On 12/14/10 11:36 PM, musnt live wrote:
> On Tue, Dec 14, 2010 at 9:29 PM, Graham Gower wrote:
>> On 15 December 2010 12:05, musnt live wrote:
>>> Original e-mail is from Theo DeRaadt
>>>
>>> Is my question: "Why is now Theo cower like rat." Is because his
>>> stance from the beginning: "we is au
On Tue, Dec 14, 2010 at 9:29 PM, Graham Gower wrote:
> On 15 December 2010 12:05, musnt live wrote:
>> Original e-mail is from Theo DeRaadt
>>
>> Is my question: "Why is now Theo cower like rat." Is because his
>> stance from the beginning: "we is audit everything" for make me
>> believe Theo was
On 15 December 2010 12:05, musnt live wrote:
> Original e-mail is from Theo DeRaadt
>
> Is my question: "Why is now Theo cower like rat." Is because his
> stance from the beginning: "we is audit everything" for make me
> believe Theo was is also on the payroll. Enjoy everyone.
I have no idea what
Hi,
Has anyone read this yet?
http://www.downspout.org/?q=node/3
Seems IPSEC might have a back door written into it by the FBI?
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsore
Original e-mail is from Theo DeRaadt
Is my question: "Why is now Theo cower like rat." Is because his
stance from the beginning: "we is audit everything" for make me
believe Theo was is also on the payroll. Enjoy everyone.
http://marc.info/?l=openbsd-tech&m=129236621626462&w=2
I have received a
===
Ubuntu Security Notice USN-1024-2 December 13, 2010
openjdk-6 regression
https://launchpad.net/bugs/688522
===
A security issue affects the following Ubuntu releases:
Ubuntu
> I'm guessing you have your window manager configured to render window
> shadows. In this case, this is less plausible, yup, unless you do the
> inverted gradient trick.
Ah, reminds me. On Windows 7, the blue border fill is actually a gradient
like other window borders, just remembered it used to
> 1) Yup, pretty unconvincing. Though one could separate window shadows,
I'm guessing you have your window manager configured to render window
shadows. In this case, this is less plausible, yup, unless you do the
inverted gradient trick.
> 2) Where is "here"? :)
I tried to dig something up, but
1) Yup, pretty unconvincing. Though one could separate window shadows,
invert the image and create what looks like a seamless background in the
file-upload window.
2) Where is "here"? :)
Cheerio,
Chris.
On Tue, Dec 14, 2010 at 10:19 PM, Michal Zalewski wrote:
> Hi folks,
>
> Two minor things t
=[BEGIN-ACROS-REPORT]=
PUBLIC
=
ACROS Security Problem Report #2010-12-14-1
-
ASPR #2010-12-14-1: Remote Binary Planting in Windows Address Book
Hi,
I've recently made publicly available "yet another fuzzer". It's
simple, easy to use via command-line interface, providing nice
analysis of software crashes in a simple form of file names.
