On Wed, 03 May 2006 22:23:42 PDT, Bill Stout said:
If a patch is ready in just a few days, and QA for a patch takes several
weeks, it would seem the vendor already knew about the vulnerability and
had a fix ready, either for next release or vulnerability discovery,
It would *seem* that way,
===
XOR Crew :: Security Advisory 0day GIVE AWAY (date?) 2/20/2006
===
Albinator Pro = 2.0.8 - Remote Command Execution Vulnerability
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
erm what do you mean with "new" documents
?
The old ones that cover shellcode, won't be any
different to a "new" document.
Its the same technics thereunless you want
polymorphic shellcode.
Just look at the phrack magazine, there you will
find papers regarding shellcode.
-sk
Hi to all!
Trying with a friend the latest Panda Antivirus we
have been found that is unable to detect the old I
Love You virus by simply changing the name of one
variable.
Attached goes a working I Love You virus in which I
changed ONLY the variable dirsystem with the name
kk2 (The file
Discovered by: Noam Rathaus using the beSTORM fuzzer.
Reported to vendor: December, 2005.
Vendor response: Microsoft does not consider this issue to be a security
vulnerability.
Public release date: 4th of May, 2006.
Advisory URL:
AVG detects it as LoveLetter.Database: 268.5.3/331 Database Date: 3/5/2006On 5/4/06, Joxean Koret wrote:
Sorry, the email was sended without the attachment.---Regards,Joxean Koret Attached goes a working I Love You virus in which I changed ONLY the variable dirsystem with the name
kk2 (The file
The AV system (Vexira MailArmor version 2.x) of local ISP detected is as
VBS/Loveletter.B:
Subject: Virus havaittu / Virus found
***
Virus found from your email
***
Virusprotection software found the following virus from an email message sent
to you:
My ISP caught it:
-
The Orange virus filtering service discovered a virus or unauthorised
code (e.g. spyware or trojan) in an email sent to you.
Message sender: [EMAIL PROTECTED]
Message recipient(s): [EMAIL PROTECTED]
Message subject: [Full-disclosure] RE: Panda
Great. Now we're going to have every freaking dork
with an AV posting about how their system detected it.
GOOD WORK, FUCKO.
__
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
The major point of the thread is that some of the most popular AV scanners used in big companies, do not detect it. Yea,
I did post that AVG scanner detected it. And also a few other people
did the same with their AV scanners. And that is scary because even
small or non-so-well-known av scanners
Affected software:
Bigwebmaster Guestbook version 1.02 and down
Vendor:
http://www.bigwebmaster.com/Perl/Scripts_and_Programs/Guestbooks/
Introduction:
(taken from vendor site)
This is one of the most powerful guestbooks that you will find on the
internet. Visitors who come to your site will be
Symantec Antivirus detected and removed it as VBS.LoveLetter.CI
version 10.0.1.1000
engine 61.1.0.11
defs 2006/05/03 rev.18
- Original Message -
From: Peter van den Houten [EMAIL PROTECTED]
To: full-disclosure@lists.grok.org.uk
Sent: Thursday, May 04, 2006 4:39 PM
Subject:
why do you consider this a vulnerability. the host parameter is client based and can't be trusted. many servers ignore it altogetherOn 5/4/06, beSIRT
[EMAIL PROTECTED] wrote:
Discovered by: Noam Rathaus using the beSTORM fuzzer.Reported to vendor: December, 2005.Vendor response: Microsoft does
Guys, these are signature-based systems...
LET ME SHED SOME LIGHT ON THIS, ALL SIGNATURE-BASED
SYSTEMS CAN BE SUBVERTED. THIS IS A KNOWN FACT PEOPLE
HAVE BEEN DISCUSSING FOR YEARS.
Let me be the first to welcome you to the year 1999.
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
WebCalendar is a PHP-based calendar application that can be configured
as a single-user calendar, a multi-user calendar for groups of users,
or as an event calendar viewable by visitors.
See project homepage for details: http://www.k5n.us/webcalendar.php
Description:
The problem is that
Yes, this is a beta product but I have reason to believe that this
issue will not be discovered of fixed by M$ before it goes to gold.
Why do I believe this? Because the issue is found in IE 6 but
doesnt seem to exploit. Not saying it is not exploitable I am
saying that I cant make it
On 5/5/06, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote:
Highest bidder that can convince me that you will actually pay
wins.
Whatever happened to sharing knowledge in a common way ... Honest, get
a life ...
Steph
___
Full-Disclosure - We believe in
What do you do for work? Are you paid to work with computers?
Do not judge others and how they choose to make a living. I am
doing nothing different than anyone else who has a skill and needs
to support family.
If you were smarter you wouldn't need me to share my knowledge in
any way now
Thanks Vladis,
That's an excellent and well thought out reply. Sounds like you have
some experience in delivering software.
It would seem that if a few days buffer were built into the system,
specifically to check in security fixes prior to QA; that would be a
huge 'CYA' benefit to prevent
I just found a second bug that allows one to remotely retrieve the
contents of other tabs inside of IE7.
Again, for sale. Highest bidder.
Exploit example is to trick luser to visiting website which would
then download contents of all open tabs including cookie and
session information.
On Thu, 04 May 2006 18:15:18 PDT, Bill Stout said:
That's an excellent and well thought out reply. Sounds like you have
some experience in delivering software.
Not commercial software. However, commercial software ship dates are
infinitely flexible compared to 30,000 students are showing up
On Thu, 04 May 2006 16:46:28 PDT, [EMAIL PROTECTED] said:
Highest bidder that can convince me that you will actually pay
wins.
As a spectator, I wonder who's going to bid on it, and how much, without any
clues as to what exactly the extent is (crash, code execution as user, code
exec as
[EMAIL PROTECTED] wrote:
As a spectator, I wonder who's going to bid on it, and how much, without any
clues as to what exactly the extent is (crash, code execution as user, code
exec as system, etc), or even any proof you have the goods.. ;)
If the guy provided more information, such as his
I can prove that I have the goods to those that are seriously
interested in buying.
On Thu, 04 May 2006 19:26:53 -0700 [EMAIL PROTECTED] wrote:
On Thu, 04 May 2006 16:46:28 PDT, [EMAIL PROTECTED] said:
Highest bidder that can convince me that you will actually pay
wins.
As a spectator, I
If you are interested in bidding. I can provide you wtih an
account to provide the funds. Social Security numbers are for
American citizens only so don't assume I am such a person.
On Thu, 04 May 2006 20:58:26 -0700 Peter Besenbruch [EMAIL PROTECTED]
wrote:
[EMAIL PROTECTED] wrote:
As a
[EMAIL PROTECTED] wrote:
If you are interested in bidding. I can provide you wtih an
account to provide the funds. Social Security numbers are for
American citizens only so don't assume I am such a person.
I'll start the bidding at $1.25 USD. Do you take checks?
I have a slighty used
Ahh and here come the clueless posts from those that have never
found a vulnerability themselves.
Sigh...
On Thu, 04 May 2006 21:51:50 -0700 Randal T. Rioux
[EMAIL PROTECTED] wrote:
[EMAIL PROTECTED] wrote:
If you are interested in bidding. I can provide you wtih an
account to provide the
28 matches
Mail list logo
