Re: [Full-disclosure] Sendmail/Postfix Storybook

2007-12-15 Thread [EMAIL PROTECTED]
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 doesnt look remote to me since you need to upload the malicious .forward file in the home, much a local bug allowing remote exec rather than a remote bug. kcope wrote: Look, it's the Sendmail/postfix the Storybook

Re: [Full-disclosure] Sendmail/Postfix Storybook

2007-12-15 Thread fabio
wtf? remote exploit? you need an user account and all you get is.. a command executed by the same user account. Isn't easier just to login on the box? CtrlAltCa kcope wrote: Look, it's the Sendmail/postfix the Storybook

Re: [Full-disclosure] Sendmail/Postfix Storybook

2007-12-15 Thread reepex
So a kid posts his first found exploit to every mailing list and you are going to bash him? If you scare him off or discourage him then we wont get code and screenshots from his future high-risk 0day. On Dec 15, 2007 7:29 AM, fabio [EMAIL PROTECTED] wrote: wtf? remote exploit? you need an

Re: [Full-disclosure] Small Design Bug in Postfix - REMOTE

2007-12-15 Thread reepex
this kid spent many hard hours reading man pages looking for 0day, gives it to us along with hello world python networking code ( that is incapable of parsing replies so any unintended behaviour causes exit), and you are going to bash it? You are probably just jealous you do not have the

Re: [Full-disclosure] [Professional IT Security Providers - Exposed] Cyberklix ( F+ )

2007-12-15 Thread reepex
I have been following your blog alot and think the idea is really awesome but this one line... On Dec 13, 2007 2:23 PM, secreview [EMAIL PROTECTED] wrote: true Ethical Hacker talent. Was this meant to be humorous? You realize that 'ethical hacker' ( as in the certification) is a bunch of X

Re: [Full-disclosure] [Professional IT Security Providers - Exposed] Cyberklix ( F+ )

2007-12-15 Thread SecReview
Reepex, unlike you we do not subscribe to definitions as set fourth by such certification. Did you like working for geek squad? ;) Thanks for reading. On Sat, 15 Dec 2007 08:58:36 -0500 reepex [EMAIL PROTECTED] wrote: I have been following your blog alot and think the idea is really awesome

[Full-disclosure] Thomas Ptacek and Wikipedia

2007-12-15 Thread Gobbles is back
ALERT ALERT Quick cheeky posting by unknown gobble member staff over Thomas Ptacek's latest Wikipedia absurdness. lol ... Finally Symantec has taken notice, and started to add there own stuff to SF .. FINALLY !!! http://turkeychargen.blogspot.com ___

Re: [Full-disclosure] Thomas Ptacek and Wikipedia

2007-12-15 Thread coderman
On Dec 14, 2007 8:22 AM, Gobbles is back [EMAIL PROTECTED] wrote: ... Quick cheeky posting by unknown gobble member staff over Thomas Ptacek's latest Wikipedia absurdness. PS: Your Homework Assignments Thomas Ptacek to retract all stupid commentary from world wide web. examples: I don't think

Re: [Full-disclosure] Thomas Ptacek and Wikipedia

2007-12-15 Thread coderman
On Dec 15, 2007 2:51 PM, coderman [EMAIL PROTECTED] wrote: ... I don't think this is a timing attack; it's a side-channel attack that exploits the fact that OpenSSL's impact on the branch prediction cache leaks information. someone says to me, Branch Prediction Analysis side channel attacks