Re: [Full-Disclosure] Sasser author

2004-05-17 Thread list
Anders B Jansson wrote: [EMAIL PROTECTED] wrote: Anders B Jansson wrote: And stop this silly mumbling about Sasser being created as warning or heads up. That's your *interpretation*, not what I said. And this interpretation is *wrong*. No, it's not an interpretation, it caused havoc, that's a

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread [EMAIL PROTECTED]
Georgi Guninski wrote: On Sun, May 16, 2004 at 12:19:21PM -0700, [EMAIL PROTECTED] wrote: The MS operating systems are the main source of problems for really only 2 reasons: 1) their popularity makes them the most valuable targets i suggest you stop smoking bad stuff, it is illegal in bulgaria.

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread Ondrej Krajicek
I run anti-virus software on my servers... to sluff away the moronic Windows viruses that clog up my email account. Anti-virus monitors are a built-in performance drag on the OS. Microsoft says, hey, when we benchmark against samba, we're almost as fast, and this special case, we're faster.

RE: [Full-Disclosure] New therad: sasser, costs, support etcalltogether

2004-05-17 Thread Scott Forrest
Irregardless of blame in relation to Point #1, the matter is moot. If not for the holes in all Software there would be a lot less need for IT staff and network support - namely us. I applaud their attempts to get it right and am thrilled that they don't. Their mistakes provide more jobs than Bush

RE: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread Jos Osborne
Virus prevention solutions are useless when you have careless or undereducated users. I've seen a secretary who were told not to open attachments in e-mails in Outlook. When she got another tremendous birthday card from god-knows-who she obeyed, saved the attachment to the desktop and then opened

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread Valdis . Kletnieks
On Mon, 17 May 2004 13:33:44 +0200, Ondrej Krajicek [EMAIL PROTECTED] said: we're faster. Add on an the required anti-virus program monitoring packets in and out and watch your performance drop as that eliminates the whole concept behind DMA as now you have to route all data through the

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread Ondrej Krajicek
IMHO the data are routed through host CPU anyway, DMA is not as clever to locate the proper file in the proper filesystem on the proper volume and pass them to the proper network card. You're right that the=20 CPU does not have to process every single bit of each (?) file. But this could

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread Valdis . Kletnieks
On Mon, 17 May 2004 15:58:35 BST, Jos Osborne [EMAIL PROTECTED] said: Well, it's a start. Now you just have to teach them to Right-Click-Scan-for-viruses in the middle of that... Of course, the problem here is that if it got to our user's desktop via e-mail, it didn't get detected by the mail

[Full-Disclosure] RE: Still Vulnerable in MSIE

2004-05-17 Thread Kujawa, Greg
I don't see why this thread had to take a bitter personal turn, but anyway: O The only evidence I have to support my claim of being infected with some presumably unpatched vulnerabilities is the fact that I update my company's systems on a daily basis for antivirus definitions as well as

RE: [Full-Disclosure] New therad: sasser, costs, support etcalltogether

2004-05-17 Thread id3nt
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Uhmm, irregardless is not a word. The word is regardless. Irregardless of blame in relation to Point #1, the matter is moot. If not for the holes in all Software there would be a lot less need for IT staff and network support - namely us. I applaud

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread Valdis . Kletnieks
On Mon, 17 May 2004 17:29:04 +0200, Ondrej Krajicek [EMAIL PROTECTED] said: We are talking about on-line anti-virus scanning performance, which is decided mainly by the troughput of the I/O bus and CPU speed. SELinux is about mandatory access control. Exactly. (from another list about 2

[Full-Disclosure] OpenBSD procfs

2004-05-17 Thread Deprotect Advisories
--- Deprotect Security Advisory 20041405 --- Advisory ID : DEPROTECT-20041405 Authors : Christer Oberg, Joel Soderberg Publish date : 17/05/2004 Application

RE: [Full-Disclosure] New therad: sasser, costs, support etcalltogether

2004-05-17 Thread madsaxon
At 08:42 AM 5/17/2004 -0700, [EMAIL PROTECTED] wrote: Uhmm, irregardless is not a word. The word is regardless. Well, in fact, irregardless *is* an accepted word; it just has no justification for existence, like utilize. m5x ___ Full-Disclosure - We

[Full-Disclosure] Outlook 2003 listening on udp/3088

2004-05-17 Thread Ondrej Krajicek
Hello, I've just noticed (no, not by using tools which ship with Windows XP[1], thank you Bill), that Outlook 2003 binds to UDP port 3088 on all interfaces and listens. Quick Googling for it found no useful explanation. Does anyone know what is this good for? Another open port on my (and

RE: [Full-Disclosure] New therad: sasser, costs, support etcalltogether

2004-05-17 Thread Gary E. Miller
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Yo All! On Mon, 17 May 2004, Michael Gargiullo wrote: For years trying to explain this to people... Now if only I could convince my sister-in-law that she should not ax me a question about an idear she had... Sorta depends on which dictionary

RE: [Full-Disclosure] New therad: sasser, costs, support etcalltogether

2004-05-17 Thread Michael Gargiullo
On Mon, 2004-05-17 at 11:42, [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Uhmm, irregardless is not a word. The word is regardless. THANK YOU! For years trying to explain this to people... Now if only I could convince my sister-in-law that she should not ax me a

[Full-Disclosure] [waraxe-2004-SA#029 - Possible remote file inclusion in PhpNuke 6.x - 7.3]

2004-05-17 Thread Janek Vind
{} { [waraxe-2004-SA#029] } {} {

[Full-Disclosure] Buffer Overflow in ActivePerl ?

