[Full-disclosure] [ MDVSA-2008:236 ] vim
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2008:236 http://www.mandriva.com/security/ ___ Package : vim Date: December 3, 2008 Affected: 2008.0, 2008.1, 2009.0, Corporate 3.0, Corporate 4.0, Multi Network Firewall 2.0 ___ Problem Description: Several vulnerabilities were found in the vim editor: A number of input sanitization flaws were found in various vim system functions. If a user were to open a specially crafted file, it would be possible to execute arbitrary code as the user running vim (CVE-2008-2712). Ulf Härnhammar of Secunia Research found a format string flaw in vim's help tags processor. If a user were tricked into executing the helptags command on malicious data, it could result in the execution of arbitrary code as the user running vim (CVE-2008-2953). A flaw was found in how tar.vim handled TAR archive browsing. If a user were to open a special TAR archive using the plugin, it could result in the execution of arbitrary code as the user running vim (CVE-2008-3074). A flaw was found in how zip.vim handled ZIP archive browsing. If a user were to open a special ZIP archive using the plugin, it could result in the execution of arbitrary code as the user running vim (CVE-2008-3075). A number of security flaws were found in netrw.vim, the vim plugin that provides the ability to read and write files over the network. If a user opened a specially crafted file or directory with the netrw plugin, it could result in the execution of arbitrary code as the user running vim (CVE-2008-3076). A number of input validation flaws were found in vim's keyword and tag handling. If vim looked up a document's maliciously crafted tag or keyword, it was possible to execute arbitary code as the user running vim (CVE-2008-4101). A vulnerability was found in certain versions of netrw.vim where it would send FTP credentials stored for an FTP session to subsequent FTP sessions to servers on different hosts, exposing FTP credentials to remote hosts (CVE-2008-4677). This update provides vim 7.2 (patchlevel 65) which corrects all of these issues and introduces a number of new features and bug fixes. ___ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2712 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2953 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3074 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3075 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3076 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4101 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4677 ___ Updated Packages: Mandriva Linux 2008.0: 9687145d46a754a50f26498399e42f84 2008.0/i586/vim-common-7.2.065-9.2mdv2008.0.i586.rpm 5ab8b8d113ef693c07cd79f693d47638 2008.0/i586/vim-enhanced-7.2.065-9.2mdv2008.0.i586.rpm cf40227e84aac1a17a1a2973685e6a1f 2008.0/i586/vim-minimal-7.2.065-9.2mdv2008.0.i586.rpm bf9cb876e1958d7b215a7039e1c52975 2008.0/i586/vim-X11-7.2.065-9.2mdv2008.0.i586.rpm 7b1b039b2ba0233b6535775ecd200e6d 2008.0/SRPMS/vim-7.2.065-9.2mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: fa3479b036e054ce12a0e680e95f28f6 2008.0/x86_64/vim-common-7.2.065-9.2mdv2008.0.x86_64.rpm d1e10ebfaa89c3ca0cc72624531c6950 2008.0/x86_64/vim-enhanced-7.2.065-9.2mdv2008.0.x86_64.rpm a8961516b64c325bf6662b44e1384885 2008.0/x86_64/vim-minimal-7.2.065-9.2mdv2008.0.x86_64.rpm eb6a696807d8a2e55d9a447266081bc4 2008.0/x86_64/vim-X11-7.2.065-9.2mdv2008.0.x86_64.rpm 7b1b039b2ba0233b6535775ecd200e6d 2008.0/SRPMS/vim-7.2.065-9.2mdv2008.0.src.rpm Mandriva Linux 2008.1: bf1bbb5c11dc18f5b626830f83324bab 2008.1/i586/vim-common-7.2.065-9.2mdv2008.1.i586.rpm 54426458bb7601d9b3fdfedfa16ee9c6 2008.1/i586/vim-enhanced-7.2.065-9.2mdv2008.1.i586.rpm ca94206e37b639a4577272d05ef10489 2008.1/i586/vim-minimal-7.2.065-9.2mdv2008.1.i586.rpm 8b58cee3b8ccee24408c1ed78215cb89 2008.1/i586/vim-X11-7.2.065-9.2mdv2008.1.i586.rpm 2886ecd9e5117b6464dc82e12bc41ee6 2008.1/SRPMS/vim-7.2.065-9.2mdv2008.1.src.rpm Mandriva Linux 2008.1/X86_64: f56a2879dfbca889824074338eca652c 2008.1/x86_64/vim-common-7.2.065-9.2mdv2008.1.x86_64.rpm e813a7a4126f4b5413b6a3517bb57c97 2008.1/x86_64/vim-enhanced-7.2.065-9.2mdv2008.1.x86_64.rpm cfc262ca8e4995d5b648c282d05f9261 2008.1/x86_64/vim-minimal-7.2.065-9.2mdv2008.1.x86_64.rpm dce8110e159fe8b767d596346514d1e9 2008.1/x86_64/vim-X11-7.2.065-9.2mdv2008.1.x86_64.rpm 2886ecd9e5117b6464dc82e12bc41ee6 2008.1/SRPMS/vim-7.2.065-9.2mdv2008.1.src.rpm Mandriva Linux 2
[Full-disclosure] CVE-2008-2086: Java Web Start File Inclusion via System Properties Override
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Virtual Security Research, LLC. http://www.vsecurity.com/ Security Advisory - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Advisory Name: Java Web Start File Inclusion via System Properties Override Release Date: 2008-12-03 Application: Sun Java Runtime Environment / Java Web Start Versions: See below Severity: High Author: Timothy D. Morgan Vendor Status: Patch Released [3] CVE Candidate: CVE-2008-2086 Reference: http://www.vsecurity.com/bulletins/advisories/2008/JWS-props.txt - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Product Description - --- - From [1]: "Using Java Web Start technology, standalone Java software applications can be deployed with a single click over the network. Java Web Start ensures the most current version of the application will be deployed, as well as the correct version of the Java Runtime Environment (JRE)." Vulnerability Overview - -- On March 27th, VSR identified a vulnerability in Java Web Start related to the execution of privileged applications. This flaw could allow an attacker to execute arbitrary code on a victim system if a user could be convinced to visit a malicious web site. Product Background - -- Java Web Start (JWS) applications are launched through specially formatted XML files hosted on web sites with a "jnlp" file extension. These files reference one or more "jar" files which are meant to be downloaded and executed by client systems. JWS applications are run in unprivileged mode by default but may be run with full user privileges if the jnlp file requests this access. Privileged JWS applications must have each jar file signed by the same trusted author in order to be executed. However, jnlp files are not signed and may be hosted by third-party web sites. In addition to specifying application components, the jnlp specification permits application authors to supply certain System properties which may be retrieved by the application through the System.getProperty() and System.getProperties() methods. Besides any user-supplied properties, the Java VM also provides access to a number of sensitive runtime settings through this interface. More information on the jnlp format may be found in [2]. Vulnerability Details - - VSR discovered an unsafe behavior