bugtraq mailing list - 2004/05

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2004/05

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 17	² 4
³ 25	⁴ 13	⁵ 18	⁶ 4	⁷ 13	⁸ 8	⁹ 2
¹⁰ 11	¹¹ 17	¹² 12	¹³ 14	¹⁴ 20	¹⁵ 14	¹⁶ 2
¹⁷ 20	¹⁸ 26	¹⁹ 37	²⁰ 9	²¹ 13	²² 1	²³ 5
²⁴ 6	²⁵ 3	²⁶ 12	²⁷ 14	²⁸ 11	²⁹ 3	³⁰ 8
³¹ 11

Messages by day:

May 1 (17 messages)

MDKSA-2004:041 - Updated ProFTPD packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Re: Multi stage attacks on networks? (Bill Nash <billn@...ln.net>)
RE: Multi stage attacks on networks? ("Shaun Bertrand" <sbertrand@...home.com>)
Re: http://www.smashguard.org (Pavel Machek <pavel@....cz>)
Re: http://www.smashguard.org (Crispin Cowan <crispin@...unix.com>)
[product-security@...le.com: APPLE-SA-2004-04-30 QuickTime 6.5.1] (David Ahmad <da@...urityfocus.com>)
Re: http://www.smashguard.org (Pavel Machek <pavel@....cz>)
LNSA-#2004-0013: Multiple Vulnerabilities in Samba (Vincenzo Ciaglia <ciaglia@...wosix.org>)
LNSA-#2004-0014: X-Chat vulnerability in Socks-5 proxy (Vincenzo Ciaglia <ciaglia@...wosix.org>)
Re: http://www.smashguard.org (Theo de Raadt <deraadt@....openbsd.org>)
Re: http://www.smashguard.org (Nicholas Weaver <nweaver@...berkeley.edu>)
Re: http://www.smashguard.org (Coleman Kane <cokane@...ane.org>)
RE: IE Certificate Stealing (Phising) bug (Michael Wojcik <Michael.Wojcik@...rofocus.com>)
Props 0.6.1 XSS and Remote File Viewing Vulnerability ("Manuel Lopez" <mantra@...o.org>)
Re: http://www.smashguard.org (Theo de Raadt <deraadt@....openbsd.org>)
New LSASS-based worm finally here (Sasser) (Ben Ryan <ben@...c.edu.au>)
Will the Sasser worm become the next Blaster? (kers0r <root@...lum-nz.com>)

May 2 (4 messages)

Re: New LSASS-based worm finally here (Sasser) ("Lee" <cheekypeople@...33.com>)
Re: Will the Sasser worm become the next Blaster? (Gadi Evron <ge@...uxbox.org>)
LHa buffer overflows and directory traversal problems (Ulf Härnhammar <Ulf.Harnhammar.9485@...dent.uu.se>)
SSL PCT vulnerability information (kquest@...layer.com)

May 3 (25 messages)

