Re: [Full-Disclosure] Apache 1.3.29

2004-03-12 Thread worldi
\x80j\x01\x03\x01 but how can j be in there is what i dont get *shrug* hint: the ascii-value for j is 0x6a. since j is a valid letter there is no need to write it in hex. see google.com and intel.com for further information about this issue ... ;) - w. -- mailto:[EMAIL PROTECTED] -=[

Re: [Full-Disclosure] MS Security Response is a bunch of half-witted morons

2004-03-12 Thread Nicob
On Fri, 2004-03-12 at 01:57, Nick FitzGerald wrote: Try to read Microsoft's latest security epistles: http://www.microsoft.com/technet/security/bulletin/ms04-009.mspx http://www.microsoft.com/technet/security/bulletin/ms04-010.mspx with a browser that does not have JavaScript

[Full-Disclosure] Dogpatch Software CFWebstore 5.0 shopping cart software multiple security vulnerabilities

2004-03-12 Thread S-Quadra Security Research
S-Quadra Advisory #2004-03-12 Topic: Dogpatch Software CFWebstore 5.0 shopping cart software multiple security vulnerabilities Severity: High Vendor URL: http://www.cfwebstore.com Advisory URL: http://www.s-quadra.com/advisories/Adv-20040312.txt Release date: 12 Mar 2004 1. DESCRIPTION

[Full-Disclosure] [SECURITY] [DSA 462-1] New xitalk packages fix local group utmp exploit

2004-03-12 Thread debian-security-announce
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 462-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze March 12th, 2004

[Full-Disclosure] PLAXO: is that a cure or a disease?

2004-03-12 Thread [EMAIL PROTECTED]
Friday, March 12, 2004 Having a firm belief in unnecessary gadgetry, we recently sent our most senior colleague Liu Die Yu a request to update his contact information via our plaxo device [http://www.plaxo.com/]. Checking back several hours later in our plaxo web account we eagerly selected

[Full-Disclosure] grsecurity PRODUCT

2004-03-12 Thread bbrown
Dear List, Drunken junkie brad spengler has triumphantly released 2.6 version of his revolutionary backdoored kernel patch grsecurity PRODUCT. We are talking next generation here, among the added features: Tab completion 3d games support IRC client support GAIM support Experimental

[Full-Disclosure] [OpenPKG-SA-2004.006] OpenPKG Security Advisory (uudeview)

2004-03-12 Thread OpenPKG
:no Affected Releases: Affected Packages: Corrected Packages: OpenPKG CURRENT = uudeview-0.5.20-20040302 = uudeview-0.5.20-20040312 OpenPKG 2.0 = uudeview-0.5.19-2.0.0= uudeview-0.5.19-2.0.1 OpenPKG 1.3 = uudeview-0.5.18-1.3.0= uudeview-0.5.18-1.3.1 Dependent

RE: [Full-Disclosure] Caching a sniffer

2004-03-12 Thread Justin Baldini
It would probably be better to build it at the switch level. I would think there would be a change in resistance when there is ANYTHING added/removed from the cabling that could be measured by the switch. You could then have it disable that segment upon such detection if you'd like. -jb

Re: [Full-Disclosure] Apache 1.3.29

2004-03-12 Thread bart2k
On Thu, 11 Mar 2004 12:38:02 -0800 VeNoMouS [EMAIL PROTECTED] wrote: any one know if theres a new exploit for apache 1.3.29 in the wild one of my mates boxes was breached this morning by ir4dex appears they gained axx via apache then got root via mmap() Only one I have seen is for Apache for

[Full-Disclosure] Re: MS Security Response is a bunch of half-witted morons

2004-03-12 Thread [EMAIL PROTECTED]
Even worse ! Convinced we could out-wit Nick FitzGerald ;-) we see with glee tucked away at the bottom of the page: View a printer-friendly version of this page PRESTO ! Away we go. Only to find that 3 colorful pages later, our trusty printer churns pictures of the [x]technical details

[Full-Disclosure] Cpanel Vulnerability

2004-03-12 Thread RK Davies
http://www.securityfocus.com/archive/1/357064/2004-03-08/2004-03-14/2 http://forums.cpanel.net/showthread.php?s=threadid=21456 RK Davies Textbox Networks http://www.textbox.net ** This post is encrypted in the english language

[Full-Disclosure] Book of unreleased exploits?

2004-03-12 Thread david cohen
Coworker of mine took a class taught by one of the authors of this book: http://www.wiley.com/WileyCDA/WileyTitle/productCd-0764544683.html Coworker is telling me this is some sort of compendium of unreleased exploits. Figuring that the average exploit would take up about 5 pages of printed

Re: [Full-Disclosure] Re: MS Security Response is a bunch of half-witted morons

2004-03-12 Thread Troy
On Fri, 12 Mar 2004 16:09:21 -0500, [EMAIL PROTECTED] wrote: Your points are well taken and understandable. But if you are supporting a M$ operating system enough to need to read the SB's, then wouldnt your IE be up to date to read them? Even if you would just use IE to read M$'s site?

Re: [Full-Disclosure] Book of unreleased exploits?

2004-03-12 Thread Person
Anyone know for sure? I've never heard of any of these guys, but one of these jokers has to be on this mailing list. You've never heard of David Litchfield, Dave Aitel or Riley Hassell? You need to hit the bars at Blackhat instead of the talks meng. [d]

Re: [Full-Disclosure] Book of unreleased exploits?