in the way properties are interpreted when specified in jnlp files. In certain versions of the Java Runtime Engine (JRE), values supplied through jnlp files override existing system defaults. Thus far, VSR has verified the following System properties may be overridden: java.home java.ext.dirs user.home Of particular interest are the java.home and java.ext.dirs properties. If an attacker could lure a victim to open a malicious jnlp file which references a trusted application, it may be executed without any confirmation by the user. However, as the application attempts to load classes, it may trust the malicous java.home and/or java.ext.dirs value. These paths could point to a malicious local or remote JRE or extensions installation. It appears that under Windows, UNC network paths may be used for the java.home value. It is not yet known whether or not UNC paths may be used for java.ext.dirs. During testing, VSR found that Java Cryptography Extension (JCE) classes failed to load when java.home was set to an invalid path. However, by setting this path to network share which hosted a valid JRE installation, the JCE classes loaded correctly. If such a network share were hosted by the attacker, then arbitrary code could potentially be loaded without restrictions, unbeknownst to the victim. The following XML shows what a malicious jnlp file might look like. Note that the malicious jnlp file would likely be very similar to the ones users normally rely on with certain properties overriden in the resources section. http://trusted.example.org/"; href="evil.jnlp"> Trusted Application Trusted Vendor Trusted Application by Trusted Vendor http://trusted.example.org/"; /> To fully exploit this specific attack vector, an attacker would need to remotely or locally host a malicious version of classes used by a trusted application and then lure a user into opening a malicious jnlp file. A firewall installed between the attacker and victim could mitigate this issue if the victim's machine were restricted from accessing the hosted network share. Note that certain JWS applications may trust other System properties, such as user.home, and use them in ways which could be exploited in application-specific variants of this attack. Versions Affected - - During testing, VSR found the following JRE versions to be
Re: [Full-disclosure] Project Chroma: A color code for the state ofcyber security
Mike C wrote: >> If you really want to change state of security for the n00bs, >> spread the knowledge, not the colors. >> >> > Thats what project Chroma is all about.. Are you on board?! > This already exists, backed up by some hard-core security competence: http://isc.sans.org/infocon.html http://isc.sans.org/ Has it changed the world? -Luke smime.p7s Description: S/MIME Cryptographic Signature ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Project Chroma: A color code for the state ofcyber security
How exactly is a list of 5 colors going to educate the world about the need for, and proper implementation of, security measures? And be specific, stop with the vagueness already. On Wed, Dec 3, 2008 at 9:45 PM, Mike C <[EMAIL PROTECTED]> wrote: > > Thats what project Chroma is all about.. Are you on board?! > > -- > MC > Security Researcher > Lead, Project Chroma > http://sites.google.com/site/projectchromaproject/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] News for Ureleet
Hey mike, how about you stop playing moderator you fucking douche bag. I for one believe netdev brings alot to this list and encourage him and ureleet to continue posting. On Wed, Dec 3, 2008 at 9:47 PM, Mike C <[EMAIL PROTECTED]> wrote: > Hye Guys, > > I though we had settled the issues offline. Lets restart our > discussions.. this bickering is highly unnecessary on the list. > > -- > MC > Security Researcher > Lead, Project Chroma > http://sites.google.com/site/projectchromaproject/ > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Iran executes IT expert who spied for Israel
On Wed, Dec 3, 2008 at 6:55 AM, Ureleet <[EMAIL PROTECTED]> wrote: > hes not a troll andrew. he brings up good points. u nd i are the > only trolls here. i only troll u. you troll every1. > Yes, acceptance is he first stage of recovery for the both of you. Let us continue with the offline discussions. -- MC Security Researcher Lead, Project Chroma http://sites.google.com/site/projectchromaproject/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] News for Ureleet
Hye Guys, I though we had settled the issues offline. Lets restart our discussions.. this bickering is highly unnecessary on the list. -- MC Security Researcher Lead, Project Chroma http://sites.google.com/site/projectchromaproject/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Project Chroma: A color code for the state ofcyber security
On Tue, Dec 2, 2008 at 11:29 AM, Elazar Broad <[EMAIL PROTECTED]> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > > > On Tue, 02 Dec 2008 11:50:46 -0500 rholgstad <[EMAIL PROTECTED]> > wrote: >>Mike C wrote: >>> On Mon, Dec 1, 2008 at 5:27 PM, rholgstad <[EMAIL PROTECTED]> >>wrote: >>> and how does making a color based on these inputs protect >>people? >>> >>> Once all desktops have an icon or widget (say at the right hand >>> corner) with the color, and this is consistently seen >>everywhere, the >>> users will start associating with their online security. they >>will be >>> reminded that they have to be careful with the data they share. >>> >>> This, if implemented correctly will be a boon to security >>industry, >>> where the weakest kinks currently are 'n00b' users. >>> >>> >>you are joking right? >> >>So some widget is going to stop the next SMB remote or IE client >>side >>and protect the 'n00b' users? Please explain how this works. Also >>please >>explain how "they will be reminded that they have to be careful >>with the >>data they share. " has anything to do with protecting a users >>machine >>from being compromised. > > Thats the whole point. There is a fine line between using visual > alerts to put people(Joe six pack) into a state of "awareness"(more > like mild hysteria) of a threat versus knowing how to protect > oneself against that threat and using that awareness indicator as > the kick in the ass to get moving and shore up the defenses(hell, > how many security folk do this too, then again, every time > something goes bump we see red). Visual alerts are great at > persuasion tools, especially when the goal is to get Joe to buy > your latest all-in-one-will-make-your-coffee-and-buy-you-beer > AV/Malware/Spyware/Foo(whats this doing here?)/evil monkey in the > closet package. So of course, Joe will never learn how to properly > defend his computer/data, and the "industry" will prosper. > I dont think it is a lost battle. This method could prove an excellent way to solve this age old problem. > Now, thanks to our good friends over at the DHS, the color system > has turned into a complete and utter joke(for the most part), so my > friend, you see, this a complete exercise in futility(besides the > fact that every friggin AV/IDS/Security/SIM company out there has > red, yellow and green as their corporate "flag", if you are just > joining the party, then you can completely ignore this) > DHS implementation leaves a lot to be desired. Please do not compare this to DHS's implementation. > If you really want to change state of security for the n00bs, > spread the knowledge, not the colors. > Thats what project Chroma is all about.. Are you on board?! -- MC Security Researcher Lead, Project Chroma http://sites.google.com/site/projectchromaproject/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Project Chroma: A color code for the state ofcyber security