2004-05-17 Thread [EMAIL PROTECTED]
hi folks, i played around with ActiveState's ActivePerl for Win32, and crashed Perl.exe with the following command: perl -e $a=A x 256; system($a) I wonder if this bug isnt known?!? Because system() is a very common command Can anybody reproduce this? I put together a little advisory on my

Re: [Full-Disclosure] Outlook 2003 listening on udp/3088

2004-05-17 Thread Oliver Raymond
hey, the tools are inbuilt and do indeed ship with the product: netstat -ao works on a windows xp (not 2000) box will show pid. promise! -- Original Message -- From: Ondrej Krajicek [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] Date: Mon, 17 May 2004

Re: [Full-Disclosure] Outlook 2003 listening on udp/3088

2004-05-17 Thread insecure
Ondrej Krajicek wrote: Hello, I've just noticed (no, not by using tools which ship with Windows XP[1], thank you Bill), that Outlook 2003 binds to UDP port 3088 on all interfaces and listens. Quick Googling for it found no useful explanation. Does anyone know what is this good for? Another open

RE: [Full-Disclosure] New therad: sasser, costs, support etcalltogether

2004-05-17 Thread Ron DuFresne
On Mon, 17 May 2004, Michael Gargiullo wrote: On Mon, 2004-05-17 at 11:42, [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Uhmm, irregardless is not a word. The word is regardless. THANK YOU! For years trying to explain this to people... Now if only I could

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread Shane C. Hage
Bill, I agree with most of your statements below. However, with competing operating systems such as those you mentioned below plus OS/2 and Apple Macintosh in the 1980's, the business leaders and consumers chose Windows. I think people forget that Microsoft must have filled a gap that these

RE: [Full-Disclosure] Buffer Overflow in ActivePerl ?

2004-05-17 Thread [EMAIL PROTECTED]
hi folks, i played around with ActiveState's ActivePerl for Win32, and crashed Perl.exe with the following command: perl -e $a=A x 256; system($a) I wonder if this bug isnt known?!? Because system() is a very common command Can anybody reproduce this? I discovered this vulnerability

RE: [Full-Disclosure] New therad: sasser, costs, support etcalltogether

2004-05-17 Thread Michael Gargiullo
On Mon, 2004-05-17 at 16:18, Ron DuFresne wrote: On Mon, 17 May 2004, Michael Gargiullo wrote: On Mon, 2004-05-17 at 11:42, [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Uhmm, irregardless is not a word. The word is regardless. THANK YOU! For

[Full-Disclosure] ROCKET SCIENCE: Outllook 2003

2004-05-17 Thread [EMAIL PROTECTED]
Monday, May 17, 2004 Technical final step to 'silent delivery and installation of an executable on the target computer, no client input other than reading an email' this can be achieved with the highly touted 'secure-by-default' Outlook 2003 mail client from the craftsman known as

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread James Riden
Shane C. Hage [EMAIL PROTECTED] writes: When the Internet revolution started, there was no way to predict the magnitude that a malicious program could have across the world. We had proof of the effects that a malicious program could have in, what, 1988 ? Now it's 2004. -- James Riden /

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread Stormwalker
Hi Shane, A little correction in history: On Mon, 17 May 2004, Shane C. Hage wrote: I agree with most of your statements below. However, with competing operating systems such as those you mentioned below plus OS/2 and Apple Macintosh in the 1980's, the business leaders and consumers chose

[Full-Disclosure] MDKSA-2004:044 - Updated libuser packages fix vulnerability

2004-05-17 Thread Mandrake Linux Security Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandrakelinux Security Update Advisory ___ Package name: libuser Advisory ID:

[Full-Disclosure] Which XP svchost service listens on port 1025 ?

2004-05-17 Thread BillyBobKnob
On XP with a netstat -ano I see that svchost is listening on port 1025. Then running a tasklist -SVC I see which services are running under this particular svchost. I have tried disabling most of them and restarting the server service but port 1025 stays in listening state. Any ideas why XP is

[Full-Disclosure] MDKSA-2004:046 - Updated apache packages fix a number of vulnerabilities

2004-05-17 Thread Mandrake Linux Security Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandrakelinux Security Update Advisory ___ Package name: apache Advisory ID:

[Full-Disclosure] MDKSA-2004:045 - Updated passwd packages fix vulnerabilities

2004-05-17 Thread Mandrake Linux Security Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandrakelinux Security Update Advisory ___ Package name: passwd Advisory ID:

Re: [Full-Disclosure] Outlook 2003 listening on udp/3088

2004-05-17 Thread Richard Maudsley
udp packets can be fired at all ports in that range www.mindblock.org insecure [EMAIL PROTECTED] wrote: Ondrej Krajicek wrote: Hello, I've just noticed (no, not by using tools which ship with Windows XP[1], thank you Bill), that Outlook 2003 binds to UDP port 3088 on all interfaces and

Re: [Full-Disclosure] Buffer Overflow in ActivePerl ?

