|
|
Colapse all |
Post message
[SECURITY] [DSA 527-1] New pavuk packages fix buffer overflow 2004-07-03 Matt Zimmerman (mdz debian org) [SECURITY] [DSA 526-1] New webmin packages fix multiple vulnerabilities 2004-07-03 Matt Zimmerman (mdz debian org) The 3 D's: Demo for the Dullards and Dunces 2004-07-03 http-equiv (at) excite (dot) com [email concealed] (1 malware com) Take the following little link: http://www.malware.com/punk.html copy and paste it into either of the following: http://www.securityfocus.com/bid/10308 http://www.securityfocus.com/bid/10023 construct an authoritative looking email from your favorite vendor and fire it off to your buddy: htt [ more ] [ reply ] Cart32 Input Validation Flaw in 'GetLatestBuilds?cart32=' Permits Remote Cross-Site Scripting Attacks 2004-07-03 Dr Ponidi (drponidi hackermail com) Indonesia Security Development Team Advisory Cart32 Input Validation Flaw in 'GetLatestBuilds?cart32=' Permits Remote Cross-Site Scripting Attacks ======================================================================== ============================== Advisory Name: Cart32 Input Validation Fl [ more ] [ reply ] Public Review of OIS Security Vulnerability Reporting and Response Guidelines 2004-07-02 OIS (announcements oisafety org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Organization for Internet Safety (OIS) extends an invitation to the readers of the BugTraq, NTBugtraq, and Full-Disclosure mailing lists to participate in the ongoing public review of the OIS Security Vulnerability Reporting and Response Guidelines. [ more ] [ reply ] Re: [Full-Disclosure] Fix for IE ADODB.Stream vulnerability is out 2004-07-03 http-equiv (at) excite (dot) com [email concealed] (1 malware com) <!-- The real fault doesn't belong with individual components (ADODB.Stream included), and I think the almost rant-like posts of Drew Copeley and HTTP-EQUIV miss this fact. ADODB.Stream does *not* represent a vulnerability, although it does act to significantly worsen the impact of an exist [ more ] [ reply ] THE INSIDER VULNERABILITY STILL WORKS AFTER TODAY'S PATCH 2004-07-03 liudieyu umbrella name (1 replies) FROM: Liu Die Yu - http://umbrella.name/ TO : bugtraq (at) securityfocus (dot) com [email concealed], NTBugtraq (at) listserv.ntbugtraq (dot) com [email concealed], full-disclosure (at) lists.netsys (dot) com [email concealed] SUBJ: THE INSIDER VULNERABILITY STILL WORKS AFTER TODAY'S PATCH DATE: 2004/07/03 UTC+800 BODY: [background] the latest 0day remote compromise exploit for in [ more ] [ reply ] RE: [Full-Disclosure] THE VULNERABILITY STILL WORKS AFTER TODAY'S PATCH 2004-07-03 Jelmer (jkuperus planet nl) RE: RE: SUPER SPOOF DELUXE Re: [Full-Disclosure] Microsoft and Security 2004-07-02 http-equiv (at) excite (dot) com [email concealed] (1 malware com) What an utterly pathetic scenario you present. Obviously you're blissfully unaware of the current security trend of site spoofing, 'phishing', url spoofing, DNS spoofing, zone spoofing and on and on and on. and of course now very the latest 'security expert spoofing' ! <!-- "Your subject m [ more ] [ reply ] Enterasys XSR Security Routers DoS 2004-07-02 Frederico Queiroz (fqueiroz ish com br) Description: Enterasys XSR Security Routers crash when passing a packet with the option record route. System Vulnerable: This vulnerability was found in XSR-1800 series. (firmware 7.0.0.0) Proof-of-concept: I've used Hping (http://www.hping.org/) to perform this example: hping3 -1 -G www.uol.com. [ more ] [ reply ] Registry Fix For Variant of Scob 2004-07-02 Drew Copley (dcopley eEye com) About the same time Jelmer found the adodb bug, http-equiv found a similiar issue with the object "Shell.Application". This issue has also been unfixed for the past ten months. Unfortunately, Microsoft has not taken the "hint" and not fixed this issue either. Jelmer has noted this and made a proo [ more ] [ reply ] [HW-MED] XSS in Netegrity IdentityMinder 2004-07-01 vuln hexview com Cross-Site Scripting (XSS) Vulnerability in Netegrity IdentityMinder Classification: =============== Level: low-[MED]-high-crit ID: HEXVIEW*2004*07*02*1 Overview: ========= IdentityMinder is an identity and role management product developed by Netegrity (http://www.netegrity.com), a microsoft gold [ more ] [ reply ] Registry fixes for the recent IE vulnerabilities 2004-07-01 Mike Cheng (mcorl737 hotmail com) Here are the fixes to patch the 2 vulnerability referenced here http://isc.sans.org/diary.php?date=2004-06-27 and here http://www.microsoft.com/security/incident/download_ject.mspx, and stop cross-zone scripting for IE without affecting daily web browsing abilities. 