Re: [Full-disclosure] AN OUNCE OF PREVENTION...

2007-04-10 Thread Graham Reed
[EMAIL PROTECTED] writes: > [broken Mac OS X system] > If you screw up the system (like I did), then you have few options. > Knoppix cannot write to the HFS journaling file system (the default > OS X install) so you cannot undo the mistake via a Linux system. > While, I did find a few solutions tha

Re: [Full-disclosure] Solaris telnet vulnerability - how many on your network?

2007-02-13 Thread Graham Reed
[EMAIL PROTECTED] writes: > Of course disabling in.telnetd in /etc/inetd.conf (and doing a pkill -HUP > inetd) if possible is a safe bet, Or, going with Solaris 10's 'SMF' thing: % svcadm disable svc:/network/telnet And, while you're at it, % svcadm disable svc:/network/shell:default % svca

Re: [Full-disclosure] Solaris telnet vulnberability - how many on your network?

2007-02-12 Thread Graham Reed
Vincent Archer writes: > We do, and we confirm. The info is spreading like wildfire, and justifiably > so - I thought this bug category (-fuser) was squashed last with AIX over > 10 years ago. Everybody with the BSD tools had this bug 10-12 years ago; AIX stood out because there was some guy at I

Re: [Full-disclosure] Phishers now abusing dynamic DNS services

2005-12-12 Thread Graham Reed
pagvac writes: What I mean is that the average user will trust more an URL when seeing the word "paypal" in it as a domain name, rather than some dodgy-looking numerical IP address, with a sub-directory called "paypal". Most users won't even see or notice where the link goes, that's why it wor

Re: [Full-disclosure] Bug with .php extension?

2005-12-06 Thread Graham Reed
Christopher Kunz writes: Well, actually, I think this is some kind of "feature" and is associated with the behavior that is i.e. demonstrated on default installations of Apache (which have several index.html index.html.de .en .jp etc.), only that this time not mod_negotiation, but mod_mime is r

Re: [Full-disclosure] bash vulnerability?

2005-08-16 Thread Graham Reed
Rik Bobbaers writes: so ctrl-c is just a SIGINT... you can make the program ignore that signal, i don't want to start doing that in asm (because its just a poc) but just change the pointer to the signal handler to rewrite the pointer to a return statement or something... Set SIGINT's sa_han

Re: [Full-disclosure] Gmail blacklisted by Full-Disclosure

2005-06-20 Thread Graham Reed
[EMAIL PROTECTED] writes: OK.. apparently a miscue - they're listed in the wrong zone - this should be for the postmaster zone not the DSN zone. They're in postmaster as well, with the same evidence. There is however a requirement that if they *emit* mail that claims an origin of @zproxy.gm

Re: [Full-disclosure] Gmail blacklisted by Full-Disclosure

2005-06-20 Thread Graham Reed
[EMAIL PROTECTED] writes: Complain to GMail - it's saying that a 'MAIL FROM:<>' is invalid, when in fact its the *mandatory* way of sending bounce messages. RFC2821, section 6.1: That may be what the error message from the blacklist claims to say, but that's not what the "evidence" provided

Re: [Full-disclosure] Second-Order Symlink Vulnerabilities

2005-06-07 Thread Graham Reed
[EMAIL PROTECTED] writes: For everybuddy, we have: 258 g_snprintf(buf, 2048, "rm /tmp/.eb.%s.translator -f ; wget -O \ /tmp/.eb.%s.translator \ 'http://world.altavista.com/sites/gben/pos/babelfish/tr?tt=urltext&lp=%s_%s&urltext=%s'", 259 getenv("USER"), getenv("USER"), from, t

Re: [Full-disclosure] Mac OSX 10.4 Dashboard Authentication Hijacking Vulnerability

2005-05-19 Thread Graham Reed
Jonathan Zdziarski writes: But then isnt this an issue with Sudo's grace period (ie should it be tied down to that terminal process calling it and not other ones?) I suspect that since the dash runs as the user, it's sharing the same tty somehow. It seems to work regardless of where I authentic

Re: [Full-disclosure] Memory leak in DB2 sqlcctcpgetbuffer process, vulnerability or not?

2005-05-09 Thread Graham Reed
Henk van de Tillaerdt writes: Sun released an alert about a memory leak in the sqlcctcpgetbuffer process of DB2: I'm wondering, is this a vulnerability or not? Can't answer your other questions, but memory leaks lead to exhausted memory which gives you a denial-of-service attack.

Re: [Full-disclosure] Phun With Apache

2005-04-11 Thread Graham Reed
On Apr 1, 2005, at 4:19 AM, [EMAIL PROTECTED] wrote: ## Apache follows symbolic links referenced by public_html! ## Even when SymLinksifOwnerMatch is set and FollowSymLinks is not! ## A super-easy way to gain read access on files owned by the apache user! It's not (only) a mod_userdir problem. I f