In-Reply-To: <8b9feba90ad5d6740b8fb96b9033a378 (at) 212.142.33 (dot) 197 [email concealed]>

>On which operation system? I guess windows, so on which windows version(s)?

i've tested on WIN XP...

>

>> hcp://services/layout/contentonly?topic=...

><snip>

>

>http://www.microsoft.com/technet/treeview/default.asp?url=/techne

[ more ]  [ reply ]

This is referring to MS03-043 on a Windows 2000 system scanning with
MBSA 1.2 (the mbsa version is important, as different versions of MBSA
use entirely different XML files)

The entry in the XML file used by MBSA 1.2 references two files for this
patch. The XML file does not list any reg keys for

[ more ]  [ reply ]

BTW, I should note that one user did respond back to my pseudo-challenge
and noted that small businesses like his can not afford professional
vulnerability assessment solutions.

I apologize for alienating these users.

To such users: please start using the free Nessus tool. Use MBSA as a
back-up.

[ more ]  [ reply ]

> Yeah, but won't this break a lot of programs that install their DLL's
> in their own directories by design, so that they may be installed by
> users without administrative privileges on older versions of Windows?

The change still allows use of DLLs in the application directory; it just
puts th

[ more ]  [ reply ]

This advisory first submitted to BugTraq July 2003 - rejected but since a less detailed post on this subject made it to the list as a reply and there have been subsequent inquiries regarding it off-list, there may be interest in placing this on the list now.

Email exchanges with BugTraq personnel

[ more ]  [ reply ]

> -----Original Message-----
> From: Joe DeMarco [mailto:demarcoj (at) comcast (dot) net [email concealed]]
> Sent: Tuesday, February 10, 2004 11:27 AM
> To: bugtraq (at) securityfocus (dot) com [email concealed]
> Subject: RE: Another Low Blow From Microsoft: MBSA Failure!
>
> Maybe it's just me but, I wouldn't consider a patch
> successfully applie

[ more ]  [ reply ]

> One thing nobody seems to want to recognize as a possibility here is
> that MyDoom.B didn't take off as much as MyDoom.A precisely BECAUSE of
> the US-CERT email. A lot of members of the press took that pretty
> seriously, and warnings on the evening network news shows that you
> shouldn't open th

[ more ]  [ reply ]

> Nigel Horne wrote:
>
>> I tried reproducing the problem with the latest source in CVS, but
>> had no problems.
>> 0.65 is rather old, please try again with the latest version.
>
>
> 0.65 ist the latest stable (release) version, so I guess most
> production servers would
> run it, instead of an

[ more ]  [ reply ]

Mutt-1.4.2 has just been released; this version fixes a buffer
overflow that can be triggered by incoming messages. There are
reports about spam that has actually triggered this problem and
crashed mutt.

It is recommended that users of mutt versions prior to 1.4.2 upgrade
to this version, or apply

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
Red Hat Security Advisory

Synopsis: Updated mutt packages fix remotely-triggerable crash
Advisory ID: RHSA-2004:051-01
Issue date: 2004-02-

[ more ]  [ reply ]

ZH2004-05SA (security advisory): Sql Injection Vulnerability in BosDates

Published: 11 february 2004

Released: 11 february 2004

Name: BosDates

Affected Systems: current and prior versions

Issue: Sql Injection Vulnerability

Author: G00db0y from Zone-h Security Labs - zetalabs@zone

[ more ]  [ reply ]

The Real Security Update notice at

http://service.real.com/help/faq/security/040123_player/EN/

gives a download URL for the English RealPlayer v2 (build 6.0.11.872) and
instructs users of localised v2 players to use the Check for Updates menu
option in the product.

Just for fun, I tried Chec

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

PHP Code Injection Vulnerabilities in ezContents 2.0.2 and prior

########################################################################
########
Summary :

ezContents a free open source content management system has been found to be
vulnerable to Mu

[ more ]  [ reply ]

Maybe it's just me but, I wouldn't consider a patch successfully applied
until the machine is rebooted. Registry changes usually require this
process.

-----Original Message-----
From: dotsecure (at) hushmail (dot) com [email concealed] [mailto:dotsecure (at) hushmail (dot) com [email concealed]]
Sent: Tuesday, February 10, 2004 1:21 PM
To: full-disclosur

[ more ]  [ reply ]

And just to make things a little more interesting, informal
testing suggests that at least two AV products have trouble
recognising and scanning bounced viral attachments. MIME
boundary issues, perhaps.

--
David Harley
Threat Assessment Centre Manager
Anti-Virus/Email Abuse Specialist
NHS Informat

[ more ]  [ reply ]

I think Microsoft is using wording to keep the typical end user in a
warm and cozy state. Technically, except for AD services, each client
has a full server implementation and as such should be vulnerable. I
assume that many of those DSL-connected, non-firewalled home machines
are easy targets.

And

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

@stake, Inc.
www.atstake.com

Security Advisory

Advisory Name: Virtual PC Services Insecure Temporary File Creation
Release Date: 02/10/2004
Application: Con

[ more ]  [ reply ]

Marc,

If we remove the default exemptions for Kerberos & RSVP from IPSEC with
the "NoDefaultExempt" registry key, this still passes IKE. Therefore is
IKE vulnerable to the ASN bug?

Thanks,
Tim

>>> "Marc Maiffret" <mmaiffret (at) eeye (dot) com [email concealed]> 11/02/2004 7:47:29 am >>>
Yes, I am not sure what Microsoft d

[ more ]  [ reply ]

In-Reply-To: <4027D8CD.2080807 (at) linuxbox (dot) org [email concealed]>

yeah Mydoom.C = Doomjuice.A

Mihai Neagu of BitDefender said that Doomjuice was especially designed to drop an archive that looks like the source-code of the Novarg/Mydoom worm.

After copying itself to System directory with the name INTERNAT.EXE, i

[ more ]  [ reply ]

Larry Seltzer opined:

> I agree that MyDoom demonstrates all too clearly the inherent
> limitations of conventional antivirus technology, but you're
> still unfair to it. First, the vast majority of attacks don't
> spread as far and as fast as MyDoom, and by the time one is
> likely to encounter i

[ more ]  [ reply ]