On Wed, Dec 3, 2008 at 12:17 PM, Mike Preston <[EMAIL PROTECTED]> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Mike C wrote: > | On Mon, Dec 1, 2008 at 5:27 PM, rholgstad <[EMAIL PROTECTED]> wrote: > |> and how does making a color based on these inputs protect people? > |> > | > | Once all desktops have an icon or widget (say at the right hand > | corner) with the color, and this is consistently seen everywhere, the > | users will start associating with their online security. they will be > | reminded that they have to be careful with the data they share. > | > | This, if implemented correctly will be a boon to security industry, > | where the weakest kinks currently are 'n00b' users. > | > So if its condition green I can turn off my firewall and antivirus and > surf risk free?! > If it ever does :)! With the current state of the industry, I dont think that time will come in the near future, -- MC Security Researcher Lead, Project Chroma http://sites.google.com/site/projectchromaproject/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Project Chroma: A color code for the state ofcyber security
On Tue, Dec 2, 2008 at 9:13 AM, Chris Jeane <[EMAIL PROTECTED]> wrote: > If you are taking a proactive approach to security, maybe you should always > remind the user to be careful with their data. > How about 'all desktops have an icon or widget (say at the right hand > corner)' that flashes red every five minutes and says 'be careful with the > data you share.' This solution removes the overhead of all that pesky > monitoring and data mining. > This would be far more obtrusive than required. Not what would be the most effective. > The internet is a dangerous place, and will continue to be. My 'noob' > grandmother doesn't need a 1-5 Danger Scale to keep her from being scammed > when she buys holiday gifts online. [Grandmother Voice] 'Ohh dear we are at > Internet Danger Level: Tangerine, guess I can't order those knit socks for > Johnny today.' [End Grandmother Voice] > I hope you would thing a little bigger than that. Unfortunately, that is too much to hope for? -- MC Security Researcher Lead, Project Chroma http://sites.google.com/site/projectchromaproject/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Project Chroma: A color code for the state ofcyber security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mike C wrote: | On Mon, Dec 1, 2008 at 5:27 PM, rholgstad <[EMAIL PROTECTED]> wrote: |> and how does making a color based on these inputs protect people? |> | | Once all desktops have an icon or widget (say at the right hand | corner) with the color, and this is consistently seen everywhere, the | users will start associating with their online security. they will be | reminded that they have to be careful with the data they share. | | This, if implemented correctly will be a boon to security industry, | where the weakest kinks currently are 'n00b' users. | So if its condition green I can turn off my firewall and antivirus and surf risk free?! Whoo Hoo! Mike -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkk26W4ACgkQvhwPecbXDdyR8gCfZ5bbvwn01aRCcP5oqPE2GAT5 c+kAn3TAYtGY1o6ojoLXpDo7VIEQlTjn =Mskr -END PGP SIGNATURE- smime.p7s Description: S/MIME Cryptographic Signature ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [USN-686-1] AWStats vulnerability
=== Ubuntu Security Notice USN-686-1 December 04, 2008 awstats vulnerability CVE-2008-3714 === A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 7.10 Ubuntu 8.04 LTS Ubuntu 8.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: awstats 6.5-1ubuntu1.3 Ubuntu 7.10: awstats 6.6+dfsg-1ubuntu0.1 Ubuntu 8.04 LTS: awstats 6.7.dfsg-1ubuntu0.1 Ubuntu 8.10: awstats 6.7.dfsg-5ubuntu0.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Morgan Todd discovered that AWStats did not correctly strip quotes from certain parameters, allowing for an XSS attack when running as a CGI. If a user was tricked by a remote attacker into following a specially crafted URL, the user's authentication information could be exposed for the domain where AWStats was hosted. Updated packages for Ubuntu 6.06 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.5-1ubuntu1.3.diff.gz Size/MD5:20231 02f6d6768115e61ecf3cb347e20a4d6b http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.5-1ubuntu1.3.dsc Size/MD5: 823 0acdf09ceaa643749b1d42a48b01a753 http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.5.orig.tar.gz Size/MD5: 1051780 aef00b2ff5c5413bd2a868299cabd69a Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.5-1ubuntu1.3_all.deb Size/MD5: 853248 3b839bfdfce5331f902838694df21039 Updated packages for Ubuntu 7.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.6+dfsg-1ubuntu0.1.diff.gz Size/MD5:20242 b0b2a251637b40ba30f2916b45629f33 http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.6+dfsg-1ubuntu0.1.dsc Size/MD5: 915 ca6ded2a6d1fe2175d01d996b0e3f590 http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.6+dfsg.orig.tar.gz Size/MD5: 1073578 6887d3f49de4f50830c0940041200632 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.6+dfsg-1ubuntu0.1_all.deb Size/MD5: 898120 cc9aa605fbe5455b2c0681ee4f3c7af1 Updated packages for Ubuntu 8.04 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg-1ubuntu0.1.diff.gz Size/MD5:23385 ab783d7817033c0240920e0d4aa6637c http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg-1ubuntu0.1.dsc Size/MD5: 1017 1e66b61f4a072905ab5039c9211fc7c8 http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg.orig.tar.gz Size/MD5: 1093568 98a5fad9c379ac4884d7af90db6e087b Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg-1ubuntu0.1_all.deb Size/MD5: 907832 a7c108e27112aa3ef21df347302dce36 Updated packages for Ubuntu 8.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg-5ubuntu0.1.diff.gz Size/MD5:28889 57d485dea3b40aadc924c81fa67666e4 http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg-5ubuntu0.1.dsc Size/MD5: 1530 c6dae34e2a0ac2d7036e45257e62f122 http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg.orig.tar.gz Size/MD5: 1093568 98a5fad9c379ac4884d7af90db6e087b Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/a/awstats/awstats_6.7.dfsg-5ubuntu0.1_all.deb Size/MD5: 908744 ca2b119c43f0943d1763348e10a599c6 signature.asc Description: Digital signature ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [USN-685-1] Net-SNMP vulnerabilities
