|
|
Colapse all |
Post message
ASN.1 telephony critical infrastructure warning - VOIP 2004-02-17 Gadi Evron (ge egotistical reprehensible net) RE: [Full-Disclosure] Misinformation in Security Advisories (ASN.1) 2004-02-16 first last (randnut hotmail com) John Compton john_compton24 (at) yahoo (dot) com [email concealed] wrote: >Another possibility for remote code execution would be to trigger a >context-switch mid-memcpy which would halt the memory copy operation >before it hits an unpaged address. This, if possible, might leave the >heap in a corrupted state but allow another [ more ] [ reply ] Re: [Full-Disclosure] Misinformation in Security Advisories (ASN.1) 2004-02-16 Valdis Kletnieks vt edu On Mon, 16 Feb 2004 08:42:23 PST, John Compton <john_compton24 (at) yahoo (dot) com [email concealed]> said: > You are likely not going to see any more than the DoS exploit that has > already come out. For those of you interested in the technical explanation of > why, it is included below (it's honestly beyond my complete und [ more ] [ reply ] APC 9606 SmartSlot Web/SNMP management card "backdoor" 2004-02-16 Dave Tarbatt (bugtraq always sniffing net) KarjaSoft Sami HTTP Server 1.0.4 Buffer Overflow 2004-02-17 badpack3t (badpack3t security-protocols com) ZH2004-06SA (security advisory): ShopCartCGI v2.3 Remote arbitrary file retrieving 2004-02-17 ZetaLabs (zetalabs zone-h org) ZH2004-06SA (security advisory): ShopCartCGI v2.3 Remote arbitrary file retrieving Published: 17 february 2004 Released: 17 february 2004 Name: ShopCartCGI Affected Systems: 2.3 Issue: Remote arbitrary file retrieving Author: G00db0y from Zone-h Security Labs - g00db0y (at) zone-h (dot) org [email concealed] [ more ] [ reply ] YABB information leakage on failed login 2004-02-17 David Cantrell (david cantrell org uk) YABB is a popular web-based bulletin board system, written in perl and available from <http://www.yabbforum.com/>. While evaluating it, I found a minor issue where an attacker trying to log in to the forums can extract some useful information making his job easier than it needs to be. Most YABB fo [ more ] [ reply ] [ GLSA 200402-06 ] Linux kernel AMD64 ptrace vulnerability 2004-02-17 Tim Yamin (plasmaroo gentoo org) [ GLSA 200402-05 ] phpMyAdmin < 2.5.6-rc1 directory traversal attack 2004-02-17 Tim Yamin (plasmaroo gentoo org) Re: Misinformation in Security Advisories (ASN.1) 2004-02-16 Steven M. Christey (coley mitre org) Based on our experiences in CVE, many advisories frequently have (a) incomplete, (b) inaccurate, or (c) inconsistent information. To use the eEye / ASN.1 issue as a *single* example of many that I run across: - eEye published 2 advisories that each said there were "multiple" integer overflo [ more ] [ reply ] RE: Exploit based on leaked code released. 2004-02-16 tlarholm pivx com I can verify that the attached Proof of Concept bitmap produced a DoS on several IE versions, including IE5.01 SP1 5.00.2614.3500 on Windows 2000 Pro SP2 IE5.01 SP1 5.00.2920.0000 on Windows 2000 Pro SP2 IE5.01 SP2 5.00.3315.1000 on Windows 2000 Pro SP2 The latter configuration is still supported [ more ] [ reply ] Another YabbSE SQL Injection 2004-02-16 backspace (backspace_2k terra es) Summary YaBB SE is a PHP/MySQL port of the popular forum software YaBB (yet another bulletin board). An SQL injection vulnerability allows a remote attacker to execute malicious SQL statements on the database remotely Details Vulnerable Systems: * YaBB SE versions 1.5.4, 1.5.5, possibly others T [ more ] [ reply ] AllMyLinks PHP Code Injection vulnerability 2004-02-14 Pablo Santana (m4dsk4t3r hotmail com) ******** AllMyLinks PHP Code Injection vulnerability ******** Product : AllMyLinks Vendor : www.php-resource.net Date : February 14, 2004 Problem : PHP Code Injection Vendor Contacted ? : No ************************** Source **************************** in /include/footer.inc.php - [ more ] [ reply ] LNSA-#2004-0001: mutt remote crash 2004-02-15 Vincenzo Ciaglia (ciaglia netwosix org) ************************************************************************ ************ Netwosix Linux Security Advisory #2004-0001 <http://www.netwosix.org> ------------------------------------------------------------------------ ----------- Package name: mutt Summary: remote crash Date [ more ] [ reply ] AllMyVisitors PHP Code Injection vulnerability 2004-02-14 Pablo Santana (m4dsk4t3r hotmail com) ******** AllMyVisitors PHP Code Injection vulnerability ******** Product : AllMyVisitors Vendor : www.php-resource.net Date : February 14, 2004 Problem : PHP Code Injection Vendor Contacted ? : No ************************** Source **************************** in /include/info.inc.php [ more ] [ reply ] |
|
Privacy Statement |
different */CERT teams for different countries.
As we all know, ASN.1 is a new very easy to exploit vulnerability. It
attacks both the server and the end user (IIS and IE).
We expect a new massive worm to come out exploiting
[ more ] [ reply ]