Re: Microsoft's Explorer and Internet Explorer long share name buffer overflow. (VIGOUR <vigour_vig@...oo.com>)
Re: New LSASS-based worm finally here (Sasser) (Javier Fernandez-Sanguino <jfernandez@...minus.com>)
[SECURITY] [DSA 500-1] New flim packages fix insecure temporary file creation (Matt Zimmerman <mdz@...ian.org>)
W32/Sasser a and b SNORT Sigs ("Martin Overton" <martin@...chnophiliac.com>)
[SECURITY] [DSA 499-1] New rsync packages fix directory traversal bug (Matt Zimmerman <mdz@...ian.org>)
PaX Linux Kernel 2.6 Patches DoS Advisory (chris <chris@...secure.net>)
iDEFENSE: Upcoming OpenSSH Security Advisory Announcement (Richard Johnson <thief@...traq.org>)
EEYE: Apple QuickTime (QuickTime.qts) Heap Overflow ("Marc Maiffret" <mmaiffret@...e.com>)
Re: Will the Sasser worm become the next Blaster? (Damian Menscher <menscher@...c.edu>)
[waraxe-2004-SA#026 - Multiple vulnerabilities in Coppermine Photo Gallery for PhpNuke] (Janek Vind <come2waraxe@...oo.com>)
X-Chat[v1.8.0-v2.0.8]: socks-5 remote buffer overflow exploit. (Vade 79 <v9@...ehalo.deadpig.org>)
Serv-U LIST -l Parameter Buffer Overflow (Aviram Jenik <aviram@...ondsecurity.com>)
RE: After Ms patches last Wed ... (InfoSec@...a.com)
Re: iDEFENSE: Upcoming OpenSSH Security Advisory Announcement (Ted Unangst <tedu@...tbombe.org>)
Crystal Reports Vulnerabilities ("Imperva Application Defense Center" <adc@...erva.com>)
Vulnerability in YaBB forum (Perl version without SQL) (Dmitry Shurupov <root@...p.ru>)
Multible Vulnerabilites in Aldos Webserver (<oliver@...yhat.de>)
Re: New LSASS-based worm finally here (Sasser) (Javier Fernandez-Sanguino <jfernandez@...minus.com>)
Re: New LSASS-based worm finally here (Sasser) (Javier Fernandez-Sanguino <jfernandez@...minus.com>)
Re: iDEFENSE: Upcoming OpenSSH Security Advisory Announcement (Rodrigo Barbosa <rodrigob@...spammers.org>)
RE: Will the Sasser worm become the next Blaster? ("Pullum, Stephen" <Stephen.Pullum@...-inc.com>)
[slackware-security] rsync update (SSA:2004-124-01) (Slackware Security Team <security@...ckware.com>)
[slackware-security] xine-lib update (SSA:2004-124-03) (Slackware Security Team <security@...ckware.com>)
[slackware-security] sysklogd update (SSA:2004-124-02) (Slackware Security Team <security@...ckware.com>)
Re: After Ms patches last Wed ... (James Riden <j.riden@...sey.ac.nz>)

May 4 (13 messages)

[slackware-security] libpng update (SSA:2004-124-04) (Slackware Security Team <security@...ckware.com>)
Sasser worm and Embedded Support Partner (ESP) port 5554/tcp (SGI Security Coordinator <agent99@....com>)
Re: Re: New LSASS-based worm finally here (Sasser) (Jason <security@...enik.com>)
RE: New LSASS-based worm finally here (Sasser) ("Marc Maiffret" <mmaiffret@...e.com>)
Re: Re: New LSASS-based worm finally here (Sasser) (Javier Fernandez-Sanguino <jfernandez@...minus.com>)
Re: Re: New LSASS-based worm finally here (Sasser) (insecure <insecure@...ritech.net>)
PHPNuke admin.php protection code (Luca Falavigna <fala83@...ero.it>)
Re: After Ms patches last Wed ... (Nicholas Weaver <nweaver@...berkeley.edu>)
[product-security@...le.com: APPLE-SA-2004-05-03 Security Update 2004-05-03] (David Ahmad <da@...urityfocus.com>)
RE: After Ms patches last Wed ... (Nick FitzGerald <nick@...us-l.demon.co.uk>)
@stake: AppleFileServer Remote Command Execution ("@stake Advisories" <advisories@...take.com>)
remote root exec vulnerability in omail (Thijs Dalhuijsen <thijs@...huijsen.com>)
SUSE Security Announcement: kernel (SuSE-SA:2004:010) (Roman Drahtmueller <draht@...e.de>)

May 5 (18 messages)