=== Ubuntu Security Notice USN-685-1 December 03, 2008 net-snmp vulnerabilities CVE-2008-0960, CVE-2008-2292, CVE-2008-4309 === A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 7.10 Ubuntu 8.04 LTS Ubuntu 8.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: libsnmp-perl5.2.1.2-4ubuntu2.3 libsnmp95.2.1.2-4ubuntu2.3 Ubuntu 7.10: libsnmp-perl5.3.1-6ubuntu2.2 libsnmp10 5.3.1-6ubuntu2.2 Ubuntu 8.04 LTS: libsnmp-perl5.4.1~dfsg-4ubuntu4.2 libsnmp15 5.4.1~dfsg-4ubuntu4.2 Ubuntu 8.10: libsnmp15 5.4.1~dfsg-7.1ubuntu6.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Wes Hardaker discovered that the SNMP service did not correctly validate HMAC authentication requests. An unauthenticated remote attacker could send specially crafted SNMPv3 traffic with a valid username and gain access to the user's views without a valid authentication passphrase. (CVE-2008-0960) John Kortink discovered that the Net-SNMP Perl module did not correctly check the size of returned values. If a user or automated system were tricked into querying a malicious SNMP server, the application using the Perl module could be made to crash, leading to a denial of service. This did not affect Ubuntu 8.10. (CVE-2008-2292) It was discovered that the SNMP service did not correctly handle large GETBULK requests. If an unauthenticated remote attacker sent a specially crafted request, the SNMP service could be made to crash, leading to a denial of service. (CVE-2008-4309) Updated packages for Ubuntu 6.06 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/net-snmp_5.2.1.2-4ubuntu2.3.diff.gz Size/MD5:75402 9655d984a47cec8e27efa4db0b227870 http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/net-snmp_5.2.1.2-4ubuntu2.3.dsc Size/MD5: 838 17a17230a005c1acfd0569757e728fad http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/net-snmp_5.2.1.2.orig.tar.gz Size/MD5: 3869893 34159770a7fe418d99fdd416a75358b1 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp-base_5.2.1.2-4ubuntu2.3_all.deb Size/MD5: 1152306 f7647cee4df8db87ab48c0d05635a973 http://security.ubuntu.com/ubuntu/pool/universe/n/net-snmp/tkmib_5.2.1.2-4ubuntu2.3_all.deb Size/MD5: 822946 b9b852c188937d1fffc06d4da01325d5 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp-perl_5.2.1.2-4ubuntu2.3_amd64.deb Size/MD5: 896620 a78012b3f0f13667081f97dc1a4d62e8 http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp9-dev_5.2.1.2-4ubuntu2.3_amd64.deb Size/MD5: 1497194 7d55b8d1e4ae0c45753bedcf536a1a5a http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp9_5.2.1.2-4ubuntu2.3_amd64.deb Size/MD5: 1826252 0550c1401f9bbe5f345fd96484ed369c http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/snmp_5.2.1.2-4ubuntu2.3_amd64.deb Size/MD5: 889330 5ad0ddb2c610973166e4dd07769ba3d3 http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/snmpd_5.2.1.2-4ubuntu2.3_amd64.deb Size/MD5: 797086 18cf4210342b683d3ee24fe995329b55 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp-perl_5.2.1.2-4ubuntu2.3_i386.deb Size/MD5: 896880 298d27ea1ece6e80bb8931b9a5e61961 http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp9-dev_5.2.1.2-4ubuntu2.3_i386.deb Size/MD5: 1268472 acbca43ab7ea747fa3e4636d15ef997c http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp9_5.2.1.2-4ubuntu2.3_i386.deb Size/MD5: 1710342 bd27290685bcf1d6a23eb8705d3367e7 http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/snmp_5.2.1.2-4ubuntu2.3_i386.deb Size/MD5: 881838 58121bd9e4c845da7df4e540645e0e13 http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/snmpd_5.2.1.2-4ubuntu2.3_i386.deb Size/MD5: 794672 221d1c554bd89f50dc3ac9108a6cef6b powerpc architecture (Apple Macintosh G3/G4/G5): http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp-perl_5.2.1.2-4ubuntu2.3_powerpc.deb Size/MD5: 913064 45a033b01c4b31ef90a92988bb5fb229 http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp9-dev_5.2.1.2-4ubuntu2.3_powerpc.deb Size/MD5: 1590124 b62aa5477d9307d311c811298b7ec3d9 http://security.ubuntu.com/ubuntu/pool/main/n/net-snmp/libsnmp9_5.2.1.2-4ubuntu2.3_powerpc.deb Size/MD5:
Re: [Full-disclosure] More proof that Microsoft products are probably backdoored
There are no kiddies on the group and any that appear get banned. On Wed, Dec 3, 2008 at 4:28 PM, j-f sentier <[EMAIL PROTECTED]> wrote: > If there's a peace of shit around here that should be flushed, it's only you > n3tcr4p > No one like you, get the fuck back on your kiddie mailing list/group. > > > > > 2008/12/3 n3td3v <[EMAIL PROTECTED]> >> >> You're like a shite that won't flush away. >> >> On Tue, Dec 2, 2008 at 6:11 PM, Ureleet <[EMAIL PROTECTED]> wrote: >> > all speculation: >> > >> > no 1 knows 4 sure. >> > >> > http://it.slashdot.org/article.pl?sid=07/12/17/1754257&from=rss >> > >> > http://www.cnn.com/TECH/computing/9909/03/windows.nsa.02/ >> > >> > http://www.theforbiddenknowledge.com/hardtruth/nsa_backdoor_windows.htm >> > >> > c how i did that n3td3v? i posted links, nd talked about the article >> > w/out stealing ppls work. >> > >> > pay attention. >> > >> > >> > On Tue, Dec 2, 2008 at 9:36 AM, Andy McKnight <[EMAIL PROTECTED]> >> > wrote: >> >> 2008/12/2 Ureleet <[EMAIL PROTECTED]> >> >>> >> >>> u arent getting it. >> >>> >> >>> it has nothing 2 do w/ backdoors. they r talking about actual >> >>> backdoors in the code. so that anyone who knows the backdoor can >> >>> acess any windows system regarless. they r saying that microsoft has >> >>> coded backdoors into the system so that the govt can get into any >> >>> system, patched or not. pay attention. >> >> >> >> I haven't seen anything that suggests that systems are/will be >> >> backdoored >> >> here. The text of the statement said "remote searches" which in legal >> >> terms >> >> could be anything from something as simple as browsing shared files >> >> available through P2P to full remote system access. >> >> >> >> Do you have anything else that suggests Windows has backdoors present >> >> other >> >> than this statement? >> >> >> > >> > ___ >> > Full-Disclosure - We believe in it. >> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> > Hosted and sponsored by Secunia - http://secunia.com/ >> > >> >> ___ >> Full-Disclosure - We believe in it. >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> Hosted and sponsored by Secunia - http://secunia.com/ > > > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] News for Ureleet