2004-03-12 Thread madsaxon
At 02:46 PM 3/12/2004 -0800, david cohen wrote: I've never heard of any of these guys, but one of these jokers has to be on this mailing list. You're kidding, right? You've never heard of David Litchfield or Dave Aitel? Check the archives, or google them. m5x

Re: [Full-Disclosure] Book of unreleased exploits?

2004-03-12 Thread c0hiba
here is something i found on dave aitel using that google search engine thing.. http://groups.google.com/groups?q=birth+of+a+gay+sluthl=enlr=ie=UTF-8oe=UTF-8selm=544eli%249704151525%40qz.little-neck.ny.usrnum=1 --c0hiba On Fri, 12 Mar 2004, madsaxon wrote: At 02:46 PM 3/12/2004 -0800, david

Re: [Full-Disclosure] Book of unreleased exploits?

2004-03-12 Thread Ron DuFresne
To save folks the time and effort; The Shellcoder's Handbook: Discovering and Exploiting Security Holes Jack Koziol, David Litchfield, Dave Aitel, Chris Anley, Sinan noir Eren, Neel Mehta, Riley Hassell ISBN: 0-7645-4468-3 Paperback 648 pages March 22, 2004 * Examines

Re: [Full-Disclosure] Book of unreleased exploits?

2004-03-12 Thread Cael Abal
c0hiba wrote: here is something i found on dave aitel using that google search engine thing.. http://groups.google.com/groups?q=birth+of+a+gay+sluthl=enlr=ie=UTF-8oe=UTF-8selm=544eli%249704151525%40qz.little-neck.ny.usrnum=1 --c0hiba Interesting, you posted this same link to FD four

[Full-Disclosure] Computer IP

2004-03-12 Thread Farrukh Hussain
Hey, Can anybody tell me how to change computer IP through DOS ? i am using windowsXP. please tell me its command thanks. Best Regards, Farrukh Hussain. ___ Full-Disclosure - We believe in it. Charter:

[Full-Disclosure] Re: MS Security Response is a bunch of half-witted morons

2004-03-12 Thread flurdoing
They think we are morons too!! Just in case you don't know how to read and have somehow found yourself working on security with MS products, you can listen to a CISSP (they are trained and certified readers) read the security bulletins to you as well as promote whatever crap they feel like

Re: [Full-Disclosure] Computer IP

2004-03-12 Thread Geoincidents
Can anybody tell me how to change computer IP through DOS ? i am using windowsXP. please tell me its command thanks. http://www.nthelp.com/w2k3/to_add_a_bunch_of_ip_addresses.htm Geo. ___ Full-Disclosure - We believe in it. Charter:

Re: [Full-Disclosure] Computer IP

2004-03-12 Thread Shawn Cox
ipconfig cannot be used to change an ip. RTFQ d00d. Farrukh, Try googling for (change ip command line windows xp) Or explore the netsh command. --S - Original Message - From: Christopher Downs [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Sent: Friday, March 12,

Re: [Full-Disclosure] Computer IP

2004-03-12 Thread John Paul
Hi its John, Here are the commands to change computer IP through DOS . Go to command Prompt and type netsh interface ip set address local static 10.0.0.1 255.0.0.0 Thts it. Farrukh Hussain [EMAIL PROTECTED] wrote: Hey,Can anybody tell me how to change computer IP through DOS ? i am using

Re: [Full-Disclosure] Re: MS Security Response is a bunch of half-witted morons

2004-03-12 Thread Mike Barushok
On Fri, 12 Mar 2004, Troy wrote: On Fri, 12 Mar 2004 16:09:21 -0500, [EMAIL PROTECTED] wrote: Your points are well taken and understandable. But if you are supporting a M$ operating system enough to need to read the SB's, then wouldnt your IE be up to date to read them? Even if

Re: [Full-Disclosure] Computer IP

2004-03-12 Thread Farrukh Hussain
Hi, Thanks it works :) . And the reason was, i was learning DOS :) thats why i asked :) bye bye ta ta . and thanks again. John Paul [EMAIL PROTECTED] wrote: Hi its John, Here are the commands to change computer IP through DOS . Go to command Prompt and type netsh interface

[Full-Disclosure] Re: MS Security Response is a bunch of half-witted morons

2004-03-12 Thread Walter Wart
On Fri, 2004-03-12 at 05:57, Nick FitzGerald wrote: Try to read Microsoft's latest security epistles: http://www.microsoft.com/technet/security/bulletin/ms04-009.mspx http://www.microsoft.com/technet/security/bulletin/ms04-010.mspx with a browser that does not have JavaScript

[Full-Disclosure] Re: MS Security Response is a bunch of half-witted morons

2004-03-12 Thread Charles J. Wertz
MS is not alone. More and more web sites don't work without scripting and/or cookies. I guess cookies are a lesser evil. I'm constantly faced with the decision whether or not a particular content means enough to me that I'll turn on the script. In fact, I now run two browsers, Mozilla with

[Full-Disclosure] Re: MS Security Response is a bunch of half-witted morons

2004-03-12 Thread jim_walsh
Your points are well taken and understandable. But if you are supporting a M$ operating system enough to need to read the SB's, then wouldnt your IE be up to date to read them? Even if you would just use IE to read M$'s site? To sit and scream about web design decisions in this mailing group

[Full-Disclosure] Re: MS Security Response is a bunch of half-witted morons

2004-03-12 Thread Nick FitzGerald
[EMAIL PROTECTED] to me: Nothing personal against Jim in particular here -- I've received a couple of direct Email responses that suggest a few others may also have had trouble grasping the _irony_ I was pointing out... That dealt with, I'll now address the peripheral security issues Jim