Re: [Full-Disclosure] From field spoofing and AV responses

Hi. Another OT threat, so I'll keep it short. Erik van Straten wrote: How hard would it be to have the AV software actually check the source email smtp host, and send an email to [EMAIL PROTECTED] for the *actual* offending smtp server? Incredibly hard. Yep. Mostly because of the fact that these

Re: [Full-Disclosure] Eushop Scam - how big is this scheme?

Hi. Tobias Weisserth wrote: What's the quickest way to put an end to something like this if someone is using your name for a scam like this? I mean, this could happen to virtually anyone. I'd try to walk the way up from the original hosting provider to their uplink, then to the uplink's uplink

[Full-Disclosure] Yet another version of a worm mass mail? (Paypal.com new year offer)

Hi all. I received a mail which is said to be from Paypal.com (has been sent from an IP that is registered to an ISP in Venezuela), subject is PAYPAL.COM NEW YEAR OFFER. Attached is a file called paypal.zip that contains a file paypal.exe (2592 bytes). Is this yet another variant of a

Re: [Full-Disclosure] 45% of the free files collected via KaZaA contained malware

Hi. Bernardo Quintero wrote: Impossible At least 90% of the files on KaZaA are media files ... (non executable files) I know there's a lot of bad .exe's on kazaa ... But 45% just can't be right Obviously. I'm no native english speaker, but... the way I understood the original headline

Re: [Full-Disclosure] [Fwd: Bugtraq: Linksys WRT54G Denial of Service Vulnerability]

Hi. Jonathan A. Zdziarski wrote: In a lot of cases, this would only be exploitable internally, since many configurations are set up not to allow access to the unit externally. What do you mean with externally? WLAN? Internet? I don't know this particular device, but I know that lots of other

[Full-Disclosure] [Fwd: Bugtraq: Linksys WRT54G Denial of Service Vulnerability]

Can anyone confirm if technically identical devices such as the Buffalo WBR-G54 share this vulnerability? Original Message Subject: Linksys WRT54G Denial of Service Vulnerability Date: 3 Dec 2003 22:35:26 - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Linksys WRT54G

Re: [Full-Disclosure] Foundstone Labs to Release Absolutely FREE Tool

Hi. James Foster wrote: One liner: Our free tool, MessengerScan, is available for free download at www.foundstone.com http://www.foundstone.com/ Nothing about your tool, but your advertising here sucks. Posting a short and factual mail would be fine, but this marketing-speech is really

Re: [Full-Disclosure] Re: I have fixes for the Geeklog vulnerabilities

Hi. morning_wood wrote: you perhaps stumble across the issues? Disclosure helps everyone, Any security disclosure is good, if you dont like it, I agree. Disclosure is good, but Disclosure should also include a CC to the developers in order to help them to fix the issues. You can't expect

Re: [Full-Disclosure] Re: Geeklog Multiple Versions Vulnerabilities

Hi all. Lorenzo Hernandez Garcia-Hierro wrote: Geeklog Multiple Versions Vulnerabilities -- PRODUCT: Geeklog VENDOR: Geeklog VULNERABLE VERSIONS: [...] Is it just me, or did anyone else notice that this vulnerability report comes through once or twice every day since about the beginning of

Re: [Full-Disclosure] Cafelog WordPress / b2 SQL injection vulnerabilities discovered and fixed in CVS

Hi. Seth Woolley wrote: Disclaimer: I (Seth) am not a php expert, and I don't run this code, so I haven't tested the vendor-provided patch yet, although I assume the vendor has. Be advised. I tested the patch against the current release version of wordpress (v0.71). Although I couldn't notice

Re: [Full-Disclosure] BugTraq Speed

Hi. Raj Mathur wrote: Uh, has anyone bothered asking DMA the reason for the delay? You may not get any reasonable explanation, but at least give the man a chance to defend himself before condemning him. From my point of view this was no attempt to condemn anyone, but was meant as getting a

Re: [Full-Disclosure] BugTraq Speed

Kristian Hermansen wrote: Dido.. Everytime I send a post I get about 20 bounce backs. 20? How? At least twice that much... even more if there is vacancy time in many countries.. summer and the like. They did kick a lot of those out of office-subscribers a few weeks ago, but it did help only

Re: [Full-Disclosure] BugTraq Speed

Hi. Rainer Gerhards wrote: I wonder if someone else is sharing this experience? So far I second your feeling. BugTraq is lagging behind a lot, and I remember that the lag has been less worse some time ago. I'm not sure about the reason, but it's nothing I'm really happy about. On the other

[Full-Disclosure] new lsh-releases fixes security problem

Hi all. There is a new release of lsh, which fixes the recently reported security issue. Below is a quote of the message that Niels Moeller posted to the lsh-bugs list. The original posting can be found in the list archive at http://lists.lysator.liu.se/pipermail/lsh-bugs/2003q3/000127.html

Re: [Full-Disclosure] Verisign abusing .COM/.NET monopoly, BIND releases new

Hi. Rainer Gerhards wrote: I think they have underestimated the number of typos and as such under-powered the machine. A good indication is the single IP (even though that eventually is a reverse proxy). I agree. As a side note: could it be possible to DoS name servers by querying tons of

Re: [Full-Disclosure] Backdoor, Virus, Dialer? More information.

