwares. This issue covers following articles:- 0x00 Tech Gyan - Rootkits are Back with the Boot Infection 0x01 Tool Gyan - Tools for Reverse Engineering and Malware Analysis 0x02

Re: [Full-disclosure] Cybsec Advisory 2011 0901 Windows Script Host DLL Hijacking

2011-09-05 Thread Georgi Guninski
lol, the japanese ddosed their children and the official version is they tried to entertain them. the official version appears as fuzzing while not knowing doing so. -- joro On Sun, Sep 04, 2011 at 05:34:00PM +, Thor (Hammer of God) wrote: Something like Pokemon malware would be awesome:

Re: [Full-disclosure] Cybsec Advisory 2011 0901 Windows Script Host DLL Hijacking

2011-09-05 Thread root
I agree, in some remote scenario this may work, but doesn't justify an advisory. Off-topic: First Insect PRO, and now this? What's happening fellow Latin-americans? our standards are falling. Please behave, this is the Internet! On 09/05/2011 07:33 AM, Mario Vilas wrote: Paul, Those

Re: [Full-disclosure] Cybsec Advisory 2011 0901 Windows Script Host DLL Hijacking

2011-09-05 Thread Thor (Hammer of God)
Excellent points - one slight addition, though: In fact, the Windows Script Host software is mostly used to write system maintenance scripts, so it's obvious its scripts can't be restricted or they'd be useless. Scripts can certainly be restricted based on the account context they are

Re: [Full-disclosure] Cybsec Advisory 2011 0901 Windows Script Host DLL Hijacking

2011-09-05 Thread Mario Vilas
On Mon, Sep 5, 2011 at 7:45 PM, root ro...@fibertel.com.ar wrote: Off-topic: First Insect PRO, and now this? What's happening fellow Latin-americans? our standards are falling. Please behave, this is the Internet! [image: The_Internet_is_Serious_Business - Low.jpg] -- “There's a reason