sendmail vuln advisories (CVE-2006-0058)

2006-03-23 Thread Marc Bejarano
the official advisory from http://www.sendmail.com/company/advisory/ === Sendmail MTA Security Vulnerability March 22, 2006 I. Overview Sendmail, Inc. has recently become aware of a security vulnerability in certain versions of sendmail Mail Transfer Agent (MTA) and UNIX and Linux products

[SECURITY] [DSA 1014-1] New firebird2 packages fix denial of service

2006-03-23 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1014-1[EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze March 23rd, 2006

[ MDKSA-2006:059 ] - Updated kernel packages fix multiple vulnerabilities

2006-03-23 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDKSA-2006:059 http://www.mandriva.com/security/

[SECURITY] [DSA 1016-1] New evolution packages fix arbitrary code execution

2006-03-23 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1016-1[EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze March 23rd, 2006

Re: sendmail vuln advisories (CVE-2006-0058)

2006-03-23 Thread Michal Zalewski
On Wed, 22 Mar 2006, Marc Bejarano wrote: a security vulnerability [...] certain versions [...] under some specific timing conditions [...] a specifically crafted attack [...] when specific conditions [...] within certain operating system architectures [...] certain timing conditions [...]

[ GLSA 200603-21 ] Sendmail: Race condition in the handling of asynchronous signals

2006-03-23 Thread Sune Kloppenborg Jeppesen
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200603-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[KAPDA::#37] - CoMoblog XSS

2006-03-23 Thread farhadkey
[KAPDA::#37] - CoMoblog XSS KAPDA New advisory CoMoblog XSS -- Bug: http://victim/path/img.php?i=[CODE] Vendor: http://www.easymoblog.org/ Vulnerable: CoMoblog 1.1 -- --

PasswordSafe 3.0 weak random number generator allows key recovery attack

2006-03-23 Thread info
Title : PasswordSafe 3.0 weak random number generator allows key recovery attack Date : March 23, 2006 Product : PasswordSafe 3.0 Discovered by : ElcomSoft Co.Ltd. Overview == PasswordSafe is a program

iDefense Security Advisory 03.23.05: ISS Multiple Products Local Privilege Escalation Vulnerability

2006-03-23 Thread labs-no-reply
ISS Multiple Products Local Privilege Escalation Vulnerability iDefense Security Advisory 03.23.05 http://www.idefense.com/intelligence/vulnerabilities/display.php?id=403 March 23, 2006 I. BACKGROUND Internet Security Systems (ISS) has developed a suite of tools aimed at securing server and

Re: PasswordSafe 3.0 weak random number generator allows key recovery attack

2006-03-23 Thread Dave Korn
[EMAIL PROTECTED] wrote: Title : PasswordSafe 3.0 weak random number generator allows key recovery attack Date : March 23, 2006 Product : PasswordSafe 3.0 Say, are you referring to /the/ PasswordSafe 3.0, you know, the one by that Schneier guy, the one that's on

Re: [Full-disclosure] SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)

2006-03-23 Thread Dragos Ruiu
On March 23, 2006 01:41 am, Gadi Evron wrote: Here's what ISS releasing the Race Condition vulnerability has to say: http://xforce.iss.net/xforce/alerts/id/216 They say it's a remote code execution. They say it's a race condition. No real data available to speak of. I can't see how it's

Sudo tricks

2006-03-23 Thread John Richard Moser
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 This is kind of dumb, just a quick response to some of the stuff I've been seeing floating around the past few days WRT sudo. I was toying with the idea of equivalating access to the account to access to root. Here is a simple hack to break sudo and

[HV-PAPER] Security Product Evaluation Tips

2006-03-23 Thread vuln
HexView is pleased to announce a publication on product evaluation techniques. The paper features 10 tips on how to perform an effective evaluation and choose the right product in the evolving information security market. The paper is targeted at the information security audiences in medium to

w3wp remote DoS

2006-03-23 Thread Debasis Mohanty
Sorry, if you are receiving multiple copies of it. Just resending as the one that I sent last night has not yet appeared. w3wp remote DoS due to improper reference of STA COM components in ASP.NET === Vendor: Microsoft