1. Fix the adodb.stream vuln [ more ] [ reply ] FreeBSD Security Advisory FreeBSD-SA-04:13.linux 2004-07-01 FreeBSD Security Advisories (security-advisories freebsd org) Brightmail leaks other user's spam 2004-07-01 Thomas Springer (tuevsec gmx net) Brightmail Spamfilter 6.0 offer a possibility to manage mails identified as spam in a http-driven "control-center" on the Brightmail-Server via links like http://SERVER:41080/brightmail/quarantine/viewMsgDetails.do?id=QMsgView- 3;3-0 Simply altering the last numbers in the URL (3;3 to 4;4, eg.) sh [ more ] [ reply ] [ GLSA 200407-01 ] Esearch: Insecure temp file handling 2004-07-01 Joshua J. Berry (condordes gentoo org) MD5 hash cracking service 2004-07-01 md5er (info passcracking com) I've set up a quick website and system to crack md5 hashes online using Rainbow tables. The project is using RainbowCrack and currently ~47 Gb of tables. At the moment it can crack hashes of lowercase letters and/or numbers up to 8 characters long. The cracking service is free If you are intereste [ more ] [ reply ] RE: Microsoft technologies. By default, non-HIPAA compliant? 2004-07-01 bob (at) dexis (dot) net [email concealed] (bob dexis net) I must deal with HIPAA everyday. In support of the claim that Microsoft is not HIPAA compliant, show me ANY Microsoft machine that actually does Healthcare and show me that I cannot recreate a patient from data stored on the computer in cache or other areas. The machine does NOT have to be connect [ more ] [ reply ] Announce: RSBAC v1.2.3 released 2004-07-02 Amon Ott (ao rsbac org) Rule Set Based Access Control (RSBAC) v1.2.3 has been released! Full information and downloads are available from http://www.rsbac.org We are also proud to announce the relaunch of our Website and a set of worldwide mirrors. RSBAC Key Features: * Free Open Source (GPL) Linux kernel securit [ more ] [ reply ] DLINK 624, script injection vulnerability 2004-07-01 Gregory Duchemin (c3rb3r sympatico ca) TITLE: Security flaw in DLINK 624 - SOHO routers (http://www.dlink.com) TYPE: Script injection over DHCP QUOTE from DLINK: The D-Link Xtreme G DI-624 wireless router with 108Mbps^* upgrade employs five cutting-edge hardware-based compression technologies to achieve a significant boost in perfo [ more ] [ reply ] Sanity check in Centre 2004-07-01 Manip (Bug thelostsite co uk) Summary: [www.miller-group.net] The Miller Group, Inc. announces the release of Centre, a free student information system for public and non-public schools. Centre is a web-based, open source, student management product with features that include scheduling, grade book, attendance, eligibility, [ more ] [ reply ] DoS against Domino 6.5.1 2004-06-30 Andreas Klein (Andreas C Klein physik uni-wuerzburg de) Hello, this problem has been reported to IBM Lotus customer support (PMR 37321,999,724) on Feb 16, 2004 and was reproduced by them. Affected versions: Domino 6.5.1 and newer on Linux (other platforms not tested by me, but Domino 6.5.1 on Windows has been found to be vulnerable too by IBM suppor [ more ] [ reply ] Re: php codes injection in phpMyAdmin version 2.5.7. 2004-07-01 Marc Delisle (DelislMa CollegeSherbrooke qc ca) SecurityLab report: The Top 10 Most Critical Vulnerabilities in June 2004 2004-06-30 Alexander (pigrelax yandex ru) SecurityLab report: The Top 10 Most Critical Vulnerabilities in June 2004 . Firebird Remote Pre-Authentication Database Name Buffer Overrun Vulnerability, http://www.securitylab.ru/45626.html , Bugtraq ID 10446 . Squid Proxy NTLM Authentication Buffer Overflow Vulnerability, http://www.securitylab. [ more ] [ reply ] |
|
Privacy Statement |
Hash: SHA1
- ------------------------------------------------------------------------
--
Debian Security Advisory DSA 527-1 security (at) debian (dot) org [email concealed]
http://www.debian.org/security/ Matt Zimmerman
July 3rd, 2004
[ more ] [ reply ]