[Full-disclosure] Remove all admin-root authorization prompts from OSX

http://www.petitiononline.com/31337OSX/petition.html -KF ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] SERIOUS PROBLEM WITH MACOS V+V HAHAHA

Awe... someones mad that their penis isn't even half black. I get 2 extra inches of cock for being 1/2 black. The usual 3 inches did not apply for me since I am not totally black. Go look up the word Sarcasm before you sign the petition... in fact here is a link for ya.

Re: [Full-disclosure] SERIOUS PROBLEM WITH MACOS V+V HAHAHA

btw... nice pussy ass hushmail account. -KF ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] SERIOUS PROBLEM WITH MACOS V+V HAHAHA

Sure... I was aware of an opening and inquired about it as I was trying to offload the Veritas bug perhaps? I am pretty sure I never directly applied for it or even took an interview for it. In reality I was not willing to relocate thus the position was not even an after thought. hrmm how

Re: [Full-disclosure] Grab a myspace credential

http://www.ninjahype.org/mov/ nameHREFTrack -KF wac wrote: On 1/16/07, *Deepan* [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote: On Mon, 2007-01-15 at 23:05 -0500, Peter Dawson wrote: but at some point all this abuse will likely start sending users off to another

Re: [Full-disclosure] iDefense Q-1 2007 Challenge

[EMAIL PROTECTED] wrote: I agree with you KF , that's why I do not recommand iDEFENSE in my forum's footer since some times now. They are just playing on the fact they are alone , or they were alone for a long time on this market, and they do not wish to do any effort, making loads of

Re: [Full-disclosure] iDefense Q-1 2007 Challenge

No offense to iDefense as I have used their services in the past... but MY Q1 2007 Challenge to YOU is to start offering your researchers more money in general! I've sold remotely exploitable bugs in random 3rd party products for more $$ than you are offering for these Vista items (see the

[Full-disclosure] DMA[2007-0107a] OmniWeb Javascript Alert Format String Vulnerabiity and DMA[2007-0109a] Apple Finder Disk Image Volume Label Overflow / DoS

I've been subject to a few DoS attacks as of late so these did not quite make it out. Enjoy the typos as usual. =P -KF DMA[2007-0109a] - 'Apple Finder Disk Image Volume Label Overflow / DoS' Author: Kevin Finisterre Vendor(s): http://www.apple.com Product: '= OSX 10.4 (?)' References:

[Full-disclosure] Flaaaaaaaaaaaaaaaaavor Flav! (todays MOAB)

http://projects.info-pull.com/moab/MOAB-05-01-2007.html ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] DMA[2007-0104a] - 'iLife iPhoto Photocasing Format String Vulnerability'

DMA[2007-0104a] - 'iLife iPhoto Photocasing Format String Vulnerability' Author: Kevin Finisterre Vendor(s): http://www.apple.com Product: 'iLife 06 (?)' References: http://www.digitalmunition.com/DMA[2007-0104a].txt http://www.apple.com/ilife/iphoto/features/photocasting.html

Re: [Full-disclosure] Perforce client: security hole by design

Sometimes, the track record is only good because nobody looked into it. Nice quote... -KF ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Whos Johny Pwnerseed?

You may still be scratching your head from yesterday... don't forget about today and tomorrow: http://projects.info-pull.com/moab/MOAB-02-01-2007.html -KF ___ Full-Disclosure - We believe in it. Charter:

[Full-disclosure] Welcome to Pwndertino...

Just in case you are drunk / hungover / out of town or whatever... this is a friendly reminder that MOAB has begun. http://projects.info-pull.com/moab/index.html -KF ___ Full-Disclosure - We believe in it. Charter:

Re: [Full-disclosure] Sacure Enterprise Security - Real Company!

Sheesh... funny that this chump said he was in with the individual that single handedly started the HP / DMCA fiasco. Since that person is most likely ME (or a former employee of mine) and I have never heard of this guy I got a good belly laugh out of this. So Jeff... do me a favor buddy...