You'll never know and thats what bugs you. ;) On Wed, Dec 3, 2008 at 2:52 PM, Ureleet <[EMAIL PROTECTED]> wrote: > luky 4 us, u arent any of the 3. > > thats a load off of our minds. > > On Wed, Dec 3, 2008 at 3:43 AM, n3td3v <[EMAIL PROTECTED]> wrote: >> I don't write news articles and I copy and paste abstracts from them, >> welcome to fair use. If I wanted to be a news journalist I wouldn't be >> a security researcher and ethical hacker. >> >> http://en.wikipedia.org/wiki/Fair_use >> > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ids / ips survey
Scarier yet is that the system is from a part of the internet in IDS/IPS blacklist territory. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Harry Hoffman Sent: Wednesday, December 03, 2008 7:13 AM To: Ureleet Cc: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] ids / ips survey Or even more scary... that you would run a survey app on the same system that you do all of your monitoring from :-( On Wed, 2008-12-03 at 09:55 -0500, Ureleet wrote: > yeah, nice try. lets all just go click on the link that u post in fd. ! > > On Wed, Dec 3, 2008 at 7:57 AM, Erik van Dam <[EMAIL PROTECTED]> wrote: > > Dear All, > > > > 3 college students are doing an research project on IDS/IPS systems. If > > we just could use a some of your time to complete the survey we would > > very much be pleased! > > > > The survey is about which IDS/IPS systems is used, output reviewed etc.etc. > > > > Thank you very much for your time. > > > > Survey url: http://82.129.25.82/survey/index.php?sid=16247&newtest=Y > > > > > > Kind regards, > > Erik van Dam > > > > ___ > > Full-Disclosure - We believe in it. > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ NOTICE: This email and any attachments may contain confidential and proprietary information of NetSuite Inc and is for the sole use of the intended recipient for the stated purpose. Any improper use or distribution is prohibited and subject to legal sanctions. If you are not the intended recipient, please notify the sender; do not review, copy or distribute; and promptly delete or destroy all transmitted information. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [SECURITY] [DSA 1678-1] New perl packages fix privilege escalation
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1678-1 [EMAIL PROTECTED] http://www.debian.org/security/ Steffen Joeris December 03, 2008 http://www.debian.org/security/faq - Package: perl Vulnerability : design flaws Problem type : local Debian-specific: no CVE Id(s) : CVE-2008-5302 CVE-2008-5303 Debian Bug : 286905 286922 Paul Szabo rediscovered a vulnerability in the File::Path::rmtree function of Perl. It was possible to exploit a race condition to create setuid binaries in a directory tree or remove arbitrary files when a process is deleting this tree. This issue was originally known as CVE-2005-0448 and CVE-2004-0452, which were addressed by DSA-696-1 and DSA-620-1. Unfortunately, they were reintroduced later. For the stable distribution (etch), these problems have been fixed in version 5.8.8-7etch5. For the unstable distribution (sid), these problems have been fixed in version 5.10.0-18 and will migrate to the testing distribution (lenny) shortly. We recommend that you upgrade your perl packages. Upgrade instructions - wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - --- Source archives: http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8-7etch5.dsc Size/MD5 checksum: 750 a57837967b7420057558cab7efca9202 http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8.orig.tar.gz Size/MD5 checksum: 12829188 b8c118d4360846829beb30b02a6b91a7 http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8-7etch5.diff.gz Size/MD5 checksum: 105052 cfd4c3d27c5a7a342c441383867dae89 Architecture independent packages: http://security.debian.org/pool/updates/main/p/perl/libcgi-fast-perl_5.8.8-7etch5_all.deb Size/MD5 checksum:41082 9dfa8758852aadcaadb2edbdfa17f942 http://security.debian.org/pool/updates/main/p/perl/perl-doc_5.8.8-7etch5_all.deb Size/MD5 checksum: 7378812 3baade38d4a703ae7db0e2f7d7b2df62 http://security.debian.org/pool/updates/main/p/perl/perl-modules_5.8.8-7etch5_all.deb Size/MD5 checksum: 2316518 dc45e7d6fbedf992db42f31326457df2 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8-7etch5_alpha.deb Size/MD5 checksum: 4150162 345ac6cfebda2d2e6807a1dc0e14957c http://security.debian.org/pool/updates/main/p/perl/libperl5.8_5.8.8-7etch5_alpha.deb Size/MD5 checksum: 1006 f010eb97c3f81b2958c7546ba69296eb http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.8.8-7etch5_alpha.deb Size/MD5 checksum: 2928894 52f0aa7e688e63cd4d487a6492d9ee2e http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.8.8-7etch5_alpha.deb Size/MD5 checksum:36236 eb16c8490e1e164ef6444f4b7680fbc6 http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.8.8-7etch5_alpha.deb Size/MD5 checksum: 821796 d48d9e6f1a07eafdc6acb6d990cf1fbc http://security.debian.org/pool/updates/main/p/perl/perl-base_5.8.8-7etch5_alpha.deb Size/MD5 checksum: 880174 f32a7823fd919ada981b3eda1abe6a70 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.8.8-7etch5_amd64.deb Size/MD5 checksum: 630776 4f134545671885f476770a9da3695301 http://security.debian.org/pool/updates/main/p/perl/perl-base_5.8.8-7etch5_amd64.deb Size/MD5 checksum: 806610 02ed83b2872342eb732c0179daa52869 http://security.debian.org/pool/updates/main/p/perl/perl-suid_5.8.8-7etch5_amd64.deb Size/MD5 checksum:32774 4db9f5a96272f4a561abadbc3a1ed175 http://security.debian.org/pool/updates/main/p/perl/perl_5.8.8-7etch5_amd64.deb Size/MD5 checksum: 4248964 b09695271b26cb6b6245a791e9e7122d http://security.debian.org/pool/updates/main/p/perl/perl-debug_5.8.8-7etch5_amd64.deb Size/MD5 checksum: 2735132 c8bb2c571273b1ef47beb05874ae4277 http://security.debian.org/pool/updates/main/p/perl/libperl5.8_5.8.8-7etch5_amd64.deb Size/MD5 checksum: 1010 4223d65b463272ca026ee7e7d7d0ff02 arm architecture (ARM) http://security.debian.org/pool/updates/main/p/perl/libperl5.8_5.8.8-7etch5_arm.deb Size/MD5 checksum: 1008 fd5146b7fceeb55c7ba16831e95f0b4a http://security.debian.org/pool/updates/main/p/perl/libperl-dev_5.8.8-7etch5_arm.deb Size/MD5 checksum: 562112 24fe7aacf39d42673555f228e6edd5d7
Re: [Full-disclosure] More proof that Microsoft products are probably backdoored
