Re: [Full-disclosure] Re: MSIE (mshtml.dll) OBJECT tag vulnerability

2006-04-26 Thread Valdis . Kletnieks
On Wed, 26 Apr 2006 09:22:30 +0400, Raoul Nakhmanson-Kulish said: Hello, [EMAIL PROTECTED] There are two major products that come out of Berkeley: LSD and UNIX. It's well-know fact that D-lysergic acid diethylamide is come out from Sandoz company lab and is synthesized by Dr. Albert

Re: [Full-disclosure] Re: MSIE (mshtml.dll) OBJECT tag vulnerability

2006-04-26 Thread Raoul Nakhmanson-Kulish (en)
Hello, [EMAIL PROTECTED] And in any case, I was merely correcting the misquote. You don't like like the quote, take it up with Jeremy Anderson and the person who misquoted him. ;) Sorry for misquoting :) of course, UNIX development is a manifestation of spirit of the sixties either as the

[Full-disclosure] [SECURITY] [DSA 1043-1] New abcmidi packages fix arbitrary code execution

2006-04-26 Thread Martin Schulze
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 1043-1[EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze April 26th, 2006

Re: [Full-disclosure] Re: MSIE (mshtml.dll) OBJECT tag vulnerability

2006-04-26 Thread 0x80
How did this get from a bunch of euro cock smokers selling out to Microsoft to arguing over an old, and amusing, quote? On Tue, 25 Apr 2006 23:03:33 -0700 [EMAIL PROTECTED] wrote: On Wed, 26 Apr 2006 09:22:30 +0400, Raoul Nakhmanson-Kulish said: Hello, [EMAIL PROTECTED] There are two major

Re: [Full-disclosure] Re: MSIE (mshtml.dll) OBJECT tag vulnerability

2006-04-26 Thread Javor Ninov
Dave No, not that one Korn wrote: Sol Invictus wrote: I also remember LSD pesters Microsoft and they were rapidly sold out. I knew those guys were on something when they created Windows!!! They had Dealers sell out of LSD ROFLMAO Don't talk crazy. Everyone knows what

Re: [Full-disclosure] nasa goddard space flight center stolen files

2006-04-26 Thread RPM Security Lists
Knock knock[EMAIL PROTECTED] or [EMAIL PROTECTED] : who's there?FBI: We're here to clean the gene pool.On 4/25/06, MR BABS [EMAIL PROTECTED] wrote: These files are worthless, they aren't even classified.Thanks alot for the offer asshole. Spam - Full Disclosure. On 4/25/06, [EMAIL PROTECTED]

[Full-disclosure] Cisco Security Advisory: Cisco VPN 3000 Concentrator Vulnerable to Crafted HTTP Attack

2006-04-26 Thread Cisco Systems Product Security Incident Response Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Cisco Security Advisory: Cisco VPN 3000 Concentrator Vulnerable to Crafted HTTP Attack Advisory ID: cisco-sa-20060126-vpn http://www.cisco.com/warp/public/707/cisco-sa-20060126-vpn.shtml Revision 2.0 Last Updated 26 April 2006 1600 UTC (GMT)

[Full-disclosure] [ GLSA 200604-16 ] xine-lib: Buffer overflow vulnerability

2006-04-26 Thread Sune Kloppenborg Jeppesen
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200604-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] Should I Be Worried?

2006-04-26 Thread CrYpTiC MauleR
After reading http://www.securityfocus.com/news/11389 it made me think twice about actually going public with my school's security hole by having school notify students, parents and/or faculty at risk due to it. I mean I didnt access any records, just knew that it was possible for someone to

Re: [Full-disclosure] Should I Be Worried?

2006-04-26 Thread bkfsec
CrYpTiC MauleR wrote: After reading http://www.securityfocus.com/news/11389 it made me think twice about actually going public with my school's security hole by having school notify students, parents and/or faculty at risk due to it. I mean I didnt access any records, just knew that it was

Re: [Full-disclosure] Should I Be Worried?

