Re: [Full-disclosure] Facebook URL redirection issue

2011-04-04 Thread Chris Evans
On Sun, Apr 3, 2011 at 4:26 PM, Javier Bassi javierba...@gmail.com wrote: Reported this issue to Facebook team on 03/22/11 and Facebook team acknowledged this issue on 03/29/11 and fixed this vulnerability. They still have redirects on apps made by their users, and they don't care

Re: [Full-disclosure] Facebook URL redirection issue

2011-04-04 Thread Christian Sciberras
Chris, If it's social and it's Facebook, it must be good :) Cheers, Chris. On Mon, Apr 4, 2011 at 8:22 AM, Chris Evans scarybea...@gmail.com wrote: On Sun, Apr 3, 2011 at 4:26 PM, Javier Bassi javierba...@gmail.comwrote: Reported this issue to Facebook team on 03/22/11 and Facebook team

[Full-disclosure] [ MDVSA-2011:063 ] xmlsec1

2011-04-04 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2011:063 http://www.mandriva.com/security/

[Full-disclosure] [HITB-Announce] HITBSecConf2011 - Malaysia Call for Papers Now Open

2011-04-04 Thread Hafez Kamal
The Call for Papers for the 9th annual HITBSecConf in Malaysia is now open! The event takes place from the 10th - 13th of October at the new Intercontinental Kuala Lumpur. As always the first two days will be dedicated to hands on technical training sessions followed by a 2-day quad track

[Full-disclosure] DC4420 - London DEFCON - April meet - Wednesday 22nd April 2011

2011-04-04 Thread Major Malfunction
I know it's 3 weeks out, but there's a lot going on that week so I wanted to make sure you've got this in your calendars! You wanted technical, you got it In March we quantum'd your minds then keylogged you with 13 lines of code: Thanks to Gregoire of IDQ for the drinks and the great

Re: [Full-disclosure] DC4420 - London DEFCON - April meet - Wednesday 20th April 2011

2011-04-04 Thread Major Malfunction
Doh!! Subject should of course have read Wednesday 20th, not 22nd! Major Malfunction wrote: I know it's 3 weeks out, but there's a lot going on that week so I wanted to make sure you've got this in your calendars! You wanted technical, you got it In March we quantum'd your minds then

[Full-disclosure] SLAAC Attack - 0day Windows Network Interception Configuration Vulnerability

2011-04-04 Thread Adam Behnke
Hi full disclosure dudes, InfoSec Institute security researcher Alec Waters has just released a new article on SLAAC Attacks. The basic premise is to use the default network configuration found on all Windows 7 (as well as Server 2008, Vista) installations to intercept and hijack all network

[Full-disclosure] [ MDVSA-2011:064 ] libtiff

2011-04-04 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2011:064 http://www.mandriva.com/security/

Re: [Full-disclosure] DC4420 - London DEFCON - April meet - Wednesday 20th April 2011

2011-04-04 Thread Adam Laurie
Doh!!! 20th, not 22nd!!! Major Malfunction wrote: I know it's 3 weeks out, but there's a lot going on that week so I wanted to make sure you've got this in your calendars! You wanted technical, you got it In March we quantum'd your minds then keylogged you with 13 lines of code:

Re: [Full-disclosure] SLAAC Attack - 0day Windows Network Interception Configuration Vulnerability

2011-04-04 Thread ascii
On 04/04/2011 05:34 PM, Adam Behnke wrote: http://resources.infosecinstitute.com/slaac-attack- http://resources.infosecinstitute.com/slaac-attack---0day-windows-network-i nterception-configuration-vulnerability/ --0day-windows-network-interception-configuration-vulnerability/ worst URL ever

Re: [Full-disclosure] SLAAC Attack - 0day Windows Network Interception Configuration Vulnerability

2011-04-04 Thread Valdis . Kletnieks
On Mon, 04 Apr 2011 10:34:51 CDT, Adam Behnke said: InfoSec Institute security researcher Alec Waters has just released a new article on SLAAC Attacks. The basic premise is to use the default network configuration found on all Windows 7 (as well as Server 2008, Vista) installations to

[Full-disclosure] ZDI-11-116: Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability

2011-04-04 Thread ZDI Disclosures
ZDI-11-116: Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-116 April 4, 2011 -- CVE ID: CVE-2011-0994 -- CVSS: 10, (AV:N/AC:L/Au:N/C:C/I:C/A:C) -- Affected Vendors: Novell -- Affected Products: Novell File

[Full-disclosure] Microsoft Windows shmedia.dll Division By Zero, Explore.exe DOS exploit .

2011-04-04 Thread fb1h2s Hack 2 Secure
Title :Microsoft Windows shmedia.dll Division By Zero, Explore.exe DOS exploit . Version :( Checked on XP SP All Versions ) Discovery: http://Garage4Hackers.com, http://www.fb1h2s.com Author : FB1H2S aka Rahul Sasi[ Garage4Hackers.com ] Twitter :

[Full-disclosure] [USN-1102-1] tiff vulnerability

2011-04-04 Thread Marc Deslauriers
=== Ubuntu Security Notice USN-1102-1April 04, 2011 tiff vulnerability CVE-2011-1167 === A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 8.04

[Full-disclosure] [USN-1103-1] tex-common vulnerability

2011-04-04 Thread Marc Deslauriers
=== Ubuntu Security Notice USN-1103-1April 04, 2011 tex-common vulnerability CVE-2011-1400 === A security issue affects the following Ubuntu releases: Ubuntu 10.04 LTS