Re: [Full-Disclosure] some small bugs.

2004-08-15 Thread Ted Unangst
On Sun, 15 Aug 2004, Noam Rathaus wrote: > #ll -l /usr/bin/X11/dpsinfo > -rwxr-xr-x1 root root 6456 Jul 7 18:07 /usr/bin/X11/dpsinfo > symbols found)...(no debugging symbols found)...(no debugging symbols > found)... > Program received signal SIGSEGV, Segmentation fault. > 0x4141

Re: [Full-Disclosure] OpenBSD procfs

2004-05-17 Thread Ted Unangst
On Mon, 17 May 2004, Deprotect Advisories wrote: just for the record. > Disclosure Timeline: > --- > > 03/05/2004: Initial email to vendor. 05/05/2004: Fix committed to cvs. I notified deprotect of the change at this time, and

Re: [Full-Disclosure] Support the Sasser-author fund started

2004-05-13 Thread Ted Unangst
On Thu, 13 May 2004, harry wrote: > who's fault is it really when you buy a door, you lock it, but a burglar > finds a way to easily open it, comes in and tells you... how about when he comes in and pees on your carpet, pushes your furniture into the street and blocks traffic, and throws rocks at

Re: [Full-Disclosure] iDEFENSE Security Advisory 05.12.04: Opera Telnet URI Handler File Creation/Truncation Vulnerability

2004-05-13 Thread Ted Unangst
On Wed, 12 May 2004 [EMAIL PROTECTED] wrote: > VIII. DISCLOSURE TIMELINE > > April 2, 2003 Exploit acquired by iDEFENSE > April 7, 2004 Initial vendor notification > April 7, 2004 iDEFENSE clients notified > April 14, 2004 Initial vendor response > May 12, 2004 Coordinated

[Full-Disclosure] Re: iDEFENSE: Upcoming OpenSSH Security Advisory Announcement

2004-05-03 Thread Ted Unangst
On Mon, 3 May 2004, Richard Johnson wrote: > iDEFENSE Security Advisory 05.03.04: > http://www.idefense.com/advisory/05.03.04.txt oopsie, broken link. -- we want to stop reading magazines stop watching tv stop caring about hollywood but we're addicted to the things we hate

Re: [inbox] Re: [Full-Disclosure] RE: Linux (in)security

2003-10-26 Thread Ted Unangst
On Mon, 27 Oct 2003, Brett Hutley wrote: > char buf[10]; > const char *str1 = "OVER"; > const char *str2 = "FLOW!"; > sprintf(buf, "%s%s", str1, str2); > > Admittedly a contrived example. The best way to handle this type of > stuff is to provide "safe" functions - like a sprintfn() that takes

RE: [Full-Disclosure] No Subject (re: openssh exploit code?)

2003-10-21 Thread Ted Unangst
On Tue, 21 Oct 2003, Montana Tenor wrote: > I agree with Mitch. Lets say you get an advisory that > a severe thunderstorm may be coming your way. Do you > wait until the wind and rain are blowing inside your > house to close the windows and doors. Do you allow > the kids to keep playing outside

Re: [Full-Disclosure] openssh exploit code?

2003-10-13 Thread Ted Unangst
On Mon, 13 Oct 2003, security snot wrote: > ISS' X-Forces claim to have created a working proof-of-concept code for > the bug. Are you calling those respectable young men and woman liars? Or Can you provide a reference please? The latest advisory on their web page says "... the possibility for