[Full-disclosure] Oracle Automated Service Manager 1.3 & Auto Service Request 4.3 local root during install

2013-01-31 Thread Larry W. Cashdollar
Oracle Automated Service Manager 1.3 local root during install Larry W. Cashdollar 1/29/2013 @_larry0 SUNWsasm-1.3.1-20110815093723 https://updates.oracle.com/Orion/Services/download?type=readme&aru=15864534 From the README: "Oracle

[Full-disclosure] [HITB-Announce] #HITB2013AMS FINAL CALL for Paper Submissions

2013-01-31 Thread Hafez Kamal
Hi everyone - This is the FINAL CALL for paper submissions for the 4th annual HITB Security Conference in Amsterdam, #HITB2013AMS. We're looking for talks that are highly technical, but most importantly, material which is new and cutting edge. Submissions are due BEFORE 8th Feb 23:59 CET HITB CFP

[Full-disclosure] Released: rompar - Semi-automation tool for data extraction of microscopic Masked ROM images

2013-01-31 Thread Major Malfunction
As promised at DC4420, here is the first cut (extremely beta!) of the image processing software for semi-automating the task of extracting data from images of Masked ROMs: http://www.aperturelabs.com/tools.html Fuller description/blog here: http://oamajormal.blogspot.co.uk/2013/01/fun-wi

[Full-disclosure] [CTF] nullcon HackIM CTF 2013 will start at 01-02-2013, when the clock will strike at 21:00 (+5:30 GMT)

2013-01-31 Thread nullcon
"Y2K was Survived...Mayan Apocalypse was Survived...And we are ready for Doomsday of Armageddon 2020... All new HACKIM-2013 is ready to help dust your Armour...and when you are through...you would say it - Yeah!!!Come to Papa..." "YOU...yes YOU...Think you survived The Mayan Apocalypse YOU..

[Full-disclosure] [Hacking Challenge] nullcon HackIM 2013 will start at 01-02-2013, when the clock will strike at 21:00 (+5:30 GMT)

2013-01-31 Thread nullcon
"Y2K was Survived...Mayan Apocalypse was Survived...And we are ready for Doomsday of Armageddon 2020... All new HACKIM-2013 is ready to help dust your Armour...and when you are through...you would say it - Yeah!!!Come to Papa..." "YOU...yes YOU...Think you survived The Mayan Apocalypse YOU..

[Full-disclosure] [PenTest-Announce] Phishing Attack with Social Engineering Toolkit (SET)

2013-01-31 Thread Maciej Kozuszek
A new issue of PenTest Regular has just been released. See what articles you will find inside: - Phishing Attack with Social Engineering Toolkit (SET) - Input Filter – Restrictions, Service Validation Evasion & Bypass Methods (Part#1) - Security of Enterprise Wireless Networks - Android as a Pen

Re: [Full-disclosure] What Intruder Detection System (IDS) or Network Security Monitor (NSM) do you use?

2013-01-31 Thread Rain Li
Hi, Dan, Have you tried Bro? FYI, http://www.bro-ids.org/. Regards On Mon, Jan 28, 2013 at 12:46 PM, Dan Ballance wrote: > Hi guys and girls, > > If anyone had 30 seconds to spare to make a recommendation I'd be very > appreciative. > > I have tried to us Prelude in the past, but last time I l

[Full-disclosure] DefenseCode Security Advisory: Broadcom UPnP Remote Preauth Root Code Execution Vulnerability

2013-01-31 Thread DefenseCode
DefenseCode Security Advisory http://www.defensecode.com/ Broadcom UPnP Remote Preauth Root Code Execution Vulnerability Advisory ID: DC-2013-01-003 Advisory Title: Broadcom UPnP Remote Preauth Root Code Execution Vulnerability Advisory URL: http://www.defensecode.com/subcategory/advisories-28

[Full-disclosure] Belkin Wemo 0day exploit (Remote shell + Rapid State change)

2013-01-31 Thread Daniel Cardenas
Discovered several UPnP vulnerabilites which allowed me to gain full shell access and modify the state of the device being controlled. Im in the process of disclosing to Belkin. PoC soon to come. Link to video below. http://youtu.be/BcW2q0aHOFo Belkin WeMo with latest firmware. Able to gain ful

[Full-disclosure] Belkin Wemo 0day exploit (remote shell + rapid state change)

2013-01-31 Thread Daniel Cardenas
Discovered several UPnP vulnerabilites which allowed me to gain full shell access and modify the state of the device being controlled. Im in the process of disclosing to Belkin. PoC soon to come. Link to video below. http://youtu.be/BcW2q0aHOFo Belkin WeMo with latest firmware. Able to gain ful

[Full-disclosure] [SECURITY] [DSA 2613-1] rails security update

2013-01-31 Thread Thijs Kinkhorst
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - Debian Security Advisory DSA-2613-1 secur...@debian.org http://www.debian.org/security/ Thijs Kinkhorst January 29, 2013

[Full-disclosure] Belkin WeMo Remote Shell and State Change 0day Exploit

2013-01-31 Thread Daniel Cardenas
Discovered several UPnP vulnerabilites which allowed me to gain full shell access and modify the state of the device being controlled. Im in the process of disclosing to Belkin. PoC soon to come. Link to video below. http://youtu.be/BcW2q0aHOFo Belkin WeMo with latest firmware. Able to gain ful