Re: [Full-Disclosure] Re: zone transfers, a spammer's dream?

That is *sweet* nice find. On Sun, 2004-12-19 at 19:40, Troubles Troubles wrote: == the fucking bugtraq moderators don't let me post this! == .st has this bug too. you can transfer the whole domain. their whois server also doesn't have any time-out! try this: dig @a.root-servers.net.

[Full-Disclosure] Re: zone transfers, a spammer's dream?

== the fucking bugtraq moderators don't let me post this! == .st has this bug too. you can transfer the whole domain. their whois server also doesn't have any time-out! try this: dig @a.root-servers.net. st. ns dig @auth61.ns.uu.net. st. axfr (sleep 3600; perl -e 'print

[Full-Disclosure] PHP and curl open_basedir still bypassable

As posted in http://www.securitytracker.com/alerts/2004/Oct/1011984.html the open_basedirbypassstill exists in the php 4.3.10 andcurl-7.12.2,anyone seen a patch or anything to get solve this issue? ___ Full-Disclosure - We believe in it. Charter:

[Full-Disclosure] [ GLSA 200412-19 ] phpMyAdmin: Multiple vulnerabilities

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200412-19 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

Re: [Full-Disclosure] HOW TO BREAK XP SP2 POPUP BLOCKER: TIME TO WAKE UP!

- Original Message - From: Scott Renna [EMAIL PROTECTED] To: [EMAIL PROTECTED] Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Sent: Tuesday, December 14, 2004 5:23 AM Subject: Re: [Full-Disclosure] HOW TO BREAK XP SP2 POPUP BLOCKER: kick it inthe nut ! I'd speculate for several reasons.

[Full-Disclosure] UPDATE: [ GLSA 200410-12 ] WordPress: HTTP response splitting and XSS vulnerabilities

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory [UPDATE] GLSA 200410-12:02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-Disclosure] Re: zone transfers, a spammer's dream?

== the fucking bugtraq moderators don't let me post this! == .st has this bug too. you can transfer the whole domain. their whois server also doesn't have any time-out! try this: dig @a.root-servers.net. st. ns dig @auth61.ns.uu.net. st. axfr (sleep 3600; perl -e 'print

[Full-Disclosure] Tlen.pl, remote script execution

Product:Tlen.pl (= 5.23.4.1) Vendor: o2.pl Sp. z o.o. (http://www.tlen.pl/) Impact: Remote script execution Severity: High Authors:Blazej Miga [EMAIL PROTECTED], Jaroslaw Sajko [EMAIL PROTECTED] Date: 20/12/04 [ISSUE] Tlen.pl is

[Full-Disclosure] [ GLSA 200412-18 ] abcm2ps: Buffer overflow vulnerability

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security AdvisoryGLSA 200412-18:02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-Disclosure] NetBSD kernel local vulnerabilities

Name: NetBSD kernel local vulnerabilities Date: Dec 18, 2004 Author:Evgeny Demidov Description: There exists multiple vulnerabilities in NetBSD binary compatibility code. They can be approximately divided into two parts: 1) signal number validation problems in

[Full-Disclosure] [ GLSA 200412-20 ] NASM: Buffer overflow vulnerability

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200412-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-Disclosure] [USN-42-1] Xine library vulnerabilities

=== Ubuntu Security Notice USN-42-1 December 20, 2004 xine-lib vulnerabilities https://sourceforge.net/project/shownotes.php?group_id=9655release_id=290099 === A security

[Full-Disclosure] [ GLSA 200412-15 ] Ethereal: Multiple vulnerabilities

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200412-15 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-Disclosure] Possible Python 2.3 DoS Vulnerability

When you open Python for Windows v 2.3 and enter for the command Control+Z then Control+I and press enter, the program crashes. Problem: Seems harmless right? Well, if someone was to send a request of \x1a\x09 or with \x1a\x09 at the end to a server/client running on a Python 2.3 platform, it

[Full-Disclosure] [ GLSA 200412-17 ] kfax: Multiple overflows in the included TIFF library

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200412-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

Re: [Full-Disclosure] Security breach database

I dont know about stories, but you can find defacements at hxxp://www.zone-h.org -- Martin On Tue, 14 Dec 2004 15:44:41 -0800, n30 [EMAIL PROTECTED] wrote: Guys, Looking for few interesting security breach stories... Any database / sites that capture these?? Help appreciated -n

Re: [Full-Disclosure] Re: Gadu-Gadu, another two bugs

Beware, this bug is being already exploited in the wild. I have just received the following message from WWW to GG gateway (gg# 7021349): I recomend all Gadu-Gadu users to turn on the option that does not show messages from unknown users. This option appeared in version 6.0 build 151 or so (at

Re: [Full-Disclosure] OpenSSH is a good choice?

On 17 Dec 2004, at 19:49, Carlos de Oliveira wrote: I am going to install OpenSSH in one of my servers, but I want to make sure it is secure. Does anybody know about vulnerabilites on OpenSSH, if yes, would you like to suggest me another remote secure shell ? There are no current open

[Full-Disclosure] Re: Windows Explorer TGA Crash is a DoS bug in Internet Explorer.

Tested on win2ksp4, IE6.0sp1 fully patched (hmmm... not really fully obviously ;)) It's a DoS, nothing exploitable. Explorer let's IE do the rendering in thumbnail previes mode. IE creates a HTML page and crashes while creating or rendering it. Same bug can be triggered easier with following

[Full-Disclosure] Re: Windows Explorer TGA Crash is a DoS bug in Internet Explorer.

I thought it looked familiar: http://lists.netsys.com/pipermail/full-disclosure/2004-May/021272.html It'll probably never get fixed. Berend-Jan Wever [EMAIL PROTECTED] http://www.edup.tudelft.nl/~bjwever SkyLined in #SkyLined on EFNET PGP key ID: 0x48479882 - Original Message - From:

Re: [Full-Disclosure] OpenSSH is a good choice?

Thank you all for you attention! This helps me a lot. :-) On Mon, 20 Dec 2004 18:12:21 -0600, Kevin [EMAIL PROTECTED] wrote: Nobody sitting on exploits for the current version of OpenSSH will share them in public. Of the available SSH servers, OpenSSH (if you deploy the latest version,

[Full-Disclosure] MDKSA-2004:152 - Updated ethereal packages fix multiple vulnerabilities

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandrakelinux Security Update Advisory ___ Package name: ethereal Advisory ID:

[Full-Disclosure] MDKSA-2004:153 - Updated aspell packages fix vulnerability

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandrakelinux Security Update Advisory ___ Package name: aspell Advisory ID:

[Full-Disclosure] [ GLSA 200412-21 ] MPlayer: Multiple overflows

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200412-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-Disclosure] Administrivia: Explanation

Living two thousand miles away from my hardware, a sworn refusal to fly under the current police-state conditions, and other responsibilities(like in the middle of selling my installation and moving to a new location) caused an inexcusable delay in bringing things back up. Things are still

RE: [Full-Disclosure] RE: Cipher Tool

Or you could go buy some of these and link them together to reach over a distance. The First Commercial Quantum Cryptography solution - encryption per photon =) http://www.magiqtech.com/index.php -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of