Re: [Full-disclosure] is my ISP lying or stupid?

2012-03-16 Thread gold flake
Meanwhile in related news: https://krebsonsecurity.com/2012/03/aghast-at-avasts-iyogi-support/ And https://krebsonsecurity.com/2012/03/avast-antivirus-drops-iyogi-support/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-

Re: [Full-disclosure] is my ISP lying or stupid?

2012-03-16 Thread Nick FitzGerald
And your reason for not considering "both" at all likely, is? Regards, Nick FitzGerald ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] [Security-news] SA-CONTRIB-2012-040 - CKEditor and FCKeditor - multiple XSS, arbitrary code execution

2012-03-16 Thread Greg Knaddison
Hi MaXe, Thanks for the response. You raise a good point that our advisories are not as educational as they could be as a result of not fully detailing the attacks. I recognize I'm writing this on the full-disclosure list, but many members of our community prefer a long waiting period after the v

Re: [Full-disclosure] is my ISP lying or stupid?

2012-03-16 Thread Valdis . Kletnieks
On Fri, 16 Mar 2012 21:18:36 -, James Condron said: > Just get on with your life and admit they're lying to you and couldn't give > a fuck whether you know it or not. Something to keep in mind is that big customers call their provider of bit-pipe a "carrier". If you call it an ISP, you're alm

Re: [Full-disclosure] [Security-news] SA-CONTRIB-2012-040 - CKEditor and FCKeditor - multiple XSS, arbitrary code execution

2012-03-16 Thread InterN0T Advisories
Hello Greg, Thank you for your response. After re-reading the advisory a couple of times, and after a few communication attempts from Ustima who seems to have personal issues with me, I realized that I was wrong, and that it wasn't the same bug that I made an advisory for. I am glad however, th

Re: [Full-disclosure] is my ISP lying or stupid?

2012-03-16 Thread James Condron
Chances are a datacenter monkey pulled a power cable out, or they meant router and didn't want to confuse you. Worked for a couple of ISPs, they all send the same emails out when something breaks. Shouldn't worry about it. Also wouldn't get all higher-than-thou/ "who are these noobs". Just ge

Re: [Full-disclosure] ms12-020 PoC

2012-03-16 Thread kyle kemmerer
I have not had a chance to analyze this yet, but it is not the same code as the fake sabu one on pastebin. This one supppsedly showed up on some chinese security forum. Claimed to be causing bsod on xp sp3 and server 2003 On Mar 16, 2012 2:04 PM, "Nahuel Grisolía" wrote: > BSoD! Win7 64 and 32

[Full-disclosure] [ MDVSA-2012:030 ] systemd

2012-03-16 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2012:030 http://www.mandriva.com/security/ _

Re: [Full-disclosure] ms12-020 PoC

2012-03-16 Thread Exibar
Yah, I see the same about the binaryninjas version... That's the one I'll concentrate on.. Thanks! Sent via BlackBerry by AT&T -Original Message- From: Chris L Date: Fri, 16 Mar 2012 11:32:59 To: Cc: kyle kemmerer; ; Subject: Re: [Full-disclosure] ms12-020 PoC That is the first t

Re: [Full-disclosure] ms12-020 PoC

2012-03-16 Thread root
The SABU code is fake (go figure). This python script is the first port of the Luigi code to python, that's why sucks. Here are better ports: http://pastebin.com/4FnaYYMz and http://pastebin.com/jzQxvnpj On 03/16/2012 02:50 PM, Exibar wrote: > Is that the same code from yesterday? I thought that

Re: [Full-disclosure] ms12-020 PoC

2012-03-16 Thread Ian Hayes
On Fri, Mar 16, 2012 at 10:50 AM, Exibar wrote: > Is that the same code from yesterday?  I thought that code was a fake and > didn'kt do anything? > >  Anyone confirm this? > >  Exibar > Sent via BlackBerry by AT&T I haven't run this one, but there is a Ruby script on at binaryninjas.org that ha

Re: [Full-disclosure] is my ISP lying or stupid?

2012-03-16 Thread rancor
It makes no sense unless it was a layer 3 switch. The firewalls or routers should be the first network hardware to go on their knees before a switch but... who knows what hardware they are running anyway Den 16 mar 2012 17:31 skrev "Jerry dePriest" : > ** > They had a DoS of mail, www and shell.

Re: [Full-disclosure] ms12-020 PoC

2012-03-16 Thread Exibar
Is that the same code from yesterday? I thought that code was a fake and didn'kt do anything? Anyone confirm this? Exibar Sent via BlackBerry by AT&T -Original Message- From: kyle kemmerer Sender: full-disclosure-boun...@lists.grok.org.uk Date: Fri, 16 Mar 2012 12:01:16 To: Subje

Re: [Full-disclosure] is my ISP lying or stupid?

2012-03-16 Thread Julius Kivimäki
Someone who likes all the three things being compromised at the same time. 16. maaliskuuta 2012 18.30 Jerry dePriest kirjoitti: > ** > They had a DoS of mail, www and shell. They state a switch went out. who > runs mail, www and shell on the same switch? > > (This might be a trick question, thin

[Full-disclosure] is my ISP lying or stupid?

2012-03-16 Thread Jerry dePriest
They had a DoS of mail, www and shell. They state a switch went out. who runs mail, www and shell on the same switch? (This might be a trick question, think it thru...) bma___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-d

[Full-disclosure] ms12-020 PoC

2012-03-16 Thread kyle kemmerer
Not my code, just sharing it here. http://pastebin.com/UzDKcCQy ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] JPM Article Script 6 - SQL Injection Vulnerability

2012-03-16 Thread Research
Title: == JPM Article Script 6 - SQL Injection Vulnerability Date: = 2012-03-15 References: === http://www.vulnerability-lab.com/get_content.php?id=476 VL-ID: = 476 Introduction: = A PHP and MySQL light-weight article web application. (Copy of the Vendor Hom

[Full-disclosure] Microsoft Bing - Editor Flash Component Vulnerability

2012-03-16 Thread Research
Title: == Microsoft Bing - Editor Flash Component Vulnerability Date: = 2012-03-15 References: === http://www.vulnerability-lab.com/get_content.php?id=449 MSRC ID#1: 12173 MSRC ID#2: 12227 Credits: http://technet.microsoft.com/en-us/security/cc308589 VL-ID: = 449 Intr

Re: [Full-disclosure] Oracle Exadata Infiniband Switch default logins and world readable shadow file

2012-03-16 Thread Alex Buie
I like the two day notification window... On Mar 14, 2012 6:36 PM, "larry Cashdollar" wrote: > > Oracle Exadata Infiniband Switch default logins and world readable shadow file > > Hi Full-Disclosure List, > > I've noticed a minor issue with the 1/4 rack Oracle Exadata Solution. > > What is Exadat

[Full-disclosure] [ MDVSA-2012:029 ] pidgin

2012-03-16 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2012:029 http://www.mandriva.com/security/ _

[Full-disclosure] VMSA-2012-0005 VMware vCenter Server, Orchestrator, Update Manager, vShield, vSphere Client, ESXi and ESX address several security issues

2012-03-16 Thread VMware Security Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - --- VMware Security Advisory Advisory ID: VMSA-2012-0005 Synopsis: VMware vCenter Server, Orchestrator, Update Manager, vShield, vSp

[Full-disclosure] VMSA-2012-0004 VMware View privilege escalation and cross-site scripting

2012-03-16 Thread VMware Security Team
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 --- VMware Security Advisory Advisory ID: VMSA-2012-0004 Synopsis:VMware View privilege escalation and cross-site scripting Issue date: 2012-03-15 Updated on: