-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

iDEFENSE Security Advisory 11.08.02b:
http://www.idefense.com/advisory/11.08.02b.txt
Non-Explicit Path Vulnerability in QNX Neutrino RTOS
November 8, 2002

I. BACKGROUND

QNX Software Systems Ltd.'s Neutrino RTOS (QNX) is a real-time
operating system de

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

iDEFENSE Security Advisory 11.08.02a:
http://www.idefense.com/advisory/11.08.02a.txt
File Disclosure Vulnerability in Simple Web Server
November 8, 2002

I. BACKGROUND

As its name suggests, Peter Sandvik's Simple Web Server is a
Linux-based web server.

[ more ]  [ reply ]

For a small data point regarding the need to (somehow) address XSS
vulnerabilities: according to CVE statistics, XSS issues are the
second most frequently reported vulnerability type this year [1],
behind buffer overflows (though new "flavors" of overflows help to
maintain that #1 position.) Note:

[ more ]  [ reply ]

Hi Adreas

I just read his reply aswell and I dont agree with him on some points. Sure
enough there are ways to execute code despite restictions such as you
mention (not running activex components not marked safe for scripting) ,
like the http-equiv thingie where you drop a file (wich is really my i

[ more ]  [ reply ]

At 10:44 AM 2002-11-05 -0800, Michael Howard wrote:

>During the Windows Security Push in Feb/Mar 2002, the Microsoft Internet
>Explorer team devised a method to reduce the risk of cookie-stealing
>attacks via XSS vulnerabilities.

If I understand the XSS vulnerability correctly, it is all based on

[ more ]  [ reply ]

Does any one have or know of a security contact within www.real.com, as I
have a serious issue to report. Tried the website, only have technical
support and the web forms don't allow for much content.

Any help in this regard would be most appreciated.

Regards

Mark Litchfield
NGS Software Ltd
ht

[ more ]  [ reply ]

Lotus Domino http (version) banner will appear despite

notes.ini 'DominoNoBanner=1' setting. To recreate:

formulate a URL requesting a non-existing nsf database.

Example: 'http://serverAddress/nosuchdb.nsf'

Has been verified on Lotus Domino 5.0.8, 5.0.9 and

5.0.9a. IBM Support is documen

[ more ]  [ reply ]

In-Reply-To: <20021106185730.15557.qmail (at) mail.securityfocus (dot) com [email concealed]>

>> Possibly vulnerable, not tested, OEM Version from GlobalSunTech:

>> D-Link DWL-900AP+ B1 version 2.1 and 2.2

>> ALLOY GL-2422AP-S

>> EUSSO GL2422-AP

>> LINKSYS

[ more ]  [ reply ]

Hello,

I have seen this bug a few months ago and have been
using it every now and then since.

Yet, if the user is online in invisible mode and you
ask for his shared files, he will likely get a pop-up
telling him that someone is trying to access his
files. This probably depends on his security
pre

[ more ]  [ reply ]

It is a very interesting idea, but it would take some years to start to take
effect, as non-compatible browsers would still be on the market for a few
years; Can't we find a solution that works on current browsers?

Initially, I thought about encrypting cookie content with a server based
key. But th

[ more ]  [ reply ]

This seems the wrong way round to me.
After all, how often do you access cookies from client side code?
Personally, I've never done it.
I would have IE disallow all access to cookies from scripts, unless
either, it's disabled in security options (Allow scripts to access
cookies) or the server passes

[ more ]  [ reply ]

Vulnerability in Cutecast Forum v1.2

You can read passwords of all users. (Passwords in Plaintext)

Exploit:

http://www.website.com/cgi-bin/cutecast/members/<username>.user

Zero X, member of www.lobnan.de
--
______________________________________________
http://www.linuxmail.org/
Now with POP3/

[ more ]  [ reply ]

---------------------------------------------------------------------
Red Hat, Inc. Red Hat Security Advisory

Synopsis: Updated glibc packages fix vulnerabilities in resolver
Advisory ID: RHSA-2002:197-09
Issue date: 2002-09-10
Updated on: 2002-11-06

[ more ]  [ reply ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
--
Debian Security Advisory DSA 191-1 security (at) debian (dot) org [email concealed]
http://www.debian.org/security/ Martin Schulze
November 7th, 2002

[ more ]  [ reply ]

---------------------------------------------------------------------
Red Hat, Inc. Red Hat Security Advisory

Synopsis: Updated kerberos packages available
Advisory ID: RHSA-2002:242-06
Issue date: 2002-11-07
Updated on: 2002-11-06
Product:

[ more ]  [ reply ]

Yahoo! has been informed of this information, but has not yet responded.

Yahoo Messenger: Invisible User Detect

Vulnerable Versions:

Yahoo Messenger/MyYahoo Module

5,0,0,1046/3,0,0,423

5,0,0,1232/5,5,0,449

Note: These are the only versions tested, probably works on all versions.

Information:

[ more ]  [ reply ]

In-Reply-To: <Pine.BSO.4.44.0211031440290.26887-100000 (at) ghibli.knienieder (dot) com [email concealed]>

> Possibly vulnerable, not tested, OEM Version from GlobalSunTech:

> D-Link DWL-900AP+ B1 version 2.1 and 2.2

> ALLOY GL-2422AP-S

> EUSSO GL2422-AP

>

[ more ]  [ reply ]

Unless I am missing something, this is definitely not a vulnerability in
itself but just a practical demonstration of the "assign method caching"
vulnerability.

Executing programs with or without parameters also become pointless once you
have complete access to a local security zone (in this case,

[ more ]  [ reply ]