[Full-disclosure] The_UT is repenting

http://profile.ak.fbcdn.net/v229/1642/63/n680245330_5800.jpg ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] DoS vulnerabilities in Firefox, Internet Explorer, Chrome and Opera

On Mon, 31 May 2010 14:41:52 +0200 Jan G.B. ro0ot.w...@googlemail.com wrote: Hi 1337 r3s34|2ch3|2, Yeah, you're right! Bash should analyse the bash script, given parameters to programs and alike and then change the amount to a reasonable value of 1 decimals. Btw - have you yet

Re: [Full-disclosure] adobe pdf file format

Hi! If you really want to go further you can read the Adobe PDF documentation, I think you can find almost everything about it: http://www.adobe.com/devnet/pdf/pdf_reference_archive.html Cheers! El 31/05/10 13:55, rajendra prasad escribió: Hi List, I am trying to understand the latest pdf

Re: [Full-disclosure] fulldisclosure logo Full Disclosure mailing list archives

You should also mention: - remote / local file inclusion - directory traversal - privilege escalation greets ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia -

[Full-disclosure] Decrypt info in referenced file @ web.config

Hello I'm doing a test and I obtained a copy of the web.config file, the interesting is that there is a line like that add key=PasswordFile value=C:\Inetpub\site\Users.acl / this called my attention to be on the inetpub folder and I was able to download it. It's with base64, when decoding it is

Re: [Full-disclosure] PuTTY private key passphrase stealing attack

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Jan Schejbal wrote: PuTTY, a SSH client for Windows, requests the passphrase to the ssh key in the console window used for the connection. This could allow a malicious server to gain access to a user's passphrase by spoofing that prompt That

[Full-disclosure] Why the IPS product designers concentrate on server side protection? why they are missing client protection

Hi List, I am putting my thoughts on this, please share your thoughts, comments. Request length is less than the response length.So, processing small amount of data is better than of processing bulk data. Response may have encrypted data. Buffering all the client-server transactions and

[Full-disclosure] What are the basic vulnerabilities of a software?

Hi List, For Top 25 Software Vulnerabilities, please have a look at http://cwe.mitre.org/top25/archive/2010/2010_cwe_sans_top25.pdf. I feel this categorization will help professionals as a check list for finding the vulnerabilities of a software. Thanks Rajendra

Re: [Full-disclosure] PuTTY private key passphrase stealing attack

You should make a show about it. On Tue, Jun 1, 2010 at 6:07 AM, Rob Fuller jd.mu...@gmail.com wrote: Couldn't this also be thwarted by having a MOTD? It generally displays before the bashrc if I'm not mistaken. -- Rob Fuller | Mubix Room362.com | Hak5.org On Mon, May 31, 2010 at 8:47

Re: [Full-disclosure] The_UT is repenting

Wouldn't you if you were bubba's boytoy in the can? Fra: full-disclosure-boun...@lists.grok.org.uk [mailto:full-disclosure-boun...@lists.grok.org.uk] På vegne af PsychoBilly Sendt: 1. juni 2010 10:21 Til: full-disclosure@lists.grok.org.uk Emne: [Full-disclosure] The_UT is repenting

Re: [Full-disclosure] The_UT is repenting

Anders - i'm very sorry, you must of confused this mailing list with astalavista forums. Please go away... or kill yourself, whichever you prefer.. and in the interest of full-disclosure, I have my fingers crossed for the latter :) Thanks.

Re: [Full-disclosure] PuTTY private key passphrase stealing attack

On Jun 1, 2010, at 2:47 AM, Jan Schejbal wrote: PuTTY, a SSH client for Windows, requests the passphrase to the ssh key in the console window used for the connection. This could allow a malicious server to gain access to a user's passphrase by spoofing that prompt. We assume that the

Re: [Full-disclosure] Why the IPS product designers concentrate on server side protection? why they are missing client protection

You're missing one point: Host IPS MUST be deployed with any Network Security (Firewalls os NIPSs). No security solution/technology is the miracle protection alone, so that's the reason everybody is talking about defense in depth. Cheers. Nelson Brito Security Researcher

[Full-disclosure] DoS vulnerability in Internet Explorer

Hello Full-Disclosure! I want to warn you about Denial of Service vulnerability in Internet Explorer. Which I already disclosed at my site in 2008 (at 29.09.2008). But recently I made new tests concerning this vulnerability, so I decided to remind you about it. I know this vulnerability for a

Re: [Full-disclosure] Why the IPS product designers concentrate on server side protection? why they are missing client protection

Hi List, I have started this discussion with respect to Network IPS. Thanks Rajendra On Tue, Jun 1, 2010 at 1:08 PM, rajendra prasad rajendra.paln...@gmail.comwrote: Hi List, I am putting my thoughts on this, please share your thoughts, comments. Request length is less than the response

Re: [Full-disclosure] Why the IPS product designers concentrate on server side protection? why they are missing client protection

Nelson, You're missing one point: Host IPS MUST be deployed with any Network Security (Firewalls os NIPSs). Please be aware this is a risk decision and not a fact. I don't use an host IPS and no anti Virus either. Still I'm sure my laptop is perfectly safe. This is because I do critical

Re: [Full-disclosure] Why the IPS product designers concentrate on server side protection? why they are missing client protection

Okay, but why did you mention AV as a client-side protection? It leads to a discussion about client-side protection, anyways. Cheers. Nelson Brito Security Researcher http://fnstenv.blogspot.com/ Please, help me to develop the ENG® SQL Fingerprint™ downloading it from Google Code

Re: [Full-disclosure] Why the IPS product designers concentrate on server side protection? why they are missing client protection

Comments are inline! Nelson Brito Security Researcher http://fnstenv.blogspot.com/ Please, help me to develop the ENG® SQL Fingerprint™ downloading it from Google Code (http://code.google.com/p/mssqlfp/) or from Sourceforge (https://sourceforge.net/projects/mssqlfp/). Sent on an  iPhone

Re: [Full-disclosure] DoS vulnerability in Internet Explorer

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Full-Disclosure! I want to warn you about a Denial of Service in every browser finaly !!! It actually affect every browser with a javascript engine build in !!! Adobe may be vulnerable to PoC : html headtitle0n0z/title/head body

Re: [Full-disclosure] DoS vulnerability in Internet Explorer

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Sorry Mustlive, i understand you need to see this in clear text finaly. I guess ascii is the best to communicate with you; Hello Full-Disclosure! I want to warn you about a Denial of Service in every browser finaly !!! It actually affect every

Re: [Full-disclosure] Why the IPS product designers concentrate on server side protection? why they are missing client protection

Nelson, I put my comments inline as well Regards, Cor ...snip... Nelson, You're missing one point: Host IPS MUST be deployed with any Network Security (Firewalls os NIPSs). Please be aware this is a risk decision and not a fact. I don't use an host IPS and no anti Virus either.

Re: [Full-disclosure] DoS vulnerability in Internet Explorer

This had already been published http://www.pewy.fr/hamster.html Cluster #[[ Laurent Gaffie ]] possibly emitted, @Time [[ 01/06/2010 16:00 ]] The Following #String ** -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Sorry Mustlive, i

[Full-disclosure] Onapsis Research Labs: Onapsis Bizploit - The opensource ERP Penetration Testing framework

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear colleague, We are proud to announce the release of Onapsis Bizploit, the first opensource ERP Penetration Testing framework. Presented at the renowned HITB Dubai security conference, Bizploit is expected to provide the security community with

Re: [Full-disclosure] The_UT is repenting

I don't think UT is anyone's 'boy toy.' The guy is massive. I'm sure he'll meet all kinds of experienced scam artists and criminals and learn all sorts of neat things for use when he gets out. -Travis On Tue, Jun 1, 2010 at 6:13 AM, Anders Klixbull a...@experian.dk wrote: I'm so sorry that

[Full-disclosure] [ GLSA 201006-05 ] Wireshark: Multiple vulnerabilities

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] [ GLSA 201006-07 ] SILC: Multiple vulnerabilities

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] [ GLSA 201006-06 ] Transmission: Multiple vulnerabilities

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] [ GLSA 201006-09 ] sudo: Privilege escalation

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] ZDI-10-090: Novell ZENworks Configuration Management Preboot Service Remote Code Execution Vulnerability

ZDI-10-090: Novell ZENworks Configuration Management Preboot Service Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-090 June 1, 2010 -- Affected Vendors: Novell -- Affected Products: Novell Zenworks -- TippingPoint(TM) IPS Customer Protection:

[Full-disclosure] [ GLSA 201006-03 ] ImageMagick: User-assisted execution of arbitrary code

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] [ GLSA 201006-02 ] CamlImages: User-assisted execution of arbitrary code

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] [ GLSA 201006-04 ] xine-lib: User-assisted execution of arbitrary code

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] [ GLSA 201006-01 ] FreeType 1: User-assisted execution of arbitrary code

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201006-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -