Re: [Full-Disclosure] client - server

2005-02-28 Thread Gautam R. Singh
Most likely they might have blocked the entire pool of IP belonging to your ISP try to visit the website with a proxy server On Sun, 27 Feb 2005 21:29:18 -0500, Eric Windisch [EMAIL PROTECTED] wrote: On Mon, 2005-02-28 at 02:43 +0100, Matteo Giannone wrote: - a simple ip check doesn't work

[Full-Disclosure] [HAT-SQUAD] BadBlue, Easy P2P File Sharing Remote Exploit (update)

2005-02-28 Thread class 101
(reposting again with the hole history) Andres Tarasco of sia.es has published yesterday a security hole affecting BadBlue 2.5 and below. http://seclists.org/lists/fulldisclosure/2005/Feb/0704.html Hat-Squad.com brought you a fresh exploit. The exploit and BadBlue v2.5 are both available at

[Full-Disclosure] [USN-86-1] cURL vulnerability

2005-02-28 Thread Martin Pitt
=== Ubuntu Security Notice USN-86-1 February 28, 2005 curl vulnerability CAN-2005-0940 === A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog)

[Full-Disclosure] [USN-87-1] Cyrus IMAP server vulnerability

2005-02-28 Thread Martin Pitt
=== Ubuntu Security Notice USN-87-1 February 28, 2005 cyrus21-imapd vulnerability CAN-2005-0546 === A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty

[Full-Disclosure] [USN-88-1] reportbug information disclosure

2005-02-28 Thread Martin Pitt
=== Ubuntu Security Notice USN-88-1 February 28, 2005 reportbug information disclosure https://bugzilla.ubuntulinux.org/6600 https://bugzilla.ubuntulinux.org/6717 === A

[Full-Disclosure] [TURBOLINUX SECURITY INFO] 28/Feb/2005

2005-02-28 Thread Turbolinux
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 This is an announcement only email list for the x86 architecture. Turbolinux Security Announcement 28/Feb/2005 The following

Re: [Full-Disclosure] [HAT-SQUAD] BadBlue, Easy P2P File Sharing Remote Exploit (update)

2005-02-28 Thread class 101
Title: RE: [Full-Disclosure] [HAT-SQUAD] BadBlue, Easy P2P File Sharing Remote Exploit (update) next time then publish both in same time because coded or not because of timeline , the exploit has been brought in first by hat-squad, sorry ;

Re: Fw: [Full-Disclosure] Google Search and Gmail Correlation(ev gpsc verify reciept please)

2005-02-28 Thread David Chastain
Is anyone a part of Orkut or know someone who is? On Saturday, February 26, 2005, at 03:17PM, Ankush Kapoor [EMAIL PROTECTED] wrote: Combine Google's search capabilities with Orkut, and suddenly they know so much about so many people and how they are related. Connect keyhole to that which they

RE: [lists] RE: [Full-Disclosure] Awake a modem with AT commands

2005-02-28 Thread Bart . Lansing
[EMAIL PROTECTED] wrote on 02/26/2005 07:43:02 AM: Syed Imran Ali wrote: I don't know if you specifically asked for DSL or Cable modems or what you exactly wanna do with it. As far as AT commands are your concerns, I think most of the ppl on the list can help you out. Btw,

[Full-Disclosure] Re: Full-Disclosure Digest, Vol 3, Issue 52

2005-02-28 Thread Wiggert de Haan
L.S., Van 28 februari tot en met 4 maart ben ik afwezig. Uw mail mail is aangekomen en zal beantwoord worden vanaf 7 maart. Voor spoedeisende zaken kunt u terecht bij Gijs van Blokland. [EMAIL PROTECTED] / 020-5304323 Wiggert de Haan ISIZ BV ___

[Full-Disclosure] [USN-89-1] XML library vulnerabilities

2005-02-28 Thread Martin Pitt
=== Ubuntu Security Notice USN-89-1 February 28, 2005 libxml vulnerabilities CAN-2004-0989 === A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty

[Full-Disclosure] Possible XSS issue on Windows XPSP2 IE6 via MIME Encapsulation of Aggregate HTML

2005-02-28 Thread bitlance winter
Hi, LIST. subject: Possible XSS issue on Windows XPSP2 IE6 via MIME Encapsulation of Aggregate HTML Documents NOTE: This bug had been provided by an unknown person on his site. This bug is widely known in Japan since August, 2004. (These news was reported.)

