Re: [Full-disclosure] Linux Kernel CIFS Vulnerability

2009-04-09 Thread Valdis' Mustache
Andrea, Do not be alarmed! At the time of this writing, my owner is fervently developing a response on this topic! It is a response which I have no doubt will apply a virtual salve to all of your bugbears, and assuage other tangential (and even unrelated) concerns as well. Nonetheless, I feel com

[Full-disclosure] [ MDVSA-2009:089 ] opensc

2009-04-09 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2009:089 http://www.mandriva.com/security/

Re: [Full-disclosure] Linux Kernel CIFS Vulnerability

2009-04-09 Thread Nick Boyce
On Thu, Apr 9, 2009 at 5:01 PM, Raj Mathur wrote: > On Thursday 09 Apr 2009, Andreas Bogk wrote: >> Neither the Linux kernel team, the CIFS maintainers nor any of the >> commercial Linux distributors bothered to send out an advisory. > > The advisory will be out in all the major distributions' ker

[Full-disclosure] [SECURITY] [DSA 1754-1] New roundup packages fix privilege escalation

2009-04-09 Thread Florian Weimer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1754-1 secur...@debian.org http://www.debian.org/security/ Florian Weimer April 09, 2009

[Full-disclosure] http://confickerworkinggroup.org/

2009-04-09 Thread Georgi Guninski
i am trying to get the fucts. 1. is http://confickerworkinggroup.org/ up [1] [2] as of now ? 2. is these days m$ doing reverse engineering in order to make windows(tm) run in hostile environments ? [1] http://translate.google.bg/translate?hl=bg&sl=en&u=http://isc.sans.org/diary.html%3Fstoryid%3D

[Full-disclosure] [ MDVSA-2009:088 ] wireshark

2009-04-09 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2009:088 http://www.mandriva.com/security/

Re: [Full-disclosure] Linux Kernel CIFS Vulnerability

2009-04-09 Thread Raj Mathur
On Thursday 09 Apr 2009, Andreas Bogk wrote: > [snip] > fixing a remotely exploitable buffer overflow vulnerability in the > CIFS protocol. > > Neither the Linux kernel team, the CIFS maintainers nor any of the > commercial Linux distributors bothered to send out an advisory. The advisory will be

[Full-disclosure] Secunia Research: Ghostscript jbig2dec JBIG2 Processing Buffer Overflow

2009-04-09 Thread Secunia Research
== Secunia Research 09/04/2009 - Ghostscript jbig2dec JBIG2 Processing Buffer Overflow - == Table of Contents Affected Software..

[Full-disclosure] [SECURITY] [DSA 1765-1] New horde3 packages fix several vulnerabilities

2009-04-09 Thread Steffen Joeris
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-1765-1 secur...@debian.org http://www.debian.org/security/ Steffen Joeris April 08, 2009

[Full-disclosure] [SECURITY] [DSA 1767-1] New multipath-tools packages fix denial of service

2009-04-09 Thread Nico Golde
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA-1767-1secur...@debian.org http://www.debian.org/security/ Nico Golde April 9th, 2009

[Full-disclosure] FGA-2009-003:EMC RepliStor Buffer Overflow Vulnerability

2009-04-09 Thread noreply-secresea...@fortinet.com
FGA-2009-003:EMC RepliStor Buffer Overflow Vulnerability  2009.April.08 Summary:   Fortinet's FortiGuard Global Security Research Team has discovered a buffer overflow vulnerability in EMC RepliStor. Impact: === Remote code execution. Risk:  = Critical

[Full-disclosure] [SECURITY] [DSA 1766-1] New krb5 packages fix several vulnerabilities

2009-04-09 Thread Nico Golde
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA-1766-1secur...@debian.org http://www.debian.org/security/ Nico Golde April 9th, 2009

Re: [Full-disclosure] Linux Kernel CIFS Vulnerability

2009-04-09 Thread Andreas Bogk
Thierry Zoller wrote: > AB> Neither the Linux kernel team, the CIFS maintainers nor any of > AB> the commercial Linux distributors bothered to send out an advisory. > AB> I'm at loss for words other than "irresponsible, arrogant > AB> assholes". Linux 2009 == Microsoft 2002. > I second that, th

[Full-disclosure] OpenVAS now beyond 10000 Network Vulnerability Tests

2009-04-09 Thread Michael Wiegand
Hello, Passing the 1th Network Vulnerability Test (NVT) is a perfect occasion to report about the progress of the OpenVAS project[1]. In October 2008 the systematic development of new NVTs started with a base of around 5800 Tests. With the release of OpenVAS 2.0 in December 2008, the developm

Re: [Full-disclosure] Linux Kernel CIFS Vulnerability

2009-04-09 Thread Thierry Zoller
Addendum 2: http://lwn.net/Articles/285438/ http://lwn.net/Articles/286263/ http://lwn.net/Articles/287339/ http://lwn.net/Articles/288473/ -- http://secdev.zoller.lu Thierry Zoller ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.o

Re: [Full-disclosure] Linux Kernel CIFS Vulnerability

2009-04-09 Thread Thierry Zoller
Addendum: Read the reasoning behind it here, it is so funny you'd think it must be a joke or something. His logic is in essence: once we fixed a security bug it is no longer a security bug and not worth a mention. It is clear that that guy never managed a single network that had more than 20

Re: [Full-disclosure] Linux Kernel CIFS Vulnerability

2009-04-09 Thread Thierry Zoller
AB> Neither the Linux kernel team, the CIFS maintainers nor any of AB> the commercial Linux distributors bothered to send out an advisory. AB> I'm at loss for words other than "irresponsible, arrogant AB> assholes". Linux 2009 == Microsoft 2002. I second that, the reason is intersintg too; lin

[Full-disclosure] Linux Kernel CIFS Vulnerability

2009-04-09 Thread Andreas Bogk
Dear list, as discovered by Felix von Leitner (http://blog.fefe.de/?ts=b72905a8), Linux kernel patch 2.6.29.1 contains: --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -3667,7 +3667,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses, BCC(smb_buffer_response))