If there's a peace of shit around here that should be flushed, it's only you n3tcr4p No one like you, get the fuck back on your kiddie mailing list/group. 2008/12/3 n3td3v <[EMAIL PROTECTED]> > You're like a shite that won't flush away. > > On Tue, Dec 2, 2008 at 6:11 PM, Ureleet <[EMAIL PROTECTED]> wrote: > > all speculation: > > > > no 1 knows 4 sure. > > > > http://it.slashdot.org/article.pl?sid=07/12/17/1754257&from=rss > > > > http://www.cnn.com/TECH/computing/9909/03/windows.nsa.02/ > > > > http://www.theforbiddenknowledge.com/hardtruth/nsa_backdoor_windows.htm > > > > c how i did that n3td3v? i posted links, nd talked about the article > > w/out stealing ppls work. > > > > pay attention. > > > > > > On Tue, Dec 2, 2008 at 9:36 AM, Andy McKnight <[EMAIL PROTECTED]> > wrote: > >> 2008/12/2 Ureleet <[EMAIL PROTECTED]> > >>> > >>> u arent getting it. > >>> > >>> it has nothing 2 do w/ backdoors. they r talking about actual > >>> backdoors in the code. so that anyone who knows the backdoor can > >>> acess any windows system regarless. they r saying that microsoft has > >>> coded backdoors into the system so that the govt can get into any > >>> system, patched or not. pay attention. > >> > >> I haven't seen anything that suggests that systems are/will be > backdoored > >> here. The text of the statement said "remote searches" which in legal > terms > >> could be anything from something as simple as browsing shared files > >> available through P2P to full remote system access. > >> > >> Do you have anything else that suggests Windows has backdoors present > other > >> than this statement? > >> > > > > ___ > > Full-Disclosure - We believe in it. > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ids / ips survey
Or even more scary... that you would run a survey app on the same system that you do all of your monitoring from :-( On Wed, 2008-12-03 at 09:55 -0500, Ureleet wrote: > yeah, nice try. lets all just go click on the link that u post in fd. ! > > On Wed, Dec 3, 2008 at 7:57 AM, Erik van Dam <[EMAIL PROTECTED]> wrote: > > Dear All, > > > > 3 college students are doing an research project on IDS/IPS systems. If > > we just could use a some of your time to complete the survey we would > > very much be pleased! > > > > The survey is about which IDS/IPS systems is used, output reviewed etc.etc. > > > > Thank you very much for your time. > > > > Survey url: http://82.129.25.82/survey/index.php?sid=16247&newtest=Y > > > > > > Kind regards, > > Erik van Dam > > > > ___ > > Full-Disclosure - We believe in it. > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ids / ips survey
Ureleet wrote: > yeah, nice try. lets all just go click on the link that u post in fd. ! > > On Wed, Dec 3, 2008 at 7:57 AM, Erik van Dam <[EMAIL PROTECTED]> wrote: >> Dear All, >> >> 3 college students are doing an research project on IDS/IPS systems. If >> we just could use a some of your time to complete the survey we would >> very much be pleased! >> >> The survey is about which IDS/IPS systems is used, output reviewed etc.etc. >> >> Thank you very much for your time. >> >> Survey url: http://82.129.25.82/survey/index.php?sid=16247&newtest=Y >> >> >> Kind regards, >> Erik van Dam >> >> ___ >> Full-Disclosure - We believe in it. >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> Hosted and sponsored by Secunia - http://secunia.com/ >> > It's an real survey, but thank you for your paranoism. -- Met vriendelijke groet, Erik van Dam ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] More proof that Microsoft products are probably backdoored
pot kettle black On Wed, Dec 3, 2008 at 3:34 AM, n3td3v <[EMAIL PROTECTED]> wrote: > You're like a shite that won't flush away. > > On Tue, Dec 2, 2008 at 6:11 PM, Ureleet <[EMAIL PROTECTED]> wrote: >> all speculation: >> >> no 1 knows 4 sure. >> >> http://it.slashdot.org/article.pl?sid=07/12/17/1754257&from=rss >> >> http://www.cnn.com/TECH/computing/9909/03/windows.nsa.02/ >> >> http://www.theforbiddenknowledge.com/hardtruth/nsa_backdoor_windows.htm >> >> c how i did that n3td3v? i posted links, nd talked about the article >> w/out stealing ppls work. >> >> pay attention. >> >> >> On Tue, Dec 2, 2008 at 9:36 AM, Andy McKnight <[EMAIL PROTECTED]> wrote: >>> 2008/12/2 Ureleet <[EMAIL PROTECTED]> u arent getting it. it has nothing 2 do w/ backdoors. they r talking about actual backdoors in the code. so that anyone who knows the backdoor can acess any windows system regarless. they r saying that microsoft has coded backdoors into the system so that the govt can get into any system, patched or not. pay attention. >>> >>> I haven't seen anything that suggests that systems are/will be backdoored >>> here. The text of the statement said "remote searches" which in legal terms >>> could be anything from something as simple as browsing shared files >>> available through P2P to full remote system access. >>> >>> Do you have anything else that suggests Windows has backdoors present other >>> than this statement? >>> >> >> ___ >> Full-Disclosure - We believe in it. >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> Hosted and sponsored by Secunia - http://secunia.com/ >> > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] ids / ips survey
yeah, nice try. lets all just go click on the link that u post in fd. ! On Wed, Dec 3, 2008 at 7:57 AM, Erik van Dam <[EMAIL PROTECTED]> wrote: > Dear All, > > 3 college students are doing an research project on IDS/IPS systems. If > we just could use a some of your time to complete the survey we would > very much be pleased! > > The survey is about which IDS/IPS systems is used, output reviewed etc.etc. > > Thank you very much for your time. > > Survey url: http://82.129.25.82/survey/index.php?sid=16247&newtest=Y > > > Kind regards, > Erik van Dam > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Iran executes IT expert who spied for Israel
hes not a troll andrew. he brings up good points. u nd i are the only trolls here. i only troll u. you troll every1. On Wed, Dec 3, 2008 at 6:48 AM, n3td3v <[EMAIL PROTECTED]> wrote: > Thank you for the self vaildation otherwise I wouldn't know you were > an alias/troll. > > On Wed, Dec 3, 2008 at 10:22 AM, Viktor Larionov > <[EMAIL PROTECTED]> wrote: >> Viktor Larionov >> snr. system administrator >> R&D team >> Salva Kindlustuse AS >> Parnu mnt. 16 >> 10141 Tallinn >> ESTONIA >> tel: (+372) 683 0636, (+372) 680 0500 >> fax: (+372) 680 0501 >> gsm: (+372) 5668 6811 >> [EMAIL PROTECTED] > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] News for Ureleet
luky 4 us, u arent any of the 3. thats a load off of our minds. On Wed, Dec 3, 2008 at 3:43 AM, n3td3v <[EMAIL PROTECTED]> wrote: > I don't write news articles and I copy and paste abstracts from them, > welcome to fair use. If I wanted to be a news journalist I wouldn't be > a security researcher and ethical hacker. > > http://en.wikipedia.org/wiki/Fair_use > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Sonicwall license servers down .. all customers affected
> https://licensemanager.sonicwall.com/newui/admin/admin.jsp > > thats hilarious - it MUST be a kind of honeypot :P > I think they threw up a new licensemanager server without reviewing the config .. it allows directory enumeration on a lot of pages (including the root). This one is interesting : https://licensemanager.sonicwall.com/js/ClientValidationMethods.js Seems remote debug is on as well : https://licensemanager.sonicwall.com/mf/fwregister_done.jsp Cheers, Michael Holstein CISSP GCIA Cleveland State University ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] ids / ips survey