Re: [Full-Disclosure] Xfree86 video buffering?

2005-02-28 Thread William Waisse
Le Mercredi 23 Février 2005 23:20, defiance a écrit : Seriously though, I think this has to do with stuff getting left in the video memory. I don't think X flushes it properly. I already saw this problem switching from ctrl+alt+F7 to ctrl+alt+F8 from a F7 root X session to a F8 user X

[Full-Disclosure] Safe Run As

2005-02-28 Thread offtopic
Safe Run As - keylogger protection This tool is created to protect administrative passwords against keyloggers. Administrator's passwords are stored in the AES encrypted file on the removalable storage (flash-drive, floppy). Then you need to use run as command you launch saferunas.hta, and

[Full-Disclosure] iDEFENSE Security Advisory 02.28.05: Mozilla Firefox and Mozilla Browser Out Of Memory Heap Corruption Design Error

2005-02-28 Thread idlabs-advisories
Mozilla Firefox and Mozilla Browser Out Of Memory Heap Corruption Design Error iDEFENSE Security Advisory 02.28.05 www.idefense.com/application/poi/display?id=200type=vulnerabilities February 28, 2005 I. BACKGROUND Mozilla is an open-source web browser, designed for standards compliance,

Re: Fw: [Full-Disclosure] Google Search and Gmail Correlation(evgpsc verify reciept please)

2005-02-28 Thread DAN MORRILL
Nope, But this should provide hours of amusement. Go to google and type in or copy from here: orkut +google +profile.aspx Interesting... r/ Dan Sometimes MSN E-mail will indicate that the mesasge failed to be delivered. Please resend when you get those, it does not mean that the mail box is

[Full-Disclosure] [ GLSA 200502-31 ] uim: Privilege escalation vulnerability

2005-02-28 Thread Sune Kloppenborg Jeppesen
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200502-31 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

Re: [Full-Disclosure] client - server

2005-02-28 Thread Michael Holstein
which informations can a server get about a client running M$ windows XP ? I cannot access a website because i have been banned and I'd like to understand how they recognize me for sure. All sorts of stuff. Visit browserspy (http://gemal.dk/browserspy/) for a bunch of tests. Java is one

Re: [Full-Disclosure] client - server

2005-02-28 Thread Matteo Giannone
I have made all tests on that website : none revealing informations that can recognize me. I mean: if mozilla would send its SERIAL NUMBER (if it exsts) that is a way to identify my own copy of mozilla. which informations can a server get about a client running M$ windows XP ? I cannot access

[Full-Disclosure] [ GLSA 200502-32 ] UnAce: Buffer overflow and directory traversal vulnerabilities

2005-02-28 Thread Sune Kloppenborg Jeppesen
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200502-32 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

Re: [Full-Disclosure] client - server

2005-02-28 Thread Matteo Giannone
It is impossible that they banned a block of addresses of my ISP, because that is a webserver where you play games: most of the people playing games there use my same ISP and also live near me. I am sure that my IP address changes in couple of hours after disconnections. I deleted cookies,

Re: [Full-Disclosure] client - server

2005-02-28 Thread Michael Holstein
Are you all sure they cannot know my MAC address? I think they know it when I connect to the server (i remember something of TCP/IP stack and encapsulation/decapsulation) Only if some 3rd party application (like the game) is sending it (this is how xbox modchip users get nicked .. also using

Re: [Full-Disclosure] client - server

2005-02-28 Thread Micheal Espinola Jr
A MAC address can be queried on a windows box via the registry - if you have access. This can be done with [null] sessions and netbios. So, depending on security, connectivity, access permissions, etc - it may be possible to obtain this information. On Mon, 28 Feb 2005 11:18:49 -0500, Michael

Re: [Full-Disclosure] client - server

2005-02-28 Thread Micheal Espinola Jr
What is the game? Perhaps they are blocking you by an internal User/Player ID number. I know that's how effective blocking is done in CounterStrike:Source. On Mon, 28 Feb 2005 17:49:01 +0100, Matteo Giannone [EMAIL PROTECTED] wrote: It is impossible that they banned a block of addresses of my

Re: [Full-Disclosure] Xfree86 video buffering?

