|
|
Prev week |
Colapse all |
Post message
[ GLSA 200507-04 ] RealPlayer: Heap overflow vulnerability 2005-07-06 Thierry Carrez (koon gentoo org) Re: /dev/random is probably not 2005-07-06 Michael Gnau (MGnau ctr pcusa org) remove >>> Alexey Toptygin <alexeyt (at) freeshell (dot) org [email concealed]> 7/6/2005 7:37:00 AM >>> On Tue, 5 Jul 2005, Jack Lloyd wrote: > Assuming the PRNG is any good, it shouldn't matter if an attacker can > manipulate such timings, because (by definition) a good PRNG will still > behave correctly even if an attacke [ more ] [ reply ] Re: PHPXMAIL - Authentication Bypass 2005-07-06 security surefoot com Hi Steve On Wednesday 06 July 2005 11:57, Steve <St> wrote: > Author: Stefan Lochbihler > Date: 6. Juli 2005 > Affected Software: PHPXMAIL > Software Version: 0.7 -> 1.1 > Software URL: http://phpxmail.sourceforge.net/ > Attack: Authentication Bypass [...details snipped...] > The probl [ more ] [ reply ] eRoom Multiple Security Issues 2005-07-06 c0ntexb gmail com /* ************************************************************************ ***************************************** $ An open security advisory #9 - eRoom v6.* Vulnerabilities ************************************************************************ ***************************************** [ more ] [ reply ] eRoom Multiple Security Issues 2005-07-06 c0ntexb gmail com /* ************************************************************************ ***************************************** $ An open security advisory #9 - eRoom v6.* Vulnerabilities ************************************************************************ ***************************************** [ more ] [ reply ] Re: ekg insecure temporary file creation and arbitrary code execution 2005-07-06 Adam Wysocki (gophi apcoh org) 05.07.05 exploits (at) zataz (dot) net [email concealed] wrote: > Vendor informed: yes Hi, What do you understand by "Vendor informed"? We haven't received any email from you neither to private addresses nor ekg-users/ekg-devel mailing lists. Please also note that the script you pointed at is contributed by a third-party [ more ] [ reply ] [ GLSA 200507-06 ] TikiWiki: Arbitrary command execution through XML-RPC 2005-07-06 Sune Kloppenborg Jeppesen (jaervosz gentoo org) [SECURITY] [DSA 739-1] New trac package fixes upload/download vulnerability 2005-07-06 joey infodrom org (Martin Schulze) Cross site scripting in Lotus Notes web mail 2005-07-06 shalom venera com When an HTML file attachment is opened in a lotus notes account via the web mail interface, the user sees that there is an attachment. Clicking the attachment does not prompt for saving or opening (like in Yahoo), but opens the malicious HTML immediately, allowing for stealing of the LTPA session c [ more ] [ reply ] [SECURITY] [DSA 737-1] New clamav packages fix potential DOS 2005-07-05 Michael Stone (mstone klecker debian org) Re: /dev/random is probably not 2005-07-06 Alexey Toptygin (alexeyt freeshell org) On Tue, 5 Jul 2005, Jack Lloyd wrote: > Assuming the PRNG is any good, it shouldn't matter if an attacker can > manipulate such timings, because (by definition) a good PRNG will still > behave correctly even if an attacker does feed it lots of deliberately > bad data (as long as the PRNG also ha [ more ] [ reply ] PHPXMAIL - Authentication Bypass 2005-07-06 Steve (steve01 chello at) Author: Stefan Lochbihler Date: 6. Juli 2005 Affected Software: PHPXMAIL Software Version: 0.7 -> 1.1 Software URL: http://phpxmail.sourceforge.net/ Attack: Authentication Bypass Overview: PhpXmail is a web based management software for the Xmail mail server written in php. It's main u [ more ] [ reply ] Re: /dev/random is probably not 2005-07-06 Darren Reed (avalon caligula anu edu au) In some mail from Thomas, sie said: > > > Linux cited using keyboard interrupts. How many of those happen on > > a web server in a rack, in an air conditioned computer room somewhere ? > > How many happen when you open up your web browser and select your > > internet banking web site from your boo [ more ] [ reply ] Re: /dev/random is probably not 2005-07-06 Thomas (tom electric-sheep org) > At the last place at which I worked, a few years ago, a "random > number" was generated, and used in a FIPS 140-1 compliant > encryption device, by capturing 128 ethernet frames in sequence > from the local in-house network, gathering the LSB from the > arrival time of each frame, and using those [ more ] [ reply ] Re: /dev/random is probably not 2005-07-06 Thomas (tom electric-sheep org) > Linux cited using keyboard interrupts. How many of those happen on > a web server in a rack, in an air conditioned computer room somewhere ? > How many happen when you open up your web browser and select your > internet banking web site from your bookmarks? To complete the list, Linux uses: - b [ more ] [ reply ] Re: /dev/random is probably not 2005-07-06 Chris Kuethe (chris kuethe gmail com) On 7/4/05, Robert Foxworth <rfoxwor1 (at) tampabay.rr (dot) com [email concealed]> wrote: > At the last place at which I worked, a few years ago, a "random > number" was generated, and used in a FIPS 140-1 compliant > encryption device, by capturing 128 ethernet frames in sequence > from the local in-house network, gathering th [ more ] [ reply ] Re: Imail Cookie Vulnerability (unhashed) 2005-07-06 Christophe Vandeplas (christophe vandeplas com) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sintigan (at) insecure (dot) net [email concealed] wrote: > Neither Regular or secure mode of Imail properly give out a hash on cookies leaving the cookies straight readable to any onlookers. > > No exploit is needed > POC: > > "IMail_UserId > 1006332dgd2@Someserver" > --------- [ more ] [ reply ] Re: /dev/random is probably not 2005-07-06 devnull Rodents Montreal QC CA [The From: address is a bitbucket, to deflect the autoresponder hordes. Use the address in the signature to reach me.] > Why anyone is using the old entropy based RNG at all on modern > commodity hardware? Who said anything about "modern commodity hardware"? :) Not all machines running most of th [ more ] [ reply ] Re: /dev/random is probably not 2005-07-06 devnull Rodents Montreal QC CA [The From: is a bitbucket, to deflect the hordes of broken autoresponders. Use the address in the signature to reach me.] > The original email pointed out that disk seek times may not be quite > as random as previously thought, especially with compact flash and > similar mediums. According to the [ more ] [ reply ] Re: /dev/random is probably not 2005-07-05 ChayoteMu (chayotemu gmail com) It's not necessarily the traffic itself, but aspects of the traffic. Someone had mentioned that the timing between recieving the packets was what's used, even if you see that it may change over the rest of the wire and there's nothing to say that the system is using all the traffic as the attacker s [ more ] [ reply ] VoIP-Phones: Weakness in proccessing SIP-Notify-Messages 2005-07-06 Tobias Glemser (tglemser tele-consulting com) Re: Passwords in RAM dumps [formally Novell GroupWise Plain Text Password Vulnerability.] 2005-07-05 Jason Coombs (jasonc science org) Anything But Microsoft wrote: > Do we conclude this is a Windows problem? Or are Windows programmers lazy, poorly trained or in general a bunch that don't care about security? If you get it right the first time and disclose your engineering design decisions and your source code then you can't sell [ more ] [ reply ] Re: Microsoft Internet Explorer "javaprxy.dll" Code Execution Exploit 2005-07-05 berendjanwever gmail com Thanks you all for notifying the frsirt team of their credit/copyright missteps, they seem to have corrected this on their website. I would like to request any exploit archive to reflect their changes and warn any developers that the code is under GPL and any work based on it will therefore also be [ more ] [ reply ] Advisory 07/2005: Jaws Multiple Remote Code Execution Vulnerabilities 2005-07-06 Stefan Esser (sesser hardened-php net) [SECURITY] [DSA 738-1] New razor packages fix potential DOS 2005-07-05 Michael Stone (mstone klecker debian org) Solaris Socket Hijack 2005-07-06 c0ntexb gmail com /* ************************************************************************ ***************************************** $ An open security advisory #7 - SUN Solaris SO_REUSEADDR Local Socket Hijack Bug ************************************************************************ ********************** [ more ] [ reply ] [SECURITY] [DSA 740-1] New zlib packages fix denial of service 2005-07-06 Michael Stone (mstone klecker debian org) |
|
Privacy Statement |
Gentoo Linux Security Advisory GLSA 200507-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - -
[ more ] [ reply ]