Hi all. [EMAIL PROTECTED] wrote: Recently I received some mails in english language. The writer (who pretends being [EMAIL PROTECTED], but the header says Sender: [EMAIL PROTECTED]) generously sends a patch along with his mail which should be applied in order to fix a security bug... ha ha.

Re: [Full-Disclosure] Backdoor, Virus, Dialer? More information.

Hi all. Michael Renzmann wrote: As there were many people asking me to send them the binary, I decided to put the file and a copy of the mail on my webserver. To be found at http://www.otaku42.de/download/dumaru/index.html Due to a server crash the files were not available for some hours

[Full-Disclosure] Backdoor, Virus, Dialer?

Hi. Recently I received some mails in english language. The writer (who pretends being [EMAIL PROTECTED], but the header says Sender: [EMAIL PROTECTED]) generously sends a patch along with his mail which should be applied in order to fix a security bug... ha ha. Anyone interested in the

Re: [Full-Disclosure] RE: Miatrade Guestbook - Persistant XSS

Hi. [EMAIL PROTECTED] wrote: And the XXS Lamer king strikes again *sigh* [...] This message has been sent via an anonymous mail relay at www.no-id.com. Surprise, surprise, an anonymous coward again, bashing others. Well, we didn't have that here for... 3 days? 4? Wow. New record. I'm not sure if

Re: [Full-Disclosure] RE: Miatrade Guestbook - Persistant XSS

[EMAIL PROTECTED] wrote: A 12 year old infant could 'discover' XSS 'holes' in stuff. I'm just getting tired of seeing wiener's shit 0days on this list. And I'm getting tired of guys like you complaining about morning wood's postings. Just ignore them if you don't like them. They say, things like

Re: [Full-Disclosure] Anybody know what Sobig.F has downloaded?

Hi. Tim Fletcher wrote: While this is 2nd hand I have now heard about the same effect on 2 different unrelated machines via friends on quakenet (irc) Mikeh email from a m8 Mikeh got a bit of a prob Mikeh with me pc, when i go online, after about a minute i get a message saying Mikeh system is

Re: [Full-Disclosure] MS should point windowsupdate.com to 127.0.0.1

Hi. Schmehl, Paul L wrote: Given that scenario, please apply your scintillating logic to the problem of patching this machine to protect it against threats that were discovered *after* SP2. How about setting up a transparent firewall (that is, a Linux bridging box with firewall patches applied,

Re: [Full-Disclosure] CERT site not available

Hi. Harshul Nayak (ealcatraz) wrote: Has anyone not able to reach CERT site, seems like it's not accessible. is it because of Blaster worm ? ? I was able to access cert.org from germany, using two different providers. No problems with this site at all (just tested it). Maybe a local problem?

Re: [Full-Disclosure] morning_wood should stop posting xss

Hi. [EMAIL PROTECTED] wrote: kindergarden! i think this is multy national! Yes, it's an international kindergarden. Will this bashing ever end? Bye, Mike ___ Full-Disclosure - We believe in it. Charter:

Re: [Full-Disclosure] morning_wood.

Hi. Larry W. Cashdollar wrote: I think people who have not published ANYTHING have no right to criticize those that have. So ask yourself, have I ever contributed to the security community in anyway? If not, keep quiet until you do. Well, this seems to get one of those ever built a car? no?

Re: [Full-Disclosure] Does your IE6 crash with these URLs?

Hi. Martin wrote: I have a question. I would like to know, if you can also crash IE6, when typing the following URL: ftp*://? I can confirm that problem. When opening the mentioned URL, IE6 (6.0.2800.1106) reports the following problem signature: AppName: iexplore.exeAppVer:

Re: [Full-Disclosure] Global HIGH Security Risk

Hi. Benjamin Keller wrote: I say you go to your local library/Internet cafe, create a hotmail/hushmail account, And mail it all to the list and lets see what happens In addition you might want to use an anonymizing service from the inet-cafe. Or Peek-A-Booty, or something thelike. Bye,

Re: [Full-Disclosure] The worm author finally revealed!

Hi. [EMAIL PROTECTED] wrote: It's a joke for God's sake, you were supposed to laugh. I'm amazed at the number of people who took that seriousely. As allways: You can't ever make the warning, ironic content, don't take this for serious signs in such postings fat enough - there always will be

Re: [Full-Disclosure] iDEFENSE Security Advisory 01.28.03: SSH2 ClientsInsecurely Store Passwords

Hi. iDEFENSE Labs wrote: [...] PuTTY is a free implementation of Telnet and SSH for Win32 platforms, along with an xterm terminal emulator. More information is available at http://www.chiark.greenend.org.uk/~sgtatham/putty/. [...] AFAIK WinSCP2 is a program that relies on the codebase of