|
|
Prev week |
Colapse all |
Post message
Re: [Tclhttpd-users] Re: TCLHttpd Server - Multiple Vulnerabilities 2003-09-24 Brent Welch (welch panasas com) Here is the patch for the dirlist.tcl bug Please note also that with this bug you can see a directory listing, but you cannot fetch any files that you might be able to see. The server running at www.tcl.tk has had this patch applied to it. *** dirlist.tcl 4 Apr 2003 04:10:54 -0000 1.10 --- d [ more ] [ reply ] RE: [Fwd: Re: AIM Password theft] VU#865940 2003-09-24 CERT(R) Coordination Center (cert cert org) -----BEGIN PGP SIGNED MESSAGE----- Thor Larholm <thor (at) pivx (dot) com [email concealed]> writes: > This is just a simple exploit utilizing the Object Data vulnerability > discovered by Drew Copley, coupled with the GreyMagic no-script HTML > rendering as demonstrated earlier on this list and others by jelmer. > > Tell yo [ more ] [ reply ] Re-Boot Design ASP Forum SQL injection Vulnerability 2003-09-24 Bahaa Naamneh (b_naamneh hotmail com) Re: [Fwd: Re: AIM Password theft] 2003-09-24 DarkKnight (mbuzz04 yahoo com) In-Reply-To: <3F7077FE.70303 (at) uniontown (dot) com [email concealed]> That method of stealing was taken from my website, "counter" is used to trick users into thinking that the script is just for a counter, but in reality it is just the object vulnerability. Anyways, AIM will do nothing to fix this. Why? Because it is not a [ more ] [ reply ] RE: [Fwd: Re: AIM Password theft] VU#865940 2003-09-24 Thor Larholm (thor pivx com) Art, You are correct, I should not have replied to Mark when I had not yet had my morning coffee. The dynamic rendering of OBJECT elements still trigger the HTA functionality exposed in Windows. Personally, though, I see this as an unrelated vulnerability regarding static/dynamic code rendering [ more ] [ reply ] RE: Does VeriSign's SiteFinder service violate the ECPA? 2003-09-24 Christopher Wagner (chrisw pacaids com) Your reply is well thought-out and logical, and most certainly all admins shouldn't be responsible for making sure typo'd URLs don't get intercepted by their webservers. The point I think Mr. Smith is trying to make is that Verisign seems to *want* to intercept this private information and use it t [ more ] [ reply ] Re: AIM Password theft 2003-09-24 http-equiv (at) excite (dot) com [email concealed] (1 malware com) <!-- Out of curiosity I followed that link which loaded start.html (attached). --> Caution: off-site archives will and have already stored this as: text/plain attachment: start.txt Tested on neohapsis [http://archives.neohapsis.com/archives/bugtraq/2003-09/0375.html] Due to the 'neve [ more ] [ reply ] [CLA-2003:749] Conectiva Security Announcement - php4 2003-09-24 Conectiva Updates (secure conectiva com br) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ -- CONECTIVA LINUX SECURITY ANNOUNCEMENT - ------------------------------------------------------------------------ -- PACKAGE : php4 SUMMARY : Integer overflow vulnerabiliti [ more ] [ reply ] Denial of Service against Gauntlet-Firewall / SQL-Gateway 2003-09-24 Oliver Heinz (heinz arago de) DOS-Attack against Gauntlet Firewall ------------------------------------- We found out a security-issue with the Oracle-Proxy (SQL-Gateway) of Gauntlet Firewall, Version 6 (manufactured by Secure Computing/NAI, serversrunning Solaris 8, newest Patches installed). Abstract: --------- Sen [ more ] [ reply ] Re: base64 2003-09-24 Seth Breidbart (sethb panix com) > See the corresponding RFC. The number of characters in a base64-coded > text must be a multiply of 4. So ='s are used if there aren't enough > characters and are added at the end of the text. > > = is not a valid character inside Base64 and an encoder should stop > with an error or stops decoding. [ more ] [ reply ] Re: AIM Password theft 2003-09-24 Eric Joe (sysop tje1 com) Mark/Brent, I received a SPAM message that does exactly as you described. Here is the message text ------------------------------------------------------------------------ ---- You have a secret admirer Find out who below http://www.geocities.com/merlin54906/webcam.html If you want further informa [ more ] [ reply ] BRS WebWeaver: Anonymous Surfing 2003-09-24 euronymous (just-a-user yandex ru) =:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: BRS WebWeaver: Anonymous Surfing product: BRS WebWeaver 1.06 vendor: http://www.brswebweaver.com risk: high date: 09/24/2k3 discovered by: euronymous /F0KP advisory urls: http://f0kp.iplus.ru/bz/027_en http://f0kp.iplus.ru/bz/ [ more ] [ reply ] Re: AIM Password theft 2003-09-24 jelmer (jkuperus planet nl) That would be my ado thingie There's a temporary fix over at http://ip3e83566f.speed.planet.nl/hacked-by-chinese/5.htm --jelmer On Tuesday 23 September 2003 