2006-04-26 Thread Andrew A
Your list troll was pretty lol.I commend you.On 4/26/06, CrYpTiC MauleR [EMAIL PROTECTED] wrote:After reading http://www.securityfocus.com/news/11389 it made me think twice about actually going public with my school's security hole by having school notify students, parents and/or faculty at risk

Re: [Full-disclosure] Should I Be Worried?

2006-04-26 Thread CrYpTiC MauleR
Forgot to say that the VP of Software Dev who is in charge of the site said he would do an emergency fix in 6 hours to fix the problem. As I expected the problem is still there. Either he is a moron and didn't understand me or they just tried to give the impression they were fixing it. So sad

Re: [Full-disclosure] Should I Be Worried?

2006-04-26 Thread Gary E. Miller
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Yo CrYpTiC! On Wed, 26 Apr 2006, CrYpTiC MauleR wrote: Forgot to say that the VP of Software Dev who is in charge of the site s aid he would do an emergency fix in 6 hours to fix the problem. As I exp ected the problem is still there. Either he

Re: [Full-disclosure] Should I Be Worried?

2006-04-26 Thread 0x80
If you didnt break the law who cares. On Wed, 26 Apr 2006 11:30:02 -0700 CrYpTiC MauleR [EMAIL PROTECTED] wrote: After reading http://www.securityfocus.com/news/11389 it made me think twice about actually going public with my school's security hole by having school notify students, parents

[Full-disclosure] Secunia Research: SpeedProject Products ACE Archive Handling Buffer Overflow

2006-04-26 Thread Secunia Research
== Secunia Research 26/04/2006 - SpeedProject Products ACE Archive Handling Buffer Overflow - == Table of Contents Affected

[Full-disclosure] MSIE (mshtml.dll) OBJECT tag vulnerability

2006-04-26 Thread Tim Bilbro
Title: [Full-disclosure] MSIE (mshtml.dll) OBJECT tag vulnerability You do a disservice to all IT shops by announcing these vulnerabilities before contacting the vendor. I am sure it would not generate as much web traffic to your site, but it is only fair and right to allow at least some

[Full-disclosure] [EEYEB-20060227] Juniper Networks SSL-VPN Client Buffer Overflow

2006-04-26 Thread eEye Advisories
Juniper Networks SSL-VPN Client Buffer Overflow Release Date: April 25, 2006 Date Reported: February 27, 2006 Patch Development Time (In Days): 57 Days Severity: High (Remote Code Execution) Vendor: Juniper Networks Software Affected: Juniper SSL-VPN JuniperSetup Control Operating Systems

Re: [Full-disclosure] Should I Be Worried?

2006-04-26 Thread Valdis . Kletnieks
On Wed, 26 Apr 2006 12:52:49 PDT, [EMAIL PROTECTED] said: If you didnt break the law who cares. If there's a knock at the door, and 3 agents come in with handcuffs, evidence bags, a warrant for your arrest, and a search warrant to confiscate your computer, and you have to make bail and hire a

[Full-disclosure] Seeking Anyone Harmed by Jason Coombs

2006-04-26 Thread Jason Coombs
Full disclosure goes both ways. Anyone who feels I have done them harm or who thinks I have something to hide should speak up now and make their record. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Brad Astrowsky Sent: Wednesday, April 26, 2006 10:44

Re: [Full-disclosure] MSIE (mshtml.dll) OBJECT tag vulnerability

2006-04-26 Thread bruen
Hi Tim, Perhaps instead of viewing this as breaking into locked doors and look at it as consumer product information, such as problems with my automobile, it would not appear as such a big deal. I like product recalls and keeping vendors honest. Product safety has improved significantly

Re: [Full-disclosure] MSIE (mshtml.dll) OBJECT tag vulnerability

2006-04-26 Thread Michal Zalewski
On Wed, 26 Apr 2006, Tim Bilbro wrote: You do a disservice to all IT shops by announcing these vulnerabilities before contacting the vendor. How were you impacted? What were your damages? The only loss that could possibly occur to you or your company was the time you wasted to write this rant,

Re[2]: [Full-disclosure] MSIE (mshtml.dll) OBJECT tag vulnerability

2006-04-26 Thread Thierry Zoller
Dear Michal Zalewski, MZ But that's for you to figure out what's wrong in that picture. Let's say your far away from Danemark ? ;) -- http://secdev.zoller.lu Thierry Zoller Fingerprint : 5D84 BFDC CD36 A951 2C45 2E57 28B3 75DD 0AC6 F1C7 ___

Re: [Full-disclosure] What is wrong with schools these days?

