Re: [Full-disclosure] Kmail = 1.9.1 (table/frameset) DOS

2006-10-14 Thread Vidar Løkken
On Sat, 14 Oct 2006, nnp wrote: Background: Kmail is a HTML compatible email client that comes installed by default with the KDE desktop. This DOS requires HTML parsing to be enabled. This can be done in Kmail by going to Settings - Configure Kmail -Security - and tick Prefer HTML to Plain

Re: [Full-disclosure] Browzar Footprints

2006-09-04 Thread Vidar Løkken
On Sat, 2 Sep 2006, Colin Copley wrote: but leaves the last visited url in E:\Documents and Settings\-username-\LocalSettings\Temporary Internet Files\Content.IE5\index.dat However, they do claim in their FAQ that this is irrelevant, since you need sophisticated methods to read index.dat...

Re: [Full-disclosure] Re: Full-Disclosure Digest, Vol 17, Issue 31

2006-07-17 Thread Vidar Løkken
On Sun, 16 Jul 2006, Jhou Shalnevarkno wrote: I've come to the realisation that plain text can be entered to change the root password in Slackware Linux. It doesn't check for the original password.. Surely this isn't right, perhaps its my bit of confusion but I think that its a minor case of

Re: [Full-disclosure] Advisory from AMIT concern BANTOWNE

2006-06-30 Thread Vidar Løkken
On Fri, 30 Jun 2006, AMIT SECURITY wrote: i am sorry, did not realize cap key is turned on. will type off now. thanks you to n3td3v for farther information of bantowne. We did not mean that you can not use your shift key for normal capitalization... -- MVH, Vidar God doesn't play dice.

Re: [Full-disclosure] dns tunneling with win32 client / ProxyCommand

2006-06-20 Thread Vidar Løkken
On Wed, 21 Jun 2006, Paul Szabo wrote: Stefan Drexleri [EMAIL PROTECTED] wrote: [on UNIX] use command like this: ssh -o ProxyCommand=./droute.pl sshdns.server.example.com [EMAIL PROTECTED] this be accomplished on win32 system? PUTTY unfortunately doesn't have any ProxyCommand option ...

Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotaged hosts-file lookup

2006-04-14 Thread Vidar Løkken
On Fri, 14 Apr 2006, imipak wrote: Nick FitzGerald wrote: So, the exception is not that the IP is hard-coded, but that the DNS resolver skips looking in hosts for that _domain_ and necessarily does a network DNS lookup... Unless the DNS server is itself hardcoded in MediaPlayer, as well?

Re: [Full-disclosure] obtai an IP of an MSN Messenger contact

2006-04-05 Thread Vidar Løkken
On Wed, 5 Apr 2006, n3td3v wrote: If you want the IP of a user on Yahoo Messenger, all you do is add a user to your list with social engineering techniques, then you listen on port 5101 and send the victim a normal instant message. Yahoo compromises security in that way by attempting to