21:13, Brent Meshier wrote: > Mark, > The code you just sent looks familiar to a SPAM I received > attempting to hijack users' e-gold acco [ more ] [ reply ] Re: Privacy leak in VeriSign's SiteFinder service #2 2003-09-24 der Mouse (mouse Rodents Montreal QC CA) > Verisign does NOT reject the connection until AFTER the MAIL FROM: > and RCPT TO: fields have been communicated by your email server. The "server" they had completely ignored, as far as anyone could tell, all input: you could type total garbage lines and get exactly the same canned sequence of re [ more ] [ reply ] Re: base64 2003-09-24 MightyE (trash mightye org) I agree, I don't think it's unreasonable to reject improperly formatted messages. Chances are much higher that they're spam or virii, and the minority with broken clients will find their way to non-broken clients. If you are parsing the message, particularly looking for malware, and encounter [ more ] [ reply ] Re: base64 2003-09-24 der Mouse (mouse Rodents Montreal QC CA) > 99.99% of all software should create the standard form, so please let > the tiny fraction of users with broken software suffer when their > mails get rejected. > (Note: this of course applies not only to Base64 but to all aspects > of header-parsing, file-format guessing etc...) I agree with you [ more ] [ reply ] Re: base64 2003-09-24 David Wilson (David Wilson isode com) > > 99.99% of all software should create the standard form, so please > let the tiny fraction of users with broken software suffer > when their mails get rejected. > > (Note: this of course applies not only to Base64 but to all aspects > of header-parsing, file-format guessing etc...) I wish it [ more ] [ reply ] Re: base64 2003-09-24 David Wilson (David Wilson isode com) On Tue, 2003-09-23 at 19:10, Lothar Kimmeringer wrote: > On Tue, 23 Sep 2003 12:18:31 -0400 (EDT), Birl wrote: > > >Excuse my ignorance. I tried to pook around some B64 attachements in my > >email files for an answer. > > > > > >Are you stating that an = > > > >1) should not appear in B64 at all > [ more ] [ reply ] Re: Privacy leak in VeriSign's SiteFinder service #2 2003-09-24 Marco Ivaldi (raptor 0xdeadbeef info) On Wed, 24 Sep 2003, Mark Coleman wrote: > TELNET YYAAHHOO.COM 25 > > 220 sitefinder.verisign.com VeriSign mail rejector (Postfix) > mail from:source (at) yahoo (dot) com [email concealed] > 250 Ok > rcpt to:user (at) yyaahhoo (dot) com [email concealed] > 550 <unknown[198.252.172.254]>: Client host rejected: The domain you are > trying > to send mail to [ more ] [ reply ] Privacy leak in VeriSign's SiteFinder service #2 2003-09-24 Mark Coleman (markc uniontown com) More naughty Verisign deeds... I don't know if this has been mentioned, but any mis-addressed email to a non-existent domain will reveal the sender AND intended recipient to a conveniently placed Verisign SMTP server where it can (and probably is) being tracked. For example, an email sent to us [ more ] [ reply ] FreeBSD Security Advisory FreeBSD-SA-03:14.arp 2003-09-24 FreeBSD Security Advisories (security-advisories freebsd org) TCLHttpd Server - Multiple Vulnerabilities 2003-09-24 Phuong Nguyen (dphuong yahoo com) Released Date 09/23/2003 TITLE ===== TCLHttpd 3.4.2 - Multiple Vulnerabilities DESCRIPTION =========== "TclHttpd is used both as a general-purpose Web server, and as a framework for building server applications. It implements Tcl (http://www.tcl.tk), including the Tcl Resource Center and Scriptics [ more ] [ reply ] [ESA-20030924-026] 'WebTool-userpass' passphrase disclosure vulnerability. 2003-09-24 EnGarde Secure Linux (security guardiandigital com) Re: [Full-Disclosure] GLSA: openssh (200309-14) 2003-09-23 Ademar de Souza Reis Jr. (ademar conectiva com br) On Tue, Sep 23, 2003 at 10:25:37PM +0200, Daniel Ahlberg wrote: > - - --------------------------------------------------------------------- > GENTOO LINUX SECURITY ANNOUNCEMENT 200309-14 > - - --------------------------------------------------------------------- > > PACKAGE : openssh > SUMMARY : mu [ more ] [ reply ] Privacy leak in VeriSign's SiteFinder service 2003-09-23 Richard M. Smith (rms computerbytesman com) Hi, I just discovered that VeriSign's SiteFinder Web site is leaking data submitted in Web forms to its marketing analysis partner, Omniture. Forms can easily contain personal information such as an email address. For the problem to occur, a Web form must use the GET method. This data spill prob [ more ] [ reply ] |
|
Privacy Statement |
Comment Board XSS Vulnerability
Published: 24 September 2003
Released: 24 September 2003
Affected Systems: Comment Board
Vendor: http://www.ymonda.co.uk
Issue: Remote attackers can inject XSS script.
Description:
============
"Comment Board works straight away with lit
[ more ] [ reply ]