[Full-disclosure] VMSA-2008-0010 Updated Tomcat and Java JRE packages for VMware ESX 3.5

2008-06-16 Thread VMware Security Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - --- VMware Security Advisory Advisory ID: VMSA-2008-00010 Synopsis: Updated Tomcat and Java JRE packages for VMware ESX 3.5 Issue da

[Full-disclosure] Server freezed in Skulltag 0.97d2-RC2

2008-06-16 Thread Luigi Auriemma
### Luigi Auriemma Application: Skulltag http://www.skulltag.com Versions: <= 0.97d2-RC2 Platforms:Windows, Linux and FreeBSD Bug: loop during the parsing of the packe

[Full-disclosure] [ GLSA 200806-05 ] cbrPager: User-assisted execution of arbitrary code

2008-06-16 Thread Pierre-Yves Rofes
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200806-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[Full-disclosure] [ MDVSA-2008:115 ] - Updated x11-server packages fix several vulnerabilities

2008-06-16 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2008:115 http://www.mandriva.com/security/ ___

[Full-disclosure] [ GLSA 200806-06 ] Evolution: User-assisted execution of arbitrary code

2008-06-16 Thread Pierre-Yves Rofes
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200806-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

[Full-disclosure] NULL pointer in the HTTP/XML-RPC service of Crysis 1.21

2008-06-16 Thread Luigi Auriemma
### Luigi Auriemma Application: Crysis http://www.ea.com/crysis/home.jsp Versions: <= 1.21 (1.1.1.6156 showed as gamever) Platforms:Windows Bug: NULL pointer in the HT

[Full-disclosure] [ MDVSA-2008:116 ] - Updated x11-server packages fix several vulnerabilities

2008-06-16 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2008:116 http://www.mandriva.com/security/ ___

Re: [Full-disclosure] Security/Hacking Paper Contest Win $100

2008-06-16 Thread GSO GSO
I agree with you Michael not my finest hour. He just tweaked a nerve. As for the article content, it is driven by the users so I am sure we will have a bunch that will run range from Skiddie to the informed. B On Mon, Jun 16, 2008 at 2:05 PM, Michael Krymson <[EMAIL PROTECTED]> wrote: > I think I

Re: [Full-disclosure] Security/Hacking Paper Contest Win $100

2008-06-16 Thread GSO GSO
All rights are held by the authors Knud, I have no reason to want their work. Blake On Mon, Jun 16, 2008 at 1:20 PM, Archibald Tuttle <[EMAIL PROTECTED]> wrote: > Knud, > useless to reply, > but ,just guessing, all rights of posted papers will be then hold by > gso. > something like "How 2 pwn yo

Re: [Full-disclosure] Security/Hacking Paper Contest Win $100

2008-06-16 Thread Michael Krymson
I think I won $100 at Cub Scouts once...when I was 12. Maybe I could write yet another "SSH proxy from work to view badpuppy" article? But fine, nice effort to get your forum out there and some new content drummed up. But huge negatives on the classy reply below. Fail. Then again, maybe that's how

Re: [Full-disclosure] Security/Hacking Paper Contest Win $100

2008-06-16 Thread Archibald Tuttle
Knud, useless to reply, but ,just guessing, all rights of posted papers will be then hold by gso. something like "How 2 pwn yo mommy" yours ,Harry your message: On Sat, Jun 14, 2008 at 3:13 AM, Knud Erik Højgaard <[EMAIL PROTECTED]> wrote: > > On 6/13/08, GSO GSO <[EMAIL PROTECTED]> wrote: > > If

Re: [Full-disclosure] Security/Hacking Paper Contest Win $100

2008-06-16 Thread GSO GSO
On Sat, Jun 14, 2008 at 3:13 AM, Knud Erik Højgaard <[EMAIL PROTECTED]> wrote: > > On 6/13/08, GSO GSO <[EMAIL PROTECTED]> wrote: > > If you are a security pro or just a hobbyist, write an original > > security paper, the the users vote on it. If you have the most votes > > you win $100 USD. > >

[Full-disclosure] Autodesk Security Contact

2008-06-16 Thread Elazar Broad
Does anyone have a security contact for Autodesk? elazar -- Let great B to B marketing solutions propel your brand to new heights! Click now! http://tagline.hushmail.com/fc/Ioyw6h4euHqyTMpSKWWGNSUg4MAvp9z9bcMg7Dx2cKwC9V6EIDLvFO/ ___ Full-Disclosure -

Re: [Full-disclosure] Gadi Evron not a troll but n3td3v is?

2008-06-16 Thread Ureleet
On Thu, Jun 5, 2008 at 2:24 AM, n3td3v <[EMAIL PROTECTED]> wrote: > Why does Gadi Evron get good press and n3td3v get bad press? We both > rant our crap on the mailing lists and don't really know what we're > talking about, and both of us have no technical knowledge on any of > the topics we rant

Re: [Full-disclosure] XSS Browser hijacking PoC?

2008-06-16 Thread Aaron Katz
XSSSHell looks like the one I was thinking of, though BeEF looks interesting, too. Thanks! On Mon, Jun 16, 2008 at 8:50 AM, Tim Brown <[EMAIL PROTECTED]> wrote: > On Monday 16 June 2008 12:26:48 Hanno Böck wrote: > > Am Mittwoch 11 Juni 2008 schrieb Aaron Katz: > > > Several months ago, there wa

Re: [Full-disclosure] XSS Browser hijacking PoC?

2008-06-16 Thread Tim Brown
On Monday 16 June 2008 12:26:48 Hanno Böck wrote: > Am Mittwoch 11 Juni 2008 schrieb Aaron Katz: > > Several months ago, there was a post about a proof of concept for > > complete browser hijacking via XSS. IIRC, the hijacked browser would > > periodically query a management server, and the manage

Re: [Full-disclosure] XSS Browser hijacking PoC?

2008-06-16 Thread Hanno Böck
Am Mittwoch 11 Juni 2008 schrieb Aaron Katz: > Several months ago, there was a post about a proof of concept for complete > browser hijacking via XSS. IIRC, the hijacked browser would periodically > query a management server, and the management server would track the > hijacked browsers in a datab

[Full-disclosure] Advisory: SANS CMS fails to sanitize web scripting

2008-06-16 Thread Moritz Naumann
Some monday morning fun: SANS content management system fails to properly sanitize user inputs, allowing for injection of malicious web script or HTML. Prior authentication is required, limiting this issue to blog posts by people with malicious intentions or who don't know what they're doing. PO

Re: [Full-disclosure] newbie needs password cracked

2008-06-16 Thread Ed Carp
On Mon, Jun 16, 2008 at 12:38 AM, Judge Connie Lingus <[EMAIL PROTECTED]> wrote: > a file called called .auth contains the following line. What pass does that > decode to? Thx. Like we should do your illegal cracking for you? Do it yourself and learn how... __

[Full-disclosure] newbie needs password cracked

2008-06-16 Thread Judge Connie Lingus
a file called called .auth contains the following line. What pass does that decode to? Thx. admin:Qra63yYgMWBIc (An idea just occurred to me for a new Google service: Google Rainbow Tables -- feel free to take it and enter Google's next App development contest) -