2004-05-17 Thread morning_wood
Can anybody reproduce this? Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\perl -e $a=A x 256; system($a) 'AAA

[Full-Disclosure] IRIX 6.5.24 rpc.mountd infinte loop

2004-05-17 Thread SGI Security Coordinator
-BEGIN PGP SIGNED MESSAGE- __ SGI Security Advisory Title: IRIX 6.5.24 rpc.mountd infinte loop Number: 20040503-01-P Date: May 17, 2004 Reference: SGI BUG

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread Valdis . Kletnieks
On Mon, 17 May 2004 16:27:28 EDT, Shane C. Hage [EMAIL PROTECTED] said: I think people forget that Microsoft must have filled a gap that these other operating systems didn't. How can we blame Microsoft for capitalizing on the need at the time? Yes, there was a market niche for monopolistic

[Full-Disclosure] Starting a Kick the Sasser Kid's Ass Fund

2004-05-17 Thread MacDougall, Shane
Send me money to go toward airfare and hotel for my upcoming trip to Europe. If I raise $5000 I commit to kicking the kid's head in, or at least landing one straight on his goolies. Paypal, whisky, or cash accepted. Shane ___ Full-Disclosure - We

Re: [Full-Disclosure] Buffer Overflow in ActivePerl ?

2004-05-17 Thread Troels Bay
Well, it dosen't do anything on my system (not sure if non-X86 systems are supposed to be affected...). Anyway, it just returns to the shell. System running: Apple MacOSX 10.3.4 [build 7H56] Chii:~ Tiger$ perl -e $a=A x 256; system($a) Chii:~ Tiger$ On May 18, 2004, at 00:44, morning_wood

Re: [Full-Disclosure] Starting a Kick the Sasser Kid's Ass Fund

2004-05-17 Thread Valdis . Kletnieks
On Mon, 17 May 2004 16:31:50 PDT, MacDougall, Shane [EMAIL PROTECTED] said: Send me money to go toward airfare and hotel for my upcoming trip to Europe. If I raise $5000 I commit to kicking the kid's head in, or at least landing one straight on his goolies. Hmm.. isn't that supposed to wait

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread Nick FitzGerald
Shane C. Hage to Bill Royds: I agree with most of your statements below. Well, actually, he was wrong if you consider the NT family of OSes starting in about 1993-4 (true, OOTB they were configured to be fully Win 3.x compatible -- that is, with all security disabled/dumbed down -- but the

RE: [Full-Disclosure] Starting a Kick the Sasser Kid's Ass Fund

2004-05-17 Thread Sean Crawford
Shane wrote Send me money to go toward airfare and hotel for my upcoming trip to Europe. If I raise $5000 I commit to kicking the kid's head in, or at least landing one straight on his goolies. Paypal, whisky, or cash accepted. A honourable fund indeed, may I suggest packing some

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread Valdis . Kletnieks
On Tue, 18 May 2004 12:39:46 +1200, Nick FitzGerald [EMAIL PROTECTED] said: Shane C. Hage to Bill Royds: I agree with most of your statements below. Well, actually, he was wrong if you consider the NT family of OSes starting in about 1993-4 (true, OOTB they were configured to be fully

[Full-Disclosure] Re: Buffer Overflow in ActivePerl ?

2004-05-17 Thread rich . sf
Reproduced with 5.6.1/win95. On Mon, 17 May 2004, [EMAIL PROTECTED] wrote: Date: Mon, 17 May 2004 22:23:56 +0200 From: [EMAIL PROTECTED] [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: Buffer Overflow in ActivePerl ? hi folks, i played around with ActiveState's

Re: [Full-Disclosure] OpenBSD procfs

2004-05-17 Thread Ted Unangst
On Mon, 17 May 2004, Deprotect Advisories wrote: just for the record. Disclosure Timeline: --- 03/05/2004: Initial email to vendor. 05/05/2004: Fix committed to cvs. I notified deprotect of the change at this time, and

RE: [Full-Disclosure] Support the Sasser-author fund started

2004-05-17 Thread Bill Royds
Microsoft built an OS for a desk-top stand alone computer that could run apps like a Word Processor and spreadsheet. This filled a very large niche for business and they did it very well, powerful enough to get things down, cheap enough to be affordable. But from NT on, they have tried to extend

Re: [Full-Disclosure] Re: Support the Sasser-author fund started

2004-05-17 Thread John Galt
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, 16 May 2004, Kurt Seifried wrote: oh my god, cant we stop this bloody topic finally? It used to be a really good mailing list but it turns out that soon I have to put in my SPAM list. You can subscribe to a moderated subset of this