2005-02-28 Thread Valdis . Kletnieks
On Sun, 27 Feb 2005 01:19:34 +0100, William Waisse said: I already saw this problem switching from ctrl+alt+F7 to ctrl+alt+F8 from a F7 root X session to a F8 user X session, wher the user session sees the last root screen. Umm... what's stopping the user from looking at the F7 root session

[VulnDiscuss] Re: [Full-Disclosure] [HAT-SQUAD] BadBlue, Easy P2P File Sharing Remote Exploit (update)

2005-02-28 Thread class 101
RE: [Full-Disclosure] [HAT-SQUAD] BadBlue, Easy P2P File Sharing Remote Exploit (update)next time then publish both in same time because coded or not because of timeline , the exploit has been brought in first by hat-squad , sorry ; -

[Full-Disclosure] Server termination in Scrapland 1.0

2005-02-28 Thread Luigi Auriemma
### Luigi Auriemma Application: Scrapland http://www.scrapland.com Versions: = 1.0 Platforms:Windows Bug: server termination Exploitation: remote, versus server

Re: [Full-Disclosure] Possible XSS issue on Windows XPSP2 IE6 via MIME Encapsulation of Aggregate HTML

2005-02-28 Thread 3APA3A
Dear bitlance winter, Using MHTML to bypass content filtering for scripting was at least reported here by offtopic as well as few more tricks. You may want to read this: offtopic, 3APA3A. Bypassing client application protection techniques

[Full-Disclosure] iDEFENSE Security Advisory 02.28.05: KPPP Privileged File Descriptor Leak Vulnerability

2005-02-28 Thread idlabs-advisories
, temporarily remove the setuid bit from KPPP and manually gain root privileges before executing KPPP: chmod -s /usr/sbin/kppp VI. VENDOR RESPONSE A vendor advisory for this issue is available at: http://www.kde.org/info/security/advisory-20050228-1.txt A patch for KDE 3.1 is available from ftp

[Full-Disclosure] [ GLSA 200502-33 ] MediaWiki: Multiple vulnerabilities

2005-02-28 Thread Thierry Carrez
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200502-33 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

Re: [Full-Disclosure] client - server

2005-02-28 Thread Marcus Specht
Am Montag, den 28.02.2005, 02:43 +0100 schrieb Matteo Giannone: Hi list, which informations can a server get about a client running M$ windows XP ? I cannot access a website because i have been banned and I'd like to understand how they recognize me for sure. [...] use a sniffer and find

[Full-Disclosure] OpenServer 5.0.6 OpenServer 5.0.7 : A vulnerability in TCP

2005-02-28 Thread please_reply_to_security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 __ SCO Security Advisory Subject:OpenServer 5.0.6 OpenServer 5.0.7 : A vulnerability in TCP Advisory number:SCOSA-2005.3

Re: [Full-Disclosure] Possible XSS issue on Windows XPSP2 IE6 via MIME Encapsulation of Aggregate HTML

2005-02-28 Thread bitlance winter
Dear 3APA3A. Thank you for your excelent information. offtopic, 3APA3A. Bypassing client application protection techniques http://www.security.nnov.ru/advisories/bypassing.asp 3APA3A. Bypassing content filtering whitepaper http://www.security.nnov.ru/advisories/content.asp These advisories are

[Full-Disclosure] Seeking anyone harmed by PivX Solutions

2005-02-28 Thread Jason Coombs
Regarding PivX Solutions: I would like to make contact with anyone who has been harmed by PivX Solutions. If you have been harmed by PivX Solutions, please contact me as soon as possible. Thanks. Jason Coombs [EMAIL PROTECTED] ___ Full-Disclosure -

[Full-Disclosure] Seeking anyone harmed by PivX Solutions

2005-02-28 Thread Jason Coombs
Regarding PivX Solutions: I would like to make contact with anyone who has been harmed by PivX Solutions. If you have been harmed by PivX Solutions, please contact me as soon as possible. Thanks. Jason Coombs [EMAIL PROTECTED] ___ Full-Disclosure -