|
|
Colapse all |
Post message
SGI Advanced Linux Environment security update #7 2003-12-17 SGI Security Coordinator (agent99 sgi com) SARA 5.0 2003-12-18 toddr arc com We have not posted any of our updates on SARA for over two years (except a rebuttal today) so I would like to share what we have done with SARA. 1. We are the only current open source implementation of SATAN 2. Yes, current with updates monthly. 3. We run on most Unix and MAC OS/x installa [ more ] [ reply ] Re: Edonkey/Overnet Plugins capable of Virus/Worm behavior 2003-12-18 Julian Ashton (ashton joltmedia com) In-Reply-To: <20031217225422.GA13131 (at) cs.uoregon (dot) edu [email concealed]> I am concearned that this is a P2P app with over 1.2 million simulatneous users and that anyone can write a plugin and put it on the network, the plugin CAN self propgate and CAN force overnet/edonkey to perform DDOS attacks. But where is the sec [ more ] [ reply ] Re: Cross-site scripting vulnerability in SARA v<=4.2.7 2003-12-18 toddr arc com In-Reply-To: <Pine.OSF.4.44.0312171328080.17165-100000 (at) oppie.physics.umd (dot) edu [email concealed]> Hi there, Bob Todd from Advanced Research Corporation, the developer of SARA. I have been talking to Tom and I am somewhat surprised by his email. Let me explain: 1. CSS: Tom indicates that SATAN and older vers [ more ] [ reply ] [RHSA-2003:405-01] Updated apache packages fix minor security vulnerability 2003-12-18 bugzilla redhat com MDKSA-2003:117 - Updated irssi packages fix remote crash 2003-12-18 Mandrake Linux Security Team (security linux-mandrake com) NetBSD Security Advisory 2003-018: DNS negative cache poisoning 2003-12-17 NetBSD Security Officer (security-officer NetBSD org) Cross-site scripting vulnerability in SARA v<=4.2.7 2003-12-17 Thomas M. Payerle (payerle physics umd edu) XSS Vulnerability in Security Auditor's Research Assistant (SARA) versions before 5.0.0 Affects: SARA versions 4.2.6 and 4.2.7. Older versions not tested, presumably affected. Related software (sharing common ancestry): SATAN 1.1.1 would not run properly on my test platform, but checking the code [ more ] [ reply ] Edonkey/Overnet Plugins capable of Virus/Worm behavior 2003-12-17 Julian Ashton (ashton joltmedia com) (2 replies) I have concearns about the Plugin arhcitechture and the power given to all the devs out there and possible end user harm. I am writing the FastTrack plugin for Edonkey/Overnet and during this process have realized that this is by far the worst and most insecure plugin architechture I have ever see [ more ] [ reply ] Re: Edonkey/Overnet Plugins capable of Virus/Worm behavior 2003-12-17 Pavel Kankovsky (peak argo troja mff cuni cz) (1 replies) Re: Edonkey/Overnet Plugins capable of Virus/Worm behavior 2003-12-17 Eric Anderson (anderson cs uoregon edu) Re: Internet Explorer and Opera local zone restriction bypass 2003-12-16 william schulze (was macromedia com) In-Reply-To: <20031030153550.15455.qmail (at) sf-www1-symnsj.securityfocus (dot) com [email concealed]> All: Please note that Macromedia has released an update to Flash Player 7 to address the "local zone restriction bypass" security issue. More details are available in our security bulletin posted at the Macromedia Securi [ more ] [ reply ] [OpenPKG-SA-2003.052] OpenPKG Security Advisory (cvs) 2003-12-17 OpenPKG (openpkg openpkg org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________ OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security.html http://www.openpkg.org openpkg-security (at) openpkg (dot) org [email concealed] [ more ] [ reply ] [OpenPKG-SA-2003.053] OpenPKG Security Advisory (lftp) 2003-12-17 OpenPKG (openpkg openpkg org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________ OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security.html http://www.openpkg.org openpkg-security (at) openpkg (dot) org [email concealed] [ more ] [ reply ] Server side scripts viewing in Goahead webserver <= 2.1.7 2003-12-17 Luigi Auriemma (aluigi altervista org) Re:Re: SQL Injection Vuln In osCommerce 2.2-MS1 2003-12-16 JeiAr (security gulftech org) In-Reply-To: <20031215061530.20789.qmail (at) sf-www2-symnsj.securityfocus (dot) com [email concealed]> This vulnerability also exists in the account_edit_process.php and pretty much anywhere else you can input data into the country field by altering the form. JeiAr >X-Mailer: MIME-tools 5.411 (Entity 5.404) >From: Je [ more ] [ reply ] RE: Self-signed certs unrestricted in Windows XP 2003-12-16 Menashe Eliezer (menashe finjan com) Andrew, Your test demonstrates more problems: 1. The signed applet has been launched automatically without any security warning that asks whether to trust the signer. The browser assumes that since you trust the signer for signing the page, you also trust the signer to sign the Java applet. However [ more ] [ reply ] [RHSA-2003:320-01] Updated httpd packages fix Apache security vulnerabilities 2003-12-16 bugzilla redhat com ms03-043 2003-12-16 MrNice MrNice (balzen81 hotmail com) (1 replies) |
|
Privacy Statement |
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
--
GENTOO LINUX SECURITY ANNOUNCEMENT 200312-07
- ------------------------------------------------------------------------
--
GLSA: 200312-07
Package: net-ftp/lftp
Su
[ more ] [ reply ]