2006-04-26 Thread Paul Schmehl
Pavel Kankovsky wrote: On Tue, 25 Apr 2006, Paul Schmehl wrote: We haven't had a Windows box hacked in a long time. Does it include Windoze boxes possesed by malware? Such a box is not hacked in a strict sense but the difference is almost irrelevant (esp. when backdoors have become a

Re: [Full-disclosure] What is wrong with schools these days?

2006-04-26 Thread Nick Withers
On Wed, 26 Apr 2006 17:56:26 -0500 John Lightfoot [EMAIL PROTECTED] wrote: Peter Besenbruch wrote: snip Clueless people will always be with us. No OS is going to keep them safe, but some may do a better job than others. You seem successful in managing Windows boxes, but my experience is

Re: [Full-disclosure] MSIE (mshtml.dll) OBJECT tag vulnerability

2006-04-26 Thread Morning Wood
Your blog seems to suggest that you are also quite severely mistaken in regard to my identity. Secunia did not notify Microsoft ahead of time in order to allow for them to patch it before it became public. [...] Microsoft chided Zalewski [from Secunia] for jumping the gun and posting his

[Full-disclosure] Interesting but vulnerable scheme for tokenless auth

2006-04-26 Thread Glenn Everhart
Consider the following attempt at el-cheapo (no hardware) authentication (which occurred to me recently while reading some ads): It is possible to imagine an authentication scheme that wants to use something like a certificate with signing, encrypting random nonces etc., to verify that

Re: [Full-disclosure] Internet Explorer User Interface Races, Redeux

2006-04-26 Thread Robert Lemos
V. VENDOR RESPONSE * Microsoft was informed of this vulnerability on October 20, 2005. * As part of its December patch cycle, Microsoft issued the incomplete MS05-054 patch which plugged a specific instance of this issue that had been previously reported by Secunia. * MS05-054 does indeed

Re: [Full-disclosure] n3td3v outsmarts Google

2006-04-26 Thread n3td3v
On 4/26/06, Krpata, Tyler [EMAIL PROTECTED] wrote: Well gee, aren't you going to post an Official Netdev Critical Emergency Security Advisory about this one or what? Not this one, since its not security related. However, I have a passion for hacking web applications, and corporate backyard

RE: [Full-disclosure] n3td3v outsmarts Google

2006-04-26 Thread php0t
I do plan on releasing (more) multiple Google vulnerabilities soon, to keep in line with my past reputation. I promised not to reply to n3td3v related posts any more, but this one sentence became an exception because of the cola that found its way out through my nose when I read it and bursted

Re: [Full-disclosure] Internet Explorer User Interface Races, Redeux

2006-04-26 Thread Matthew Murphy
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 Robert Lemos wrote: Hi, Matt, thanks for this. Another 50 bucks is in the mail. This is exactly what I need to make the Securityfocus homepage exciting again. This Lemos spoof is rather entertaining, but not the least bit convincing. There

Re: [Full-disclosure] n3td3v outsmarts Google

2006-04-26 Thread Don Bailey
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 The bubbles were kind of painful, I have to give him credits for finding a 0day to cause pain to some remote guy using only email. Now *that* is comedy. Don north Bailey -BEGIN PGP SIGNATURE- Version: PGP Desktop 9.0.6 (Build 6060)

Re: [Full-disclosure] Internet Explorer User Interface Races, Redeux

2006-04-26 Thread Morning Wood
Game's up, n3td3v. You can quit hiding behind your fake Yahoo account now. Go away kid, before you hurt somebody. owned! ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by

[Full-disclosure] [ GLSA 200604-17 ] Ethereal: Multiple vulnerabilities in protocol dissectors

2006-04-26 Thread Sune Kloppenborg Jeppesen
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200604-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -