[Full-disclosure] [ MDVSA-2010:219 ] mozilla-thunderbird

2010-11-01 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2010:219 http://www.mandriva.com/security/

[Full-disclosure] Call for Papers -YSTS V - Security Conference, Brazil

2010-11-01 Thread Luiz Eduardo
Hello Full-Disclosure, the CFP for YSTS V is now open! --- YSTS 5th Edition Sao Paulo, Brazil May 16th, 2011 Call for Papers Opens: November 1st 2010 Call for Papers Close: February 28th 2011 http://www.ysts.org @ystscon INTRODUCTION Following the success of previous editions, the 5th

Re: [Full-disclosure] Evilgrade 2.0 - the update explotation framework is back

2010-11-01 Thread Mario Vilas
It would indeed be vulnerable to that, and you're also right about this attack vector being quite small. But IMHO an updates mechanism that signs it's packages it quite easy to implement, so we're talking about getting a tangible benefit from a small effort. Preventing the signing key from being

Re: [Full-disclosure] Evilgrade 2.0 - the update explotation framework is back

2010-11-01 Thread Jeffrey Walton
On Sun, Oct 31, 2010 at 10:36 AM, valdis.kletni...@vt.edu wrote: On Sun, 31 Oct 2010 13:09:27 BST, Mario Vilas said: Just signing the update packages prevents this attack, so it's not that hard to fix. Except if a signing key gets compromised, as happened to one Linux vendor recently,

Re: [Full-disclosure] Evilgrade 2.0 - the update explotation framework is back

2010-11-01 Thread Christian Sciberras
No, he's just saying that a bank might be accidentally broken and robbedaccidentally.of course On Mon, Nov 1, 2010 at 4:13 PM, Jeffrey Walton noloa...@gmail.com wrote: On Sun, Oct 31, 2010 at 10:36 AM, valdis.kletni...@vt.edu wrote: On Sun, 31 Oct 2010 13:09:27 BST, Mario Vilas

Re: [Full-disclosure] Evilgrade 2.0 - the update explotation framework is back

2010-11-01 Thread Jeffrey Walton
On Mon, Nov 1, 2010 at 12:26 PM, Jhfjjf Hfdsjj taser3...@yahoo.com wrote: On Sun, Oct 31, 2010 at 10:36 AM,  valdis.kletni...@vt.edu wrote: On Sun, 31 Oct 2010 13:09:27 BST, Mario Vilas said: Just signing the update packages prevents this attack, so it's not that hard to fix. Except if a

Re: [Full-disclosure] Evilgrade 2.0 - the update explotation framework is back

2010-11-01 Thread Jhfjjf Hfdsjj
On Sun, Oct 31, 2010 at 10:36 AM, valdis.kletni...@vt.edu wrote: On Sun, 31 Oct 2010 13:09:27 BST, Mario Vilas said: Just signing the update packages prevents this attack, so it's not that hard to fix. Except if a signing key gets compromised, as happened to one Linux vendor recently,

Re: [Full-disclosure] Evilgrade 2.0 - the update explotation framework is back

2010-11-01 Thread Jhfjjf Hfdsjj
I do not believe anyone is 'ptoposing' anything. All he said was that package signing should not be taken as a silver bullet, for experience has shown that the key's themselves are capable of being compromised if a vendor is successfully attacked. Exactly what I would expect from *.edu I

[Full-disclosure] [SECURITY] [DSA 2123-1] New NSS packages fix cryptographic weaknesses

2010-11-01 Thread Florian Weimer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-2123-1 secur...@debian.org http://www.debian.org/security/ Florian Weimer November 01, 2010

[Full-disclosure] [SECURITY] [DSA 2124-1] New Xulrunner packages fix several vulnerabilities

2010-11-01 Thread Florian Weimer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-2124-1 secur...@debian.org http://www.debian.org/security/ Florian Weimer November 01, 2010

[Full-disclosure] Security-Assessment.com Advisory: BroadWorks Call Detail Record Disclosure Vulnerability

2010-11-01 Thread Nick Freeman
(, ) (, . `.' ) ('.', ). , ('. ( ) ( (_,) .`), ) _ _, / _/ / _ \ _ \ \==/ /_\ \ _/ ___\/ _ \ / \ / \/ |\\ \__( _ ) Y Y \ /__ /\___|__ / \___ /|__|_| / \/ \/.-.\/ \/:wq