SIG^2 Vulnerability Research Advisory

SurgeFTP LEAK Command Denial-Of-Service Vulnerability

by Tan Chew Keong
Release Date: 07 Apr 2005

ADVISORY URL
http://www.security.org.sg/vuln/surgeftp22m1.html

SUMMARY

SurgeFTP (http://netwinsite.com/surgeftp/) is an FTP server with SSL/TLS security, e

[ more ]  [ reply ]

In-Reply-To: <87r7irrzne.fsf (at) evinrude.uhoreg (dot) ca [email concealed]>

Hi

Two notes:

- the format string security bug is now fixed in hashcash-1.17

- Hubert is correct that the bug was not in hashcash-1.13, it was introduced in hashcash 1.14

Cheers

Adam

>Just to note, version 1.13 of hashcash (incidentally, the ve

[ more ]  [ reply ]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200504-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - -

[ more ]  [ reply ]

I tried posting a follow-up to this topic, but it was moderated out of
existence.

Looking back at my paypal phishing e-mail again and all the other
possibilities... I think the actual reason for the non-exploit phishing
spam is that that idiot spammers forgot to include the exploit.

What is more l

[ more ]  [ reply ]

Hello,

http://www.victimsite.com/index.php?&language=f00bar.php

Warning: Failed opening '/var/www/html/admin/lang/f00bar.php' for inclusion
(include_path='.:/usr/share/pear') in /var/www/html/admin/settings.inc.php
on line 147

This is path disclosure but it can also be used for malicious file inc

[ more ]  [ reply ]

{=======================================================================
=========}
{ [waraxe-2005-SA#041] }
{=======================================================================
=========}
{

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dcrab 's Security Advisory
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/

Get Dcrab's Services to audit your Web servers, scripts, networks, etc. Learn more at http://www.digitalparadox.org/services.ah

Se

[ more ]  [ reply ]

IBM Lotus Domino Server Web Service DoS Vulnerability

iDEFENSE Security Advisory 04.06.05
http://www.idefense.com/application/poi/display?type=vulnerabilities
April 6, 2005

I. BACKGROUND

IBM Lotus Domino Server software provides messaging, calendaring and
scheduling capabilities on a variety of o

[ more ]  [ reply ]

Is this the same GIF vuln that's already been talked about.

Also, why not contact M$?

I'm not against FD if conducted responsibly, but by not contacting the vendor you're acting in an irresponsible manner.

-----Original Message-----
From: Luca Ercoli <io (at) lucaercoli (dot) it [email concealed]>
Date: 6 Apr 2005 01:55:57

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory:
=======================
Vulnerabilities in Cisco IOS Secure Shell Server
================================================

Revision 1.0

For Public Release 2005 April 06 1600 UTC (GMT)

- ----------------------------------------

[ more ]  [ reply ]

===========================================================
Ubuntu Security Notice USN-108-1 April 05, 2005
gtk+2.0, gdk-pixbuf vulnerabilities
CAN-2005-0891
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

========================================================================
=====
FreeBSD-SA-05:03.amd64 Security Advisory
The FreeBSD Project

Topic: un

[ more ]  [ reply ]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200504-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - -

[ more ]  [ reply ]

OSX Root Compromise
04/05/2005

Summary:
OSX can be root compromised by a trojan application. The trojan
application does not require explicit user authentication to elevate its
privileges to root, nor does the root account need to be enabled. The
Trojan application must be run from an account tha

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dcrab 's Security Advisory
[Hsc Security Group] http://www.hackerscenter.com/
[dP Security] http://digitalparadox.org/

Get Dcrab's Services to audit your Web servers, scripts, networks, etc. Learn more at http://www.digitalparadox.org/services.ah

Se

[ more ]  [ reply ]

===========================================================
Ubuntu Security Notice USN-109-1 April 06, 2005
mysql-dfsg vulnerability
CAN-2004-0957
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

T

[ more ]  [ reply ]

Package: Microsoft Explorer
Auth: http://www.microsoft.com/
Vulnerability: Denial of Service
System(s) affected:

- Tested on Windows XP Home Edition [explorer 6.00.2800.1106 (xpsp1.020828-1920)]
- Windows 2000 seem to be not vulnerable.
- Vulnerability has not been tested on other versions of Mic

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory:
========================
Vulnerabilities in the Internet Key Exchange Xauth Implementation
=================================================================

Revision 1.0

For Public Release 2005 April 6 1600 UTC

- ----------

[ more ]  [ reply ]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200504-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - -

[ more ]  [ reply ]

Products: runcms/e-xoops 1.1A (http://www.runcms.org)

Summary: runcms/e-xoops 1.1A and below file upload vulnerability

Description
===========
runcms/e-xoops is an extensible, OO (Object Oriented), easy to use dynamic
web content management system
written in PHP. runcms/e-xoops is the ideal too

[ more ]  [ reply ]

Below is a periodic public report from the drone armies / botnets
research and mitigation mailing list.
For this report it should be noted that we base our analysis on the data
we have accumulated from various sources.

According to our incomplete analysis of information we have thus far, we
now pub

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Name: vixie-cron
Author: Karol Wiêsek <appelast (at) drumnbass.art (dot) pl [email concealed]>
Date: Mar 21, 2005

Issue:

crontab allows any user to read another users crontabs

Description:

Crontab is used to create special files used by cron to execute commands
at specifi

[ more ]  [ reply ]

-=[---------------------ADVISORY---------------------------]=-
-=[
]=-
-=[ MailEnable Enterprise & Pro remote DOS ]=-
-=[

[ more ]  [ reply ]

Computer Associates eTrust Intrusion Detection System CPImportKey
Denial of Service Vulnerability

iDEFENSE Security Advisory 04.05.05
www.idefense.com/application/poi/display?id=223&type=vulnerabilities
April 05, 2005

I. BACKGROUND

Computer Associates International, Inc.'s (CA) eTrust Intrusion

[ more ]  [ reply ]

NGSSoftware Insight Security Research Advisory

Name: Sybase ASE Multiple Security Issues
Systems Affected: Sybase ASE versions prior to 12.5.3 ESD#1
Severity: High
Vendor URL: http://www.sybase.com/
Researchers: Mark Litchfield [ mark (at) ngssoftware (dot) com [email concealed] ]
Sherief Hammad [ sherief@ngssof

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________

OpenPKG Security Advisory The OpenPKG Project
http://www.openpkg.org/security.html http://www.openpkg.org
openpkg-security (at) openpkg (dot) org [email concealed]

[ more ]  [ reply ]