Re: [Full-disclosure] Sasser or other nasty worm needed

a douchebag? I dunno but why the hell aren't your boxes patched to Sasser yet? -KF deep fried wrote: What am I Consultant? School Teacher? Terrorist? On 11/27/06, *K F (lists)* [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote: Dude... settle the hell down. I

[Full-disclosure] Kerio WebSTAR local privilege escalation

DMA[2006-1115a] - 'Kerio WebSTAR local privilege escalation' Author: Kevin Finisterre Vendor(s): http://www.kerio.com/webstar_home.html Product: 'Kerio WebSTAR = 5.4.2 (?)' References: http://www.digitalmunition.com/DMA[2006-1115a].txt Description: Kerio WebSTAR is an easy-to-use web server

[Full-disclosure] DMA[2006-1031a] - 'Intego VirusBarrier X4 definition bypass exploit'

This was supposed to go out on Halloween but it didn't... but either way all you Mac users can get scared or something. OOGA BOOGA! pwntego.tar.gz Description: GNU Zip compressed data DMA[2006-1031a] - 'Intego VirusBarrier X4 definition bypass exploit' Author: Kevin Finisterre Vendor(s):

[Full-disclosure] OpenBase SQL multiple vulnerabilities Part Deux

DMA[2006-1107a] - 'OpenBase SQL multiple vulnerabilities Part Deux' Author: Kevin Finisterre Vendor(s): http://www.openbase.com Product: 'OpenBase SQL =10.0 (?)' References: http://www.digitalmunition.com/DMA[2006-1107a].txt Description: (regurgitation warning - this may taste VERY familiar)

[Full-disclosure] Machoman / Macarena virus for OSX

Since most of the reporting out on OSX.Macerena is fairly minimal I thought I would point everyone to the original tutorial and PoC code by Roy G Biv of 29A incase you missed it. http://vx.netlux.org/lib/vrg01.html -KF ___ Full-Disclosure - We

[Full-disclosure] hack.lu Bluetooth demo

As requested by several of the folks that went to hack.lu - 2006 I have posted the code for the 'GenerationTwo' InqTana variant at http://www.digitalmunition.com/hacklu.html For those that missed it Thierry Zoller of nruns demonstrated a remote exploitation of CVE-2005-1333 as a means to

Re: [Full-disclosure] HP Tru64 dtmail bug - Really exploitable?

Where were the politics? I was simply stating the facts. -KF Politics should be avoided at all costs. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia -

Re: [Full-disclosure] NETRAGARD-20060624 SECURITY ADVISORY] [ROXIO TOAST 7 TITANIUM - LOCAL ROOT COMPROMISE ]

Propaganda Support wrote: On Aug 22, 2006, at 3:22 PM, K F wrote: the admin users on OS X can NOT become root at any time. Yes, they can. Um NO they can't. ANY is a pretty strong word. The admin user must first know the admin password before becomming root. Obviously. An admin user

[Full-disclosure] DMA[2006-0801a] - 'Apple OSX fetchmail buffer overflow'

DMA[2006-0801a] - 'Apple OSX fetchmail buffer overflow' Author: Kevin Finisterre Vendor: http://www.apple.com/ Product: 'Mac OSX =10.4.7' References: http://www.digitalmunition.com/DMA[2006-0801a].txt http://www.digitalmunition.com/getpwnedmail-x86.pl

Re: [Full-disclosure] Roxio Contact

You may try requesting to speak to someone from the Software Development / Engineering team... I am sure you already know about going round and round in an organization looking for a contact. -KF Simon Smith wrote: Does anyone have any contact information for Roxio? I called their technical

Re: [Full-disclosure] DMA[2006-0628a] - 'Apple OSX launchd unformatted syslog() vulnerability'

Just so no one feels left out... -KF #!/usr/bin/perl # # http://www.digitalmunition.com/FailureToLaunch-ppc.pl # Code by Kevin Finisterre kf_lists[at]digitalmunition[dot]com # # Much appreciation goes to John H for all kindsa random shit like exploiting Veritas and other random things in the

[Full-disclosure] DMA[2006-0628a] - 'Apple OSX launchd unformatted syslog() vulnerability'

You couldn't be more wrong if you called it a Canadian Goose! -KF #!/usr/bin/perl # http://www.digitalmunition.com/FailureToLaunch.pl # Code by Kevin Finisterre kf_lists[at]digitalmunition[dot]com # # This is a practical application of Non Executable Stack Lovin -