Re: [Full-Disclosure] new ssh exploit?

2003-09-16 Thread Shanphen Dawa
Do you have a site, with maybe comparisons between the two? I am always looking for bigger and better things :-) On Tue, 16 Sep 2003 13:39:27 -0400 Bennett Todd [EMAIL PROTECTED] wrote: 2003-09-16T11:25:47 Ron DuFresne: On Mon, 15 Sep 2003, christopher neitzert wrote: 1. upgrade to lsh.

Re: [Full-Disclosure] CERT Employee Gets Owned

2003-08-26 Thread Shanphen Dawa
On Tue, 26 Aug 2003 10:49:38 -0500 Elvedin [EMAIL PROTECTED] wrote: snip If you want this topic to die, please stop replying to it. All I know, anybody who replies to this will go on my block list, this is just as good as spam. Practice what you preech, why did you reply then? As for going

[Full-Disclosure] Execution Flow Control (EFC)

2003-08-16 Thread Shanphen Dawa
This was posted to bugtraq. http://www.securityfocus.com/archive/1/333451/2003-08-13/2003-08-19/0 The author of the software claims any machine running this Execution Flow Control (EFC) program is 100%. I think 100% is a tad bit arrogant, and I can't wait till he has to eat his words. The

Re: [Full-Disclosure] power grid vulnerable to buffer overflow?

2003-08-15 Thread Shanphen Dawa
I think they rules that out. At least thats what I have heard on the news. On Thu, 14 Aug 2003 21:35:34 -0400 rrm [EMAIL PROTECTED] wrote: Has anyone heard this rumor that something got struck by lightning in Canada that caused all these problems?

Re: [Full-Disclosure] OT but related.

2003-07-29 Thread Shanphen Dawa
I don't subscribe to bugtraq for the reasons you listed, vendor annoucing, and a lot of material that just isn't interesting to me. Usually there are a couple people subscribed to both, so if there is anything important posted to bugtraq, it usually gets reposted here. On Wed, 30 Jul 2003

Re: [Full-Disclosure] dcom exploit code observations

2003-07-28 Thread Shanphen Dawa
I would also like to know, since I though the remote computer would experience some sort of DoS instead of exploitation if the wrong return address was used. On Mon, 28 Jul 2003 22:20:20 +0200 Knud Erik Højgaard [EMAIL PROTECTED] wrote: morning_wood wrote: [snip] THIS IS NOT THE CASE...

Re: [Full-Disclosure] DCOM RPC exploit (dcom.c)

2003-07-26 Thread Shanphen Dawa
This childish flaming is why everyone wishes death upon you donnie, please get a clue. There are more constructive ways to make a point, please try your best to try them. You might be suprised how much less hated you might become around here. -Shanphen Oh yeah, please do try the tools drop

Re: [Full-Disclosure] Search Engine XSS

2003-07-23 Thread Shanphen Dawa
Yes but what affect does this have on the server? How does it comprimise security? Can you use this to DoS the server? Can you use this to gain access to areas on the server otherwise not available? On Wed, 23 Jul 2003 02:18:05 -0700 morning_wood [EMAIL PROTECTED] wrote: since were on the

Re: [Full-Disclosure] Search Engine XSS

2003-07-23 Thread Shanphen Dawa
So why not show one of these legitimate examples instead of the overused window popup script? It would just be easier to ascertain the level of severity if an actual DoS string or this trusted internal call was exploited. I am sure there are a lot of forms that can be a victim of a xss string,

[Full-Disclosure] Cisco Bug 44020

2003-07-22 Thread Shanphen Dawa
Here is supposedly a working Cisco exploit: http://www.elxsi.de/cisco-bug-44020.tar.gz This is pasted from security focus: http://www.securityfocus.com/archive/1/329765/2003-07-19/2003-07-25/0 To: BugTraq Subject: Cisco IOS exploit (44020) Date: Jul 21 2003 4:01PM Author: Martin Kluge