Dear All, 3 college students are doing an research project on IDS/IPS systems. If we just could use a some of your time to complete the survey we would very much be pleased! The survey is about which IDS/IPS systems is used, output reviewed etc.etc. Thank you very much for your time. Survey url: http://82.129.25.82/survey/index.php?sid=16247&newtest=Y Kind regards, Erik van Dam ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [SVRT-06-08] MULTI SECURITY VULNERABILITIES IN MVNFORUM
MULTI SECURITY VULNERABILITIES IN MVNFORUM 1. General Information mvnForum is software used for creating forums on the Internet (http://www.mvnforum.com). This is an open source software making use of Java J2EE (ISP/Servlet) technology. On September 6 2008, SVRT-Bkis found several CSRF and XSS vulnerabilities in some functions of mvnForum 1.2 GA. These are highly serious vulnerabilities allowing hackers to perform privilege escalation attack on the Forum. We have contacted the development team and they have patched all those vulnerabilities in the latest version of mvnForum 1.2.1 GA. Details : http://security.bkis.vn/?p=286 SVRT Advisory : SVRT-06-08 Initial vendor notification : 30-10-2008 Release Date : 03-12-2008 Update Date : 03-12-2008 Discovered by : SVRT-Bkis Attack Type : CSRF, XSS Security Rating : Critical Impact : Privilege escalation Affected Software : mvnForum (version <= 1.2 GA) 2. Technical Description We have detected five vulnerabilities in different functions of mvnForum, four of which are CSRF (Cross-site request forgery) flaw and the other is an XSS (Cross-site scripting) flaw. More precisely, four CSRF vulnerabilities make way for hackers to escalate their privilege on such forum by tricking the administrator to perform some task without asking him/her for confirmation. Tasks relating to these four vulnerabilities are: - Creating a new forum where the hacker is the administrator. - Raise the privilege of an arbitrary account. - Give an arbitrary account the sub-forum administrator privilege. - Enable or disable an arbitrary account. The XSS vulnerability is in the "Who's online" function of the forum. If hackers successfully exploit this flaw, malicious code (JavaScript) will be executed whenever the administrator view information with this function. 3. Solution Rating these highly critical vulnerabilities, Bkis Center recommends that all units, organizations and individuals using mvnForum should immediately update their forums with the latest version of the application here: http://sourceforge.net/project/showfiles.php?group_id=65527&package_id=63007 4. Credit Thanks Dau Huy Ngoc for working with SVRT-Bkis SVRT, which is short for Security Vulnerability Research Team, is one of Bkis researching groups. SVRT specializes in the detection, alert and announcement of security vulnerabilities in software, operating systems, network protocols and embedded systems. Bach Khoa Internetwork Security Center (BKIS) Hanoi University of Technology (Vietnam) Email : [EMAIL PROTECTED] Website : www.bkav.com.vn WebBlog : http://security.bkis.vn Our PGP : http://security.bkis.vn/policy/pgp/SVRT-Bkis.gpg . SVRT-Bkis ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Iran executes IT expert who spied for Israel
Thank you for the self vaildation otherwise I wouldn't know you were an alias/troll. On Wed, Dec 3, 2008 at 10:22 AM, Viktor Larionov <[EMAIL PROTECTED]> wrote: > Viktor Larionov > snr. system administrator > R&D team > Salva Kindlustuse AS > Parnu mnt. 16 > 10141 Tallinn > ESTONIA > tel: (+372) 683 0636, (+372) 680 0500 > fax: (+372) 680 0501 > gsm: (+372) 5668 6811 > [EMAIL PROTECTED] ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [SECURITY] [DSA 1679-1] New awstats packages fix cross-site scripting
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1679-1 [EMAIL PROTECTED] http://www.debian.org/security/ Florian Weimer December 03, 2008 http://www.debian.org/security/faq - Package: awstats Vulnerability : cross-site scripting Problem type : remote Debian-specific: no CVE Id(s) : CVE-2008-3714 Debian Bug : 495432 Morgan Todd discovered a cross-site scripting vulnerability in awstats, a log file analyzer, involving the "config" request parameter (and possibly others; CVE-2008-3714). For the stable distribution (etch), this problem has been fixed in version 6.5+dfsg-1+etch1. The unstable (sid) and testing (lenny) distribution will be fixed soon. We recommend that you upgrade your awstats package. Upgrade instructions - wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - --- Source archives: http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfsg-1+etch1.diff.gz Size/MD5 checksum:20369 bbe38406f0402fd5b7be2d0a427223c8 http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfsg-1+etch1.dsc Size/MD5 checksum: 1079 2fd97dfcfcbf48cbe0e4a1a431cb43bd http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfsg.orig.tar.gz Size/MD5 checksum: 1041837 af6cbfbf470eb45f5238501813d6d1c6 Architecture independent packages: http://security.debian.org/pool/updates/main/a/awstats/awstats_6.5+dfsg-1+etch1_all.deb Size/MD5 checksum: 837326 878a4f0ab2ccb36c324c0c171a6a39b5 These files will probably be moved into the stable distribution on its next update. - - For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: [EMAIL PROTECTED] Package info: `apt-cache show ' and http://packages.debian.org/ -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.9 (GNU/Linux) iQEcBAEBAgAGBQJJNmdTAAoJEL97/wQC1SS+TcAIAIfJIHGr+9Rk31245IzedbFO 7STJngHclEAe4O88FKG98nn3nu0jme42HXaWF48hXqLe/IOMclTtorr1y91EXJeq 584oMZsN62OWVZClmpyc7qHBxytZkpFsUSQvmyA09LaCoQRI9x+dcdHN0OzKzFM0 M0KmaOR5uwVwCZMYbg4yxPi8PiACdPCOGquuZlz2cXVUI4DP18NEhK7T5wqol7KO 5WsAZqFTCq+TtVkJuVp9PVqr1XD+LnVfF3DIToAyWPT3gOUSP3Kh4/j50giV13JD Q/xTUooKm6L8Lo6wljtVYBdMIyiT2deiBp7z0nsotKG4p8Fw/0lTuJ4KkW/Ag2Q= =Cb7U -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Iran executes IT expert who spied for Israel