It has been used by me and some others to find a few, possibly
exploitable, bugs in some major software
Hi folks,
Two minor things that do not deserve a lengthy discussion, but are
probably mildly interesting and worth mentioning for the record:
1) Chrome browser is an interesting example of the perils of using
minimalistic window chrome, allowing multiple windows to be spliced
seamlessly to confus
ZDI-10-290: SAP NetWeaver Business Client SapThemeRepository ActiveX Control
Remote Code Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-290
December 14, 2010
-- CVSS:
9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)
-- Affected Vendors:
SAP
-- Affected Products:
SAP NetWeaver
-- T
ZDI-10-289: Microsoft Internet Explorer HTML+Time Element outerText Remote Code
Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-289
December 14, 2010
-- CVE ID:
CVE-2010-3346
-- CVSS:
10, (AV:N/AC:L/Au:N/C:C/I:C/A:C)
-- Affected Vendors:
Microsoft
-- Affected Produ
ZDI-10-288: Microsoft Internet Explorer Recursive Select Element Remote Code
Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-288
December 14, 2010
-- CVE ID:
CVE-2010-3345
-- CVSS:
10, (AV:N/AC:L/Au:N/C:C/I:C/A:C)
-- Affected Vendors:
Microsoft
-- Affected Products
ZDI-10-287: Microsoft SharePoint Server Arbitrary File Upload Remote Code
Execution Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-287
December 14, 2010
-- CVE ID:
CVE-2010-3964
-- CVSS:
10, (AV:N/AC:L/Au:N/C:C/I:C/A:C)
-- Affected Vendors:
Microsoft
-- Affected Products:
M
ZDI-10-286: Microsoft Exchange 2007 Infinite Loop Denial of Service
Vulnerability
http://www.zerodayinitiative.com/advisories/ZDI-10-286
December 14, 2010
-- CVE ID:
CVE-2010-3937
-- CVSS:
6.8, (AV:N/AC:L/Au:S/C:N/I:N/A:C)
-- Affected Vendors:
Microsoft
-- Affected Products:
Microsoft Exchan
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
___
Mandriva Linux Security Advisory MDVSA-2010:253
http://www.mandriva.com/security/
_
PoC to generate Reverse TCP backdoors, malicious PDF or LNK files. But
also running Auto[run|play] infections (EXE, PDF, LNK) and dumping all
USB files remotely on multiple targets at the same time, a set of
extensions to dump can be specified. All EXE, PDF and LNK already
available on the USB targ
You need at minimum 2x the number of IPs your target has to take it down.
Via proxies, bots, whatever.
Targets can implement per IP throttling/blacklisting. Which means you need
more than IPs than that.
IIRC Aol throttles connection attempts.
-Travis
On Tue, Dec 14, 2010 at 10:13 AM, Cyber Flas
Create many ESTABLISHED connections (60,000) to login.oscar.aol.com server
and then temporarily disable the local client gateway, close the sockets
(the RST packets aren’t sent to AOL), reopen the gateway and repeat this
process.
Anyone have ideas on the pros/cons of using this technique?
# Cli
Hi you can xss pmwiki like this:
http://dtcsupport.gplhost.com/Main/WikiSandbox?from=%22/%3E%3Cbody%20onload=alert%281%29%3E
Also the above it seems to behave differently across versions of pmwiki.
If it doesn't work ...html injection like this should:
http://www.pmwiki.org/wiki/Main/WikiSandbox?f
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
___
Mandriva Linux Security Advisory MDVSA-2010:252
http://www.mandriva.com/security/
_
On Mon, Dec 13, 2010 at 11:53 AM, Steve Pinkham wrote:
>> I'm now worried that if an attacker knows, or "guesses" that you are
>> using, say, CentOS Linux 5.5, (or at least some mutation of Red Hat),
>> he might use this knowledge of "known artefacts" to his advantage, by
>> starting out from the
Cal Leeming [Simplicity Media Ltd] wrote:
> Actually Ryan, I'll think you'll find a lot of people just wanted to
> contribute towards testing, as most authors will appreciate the masses
> testing on as many systems as possible.
>
> It's not a case of anyone "showing off", it's simply that a lot o
www.eVuln.com advisory:
"post" - Non-persistent XSS in slickMsg
Summary: http://evuln.com/vulns/161/summary.html
Details: http://evuln.com/vulns/161/description.html
---Summary---
eVuln ID: EV0161
Software: slickMsg
Vendor: n/a
Version: 0.7-alpha
Critical Level: low
Type: Cross S
While fuzzing an Urchin web application, I discovered what appears to
be an LFI vulnerability. Neither Secunia nor Google / Urchin appear
to have reported this as a known issue. The problem lies in the gfid
parameter passed to urchin.cgi. This was tested on a somewhat
modified version of Urchin
Hi to all
If you are interested: http://bit.ly/fpH2vG
--
http://extraexploit.blogspot.com
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
28 matches
Mail list logo