My friend, I may disagree with Gadi on some points, but from my personal experience Gadi is a really nice aguy, and it's nice to chat with him. But let this be my personal oppinion, you shouldn't necessarily agree with me. This or that way, from my personal point of view, I would never wish anybody, even you, to end up in Iranian prison waiting for the execution. (and it's not code execution I'm talking about :) If you are still missing the point, you could just make a simple Google on the topic to see what is it all about, e.g. here: http://www.iran-e-sabz.org/news/torture.htm It's kind of nice and cousy to sit somewhere in the US or UK in your nice and cousy wheelchair making fun of someone's death...come to think about it - kind of makes me sick. And that's really kind of a bad subject to make fun of. I seriously doubt you can name yourself ethical (hacker or whatever you are) in the context of such statements. And I'm not even mentioning that we are talking cyber security around here - I guess going on personalities doesn't really match with the topic. For all other, sorry for the offtop. This netdev/ur3l33t stuff starts to get on my nerves too. Cheers! Viktor --- Viktor Larionov snr. system administrator R&D team Salva Kindlustuse AS Parnu mnt. 16 10141 Tallinn ESTONIA tel: (+372) 683 0636, (+372) 680 0500 fax: (+372) 680 0501 gsm: (+372) 5668 6811 [EMAIL PROTECTED] -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of n3td3v Sent: Wednesday, December 03, 2008 11:54 AM To: full-disclosure@lists.grok.org.uk Subject: Re: [Full-disclosure] Iran executes IT expert who spied for Israel Did anyone think Gadi when they read this? On Mon, Dec 1, 2008 at 10:25 PM, n3td3v <[EMAIL PROTECTED]> wrote: > -- Forwarded message -- > From: n3td3v <[EMAIL PROTECTED]> > Date: Mon, Dec 1, 2008 at 10:23 PM > Subject: Iran executes IT expert who spied for Israel > To: n3td3v <[EMAIL PROTECTED]> > > > "A COMPUTER expert has been executed in Iran after he confessed to > working for Mossad, the Israeli intelligence service. This provides a > rare insight into the intense espionage activity inside the Islamic > republic." > > http://www.timesonline.co.uk/tol/news/world/middle_east/article5258057.ece > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Iran executes IT expert who spied for Israel
Did anyone think Gadi when they read this? On Mon, Dec 1, 2008 at 10:25 PM, n3td3v <[EMAIL PROTECTED]> wrote: > -- Forwarded message -- > From: n3td3v <[EMAIL PROTECTED]> > Date: Mon, Dec 1, 2008 at 10:23 PM > Subject: Iran executes IT expert who spied for Israel > To: n3td3v <[EMAIL PROTECTED]> > > > "A COMPUTER expert has been executed in Iran after he confessed to > working for Mossad, the Israeli intelligence service. This provides a > rare insight into the intense espionage activity inside the Islamic > republic." > > http://www.timesonline.co.uk/tol/news/world/middle_east/article5258057.ece > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Sonicwall license servers down .. all customers affected
https://licensemanager.sonicwall.com/newui/admin/admin.jsp thats hilarious - it MUST be a kind of honeypot :P 2008/12/3 Rob Thompson <[EMAIL PROTECTED]>: > IT Security wrote: >> DRM schemes like this only cause problems for the LEGITIMATE customers . > > And to think that you paid a very good amount of money for that level of > service. > > We all know that there is no level of DRM that can protect anything. > Where there is a will, there is a way. Your statement of affecting only > legitimate customers is dead on the money. > > Time to start voting with dollars and holding companies accountable. > This state of eating whatever they spoon feed to us needs to end. We > all allowed this to happen. > >> >> >> >> >> ___ >> Full-Disclosure - We believe in it. >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> Hosted and sponsored by Secunia - http://secunia.com/ > > > -- > Rob > > +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+ > | _ | > | ASCII ribbon campaign ( ) | > | - against HTML email X | > |/ \ | > | | > +-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+ > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Big database for email and mobile text messages expected to be scrapped by Queen
I hope they enjoy reading my emails, isn't that right Mi5, even though you've been reading them for years and this bill *idea* was just there to test public opinion to see if an age old intelligence service operation would be accepted by the British public. :) Fraid not old sunshine, though we know you're watching us anyway. All the best and stuff, n3td3v. On Wed, Dec 3, 2008 at 9:13 AM, n3td3v <[EMAIL PROTECTED]> wrote: > A communications data Bill, paving the way for a massive database of > phone calls and emails, and a heritage protection Bill are also said > to have been scrapped to make way for economic measures. > > http://news.sky.com/skynews/Home/Politics/The-Queens-Speech-Expected-To-Have-Economic-Measures-At-Its-Heart/Article/200812115171233?lpos=Politics_First_Home_Article_Teaser_Region_1&lid=ARTICLE_15171233_The_Queens_Speech_Expected_To_Have_Economic_Measures_At_Its_Heart > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Big database for email and mobile text messages expected to be scrapped by Queen
A communications data Bill, paving the way for a massive database of phone calls and emails, and a heritage protection Bill are also said to have been scrapped to make way for economic measures. http://news.sky.com/skynews/Home/Politics/The-Queens-Speech-Expected-To-Have-Economic-Measures-At-Its-Heart/Article/200812115171233?lpos=Politics_First_Home_Article_Teaser_Region_1&lid=ARTICLE_15171233_The_Queens_Speech_Expected_To_Have_Economic_Measures_At_Its_Heart ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] News for Ureleet
I don't write news articles and I copy and paste abstracts from them, welcome to fair use. If I wanted to be a news journalist I wouldn't be a security researcher and ethical hacker. http://en.wikipedia.org/wiki/Fair_use ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] More proof that Microsoft products are probably backdoored
You're like a shite that won't flush away. On Tue, Dec 2, 2008 at 6:11 PM, Ureleet <[EMAIL PROTECTED]> wrote: > all speculation: > > no 1 knows 4 sure. > > http://it.slashdot.org/article.pl?sid=07/12/17/1754257&from=rss > > http://www.cnn.com/TECH/computing/9909/03/windows.nsa.02/ > > http://www.theforbiddenknowledge.com/hardtruth/nsa_backdoor_windows.htm > > c how i did that n3td3v? i posted links, nd talked about the article > w/out stealing ppls work. > > pay attention. > > > On Tue, Dec 2, 2008 at 9:36 AM, Andy McKnight <[EMAIL PROTECTED]> wrote: >> 2008/12/2 Ureleet <[EMAIL PROTECTED]> >>> >>> u arent getting it. >>> >>> it has nothing 2 do w/ backdoors. they r talking about actual >>> backdoors in the code. so that anyone who knows the backdoor can >>> acess any windows system regarless. they r saying that microsoft has >>> coded backdoors into the system so that the govt can get into any >>> system, patched or not. pay attention. >> >> I haven't seen anything that suggests that systems are/will be backdoored >> here. The text of the statement said "remote searches" which in legal terms >> could be anything from something as simple as browsing shared files >> available through P2P to full remote system access. >> >> Do you have anything else that suggests Windows has backdoors present other >> than this statement? >> > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