Re: New LSASS-based worm finally here (Sasser) (Gadi Evron <ge@...uxbox.org>)
UnixWare 7.1.3 Open UNIX 8.0.0 UnixWare 7.1.1 : apache multiple vulnerabilities, upgraded to apache-1.3.29 (please_reply_to_security@....com)
Re: New LSASS-based worm finally here (Sasser) (Javier Fernandez-Sanguino <jfernandez@...minus.com>)
Re: Crystal Reports Vulnerabilities (Michael Ray <miker@...se.com>)
RE: Crystal Reports Vulnerabilities ("Imperva Application Defense Center" <adc@...erva.com>)
Re: (HOAX) Dameware Mini Remote Control Version 4.2 ? Weak Key Agreement Scheme (DameWare Support <support@...eware.com>)
Vulnerabilities In PHPX 3.26 And Earlier (JeiAr <security@...ftech.org>)
[slackware-security] lha update in bin package (SSA:2004-125-01) (Slackware Security Team <security@...ckware.com>)
SMF SIZE Tag Script Injection Vulnerability (Cheng Peng Su <apple_soup@....com>)
Corsaire Security Advisory - Verity Ultraseek path disclosure issue ("advisories" <advisories@...saire.com>)
Fuse Talk Vunerabilities (Stuart Jamieson <stuart.jamieson@...ive-outdoors.co.uk>)
[OpenPKG-SA-2004.019] OpenPKG Security Advisory (kolab) (OpenPKG <openpkg@...npkg.org>)
Fwd: [Re: cvs commit: src/sys/vm vm_map.c] ("Jacques A. Vidrine" <nectar@...eBSD.org>)
Titan FTP Server Aborted LIST DoS (Aviram Jenik <aviram@...ondsecurity.com>)
IRIX Networking Security Updates (SGI Security Coordinator <agent99@....com>)
[waraxe-2004-SA#027 - Once again - critical vulnerabilities in PhpNuke 6.x - 7.2] (Janek Vind <come2waraxe@...oo.com>)
Multiple vulnerabilities in P4DB (Jon McClintock <jammer@...k.org>)
FreeBSD Security Advisory FreeBSD-SA-04:08.heimdal (FreeBSD Security Advisories <security-advisories@...ebsd.org>)

May 6 (4 messages)

FreeBSD Security Advisory FreeBSD-SA-04:09.kadmind (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Advisory: Heimdal kadmind version4 remote heap overflow ("Evgeny Demidov" <demidov@...g.net>)
[AppSecInc Security Alert] Microsoft Active Server Pages Cookie Retrieval Issue ("Aaron C. Newman (Application Security, Inc.)" <anewman@...secinc.com>)
[0xbadc0ded #03] DeleGate (SSL-filter) <= 8.9.2 (Joel Eriksson <je-secfocus@...nux.com>)

May 7 (13 messages)

SUSE Security Announcement: Live CD 9.1 (SuSE-SA:2004:011) (Roman Drahtmueller <draht@...e.de>)
Eudora file URL buffer overflow (psz@...hs.usyd.edu.au (Paul Szabo))
Will a smart worm be made in the near future? (Taeho Oh <ohhara@...tech.edu>)
Security issue with Trend OfficeScan Corporate Edition ("Matt" <matt_will_fix_it@...mail.com>)
Remote DoS IE Memory Access Violation ("E.Kellinis" <me@...her.org.uk>)
[SECURITY] [DSA 501-1] New exim packages fix buffer overflows (joey@...odrom.org (Martin Schulze))
Windows IPSec Vulnerabilty (Steffen Pfendtner <steffen@...netz.de>)
Re: Titan FTP Server Aborted LIST DoS (Gene Ken <gken@....sina.com>)
[CLA-2004:840] Conectiva Security Announcement - lha (Conectiva Updates <secure@...ectiva.com.br>)
Re: Titan FTP Server Aborted LIST DoS (Noam Rathaus <noamr@...ondsecurity.com>)
Re: Will a smart worm be made in the near future? (Jose Nazario <jose@...key.org>)
Streaming Video and Audio (security lists <lists28@...oo.com>)
Multiple vulnerabilities in 'pizza_party' ("H. Morrow Long" <morrow.long@...e.edu>)

May 8 (8 messages)

Re: Multiple vulnerabilities in 'pizza_party' (Will Image <xillwillx@...oo.com>)
Re: Multiple vulnerabilities in 'pizza_party' (Valdis.Kletnieks@...edu)
RE: Multiple vulnerabilities in 'pizza_party' ("Aditya, ALD [Aditya Lalit Deshmukh]" <aditya.deshmukh@...ine.gateway.technolabs.net>)
[FLSA-2004:1395] Updated OpenSSL resolves security vulnerability (fedora-legacy-announce@...hat.com)
[OpenPKG-SA-2004.020] OpenPKG Security Advisory (ssmtp) (OpenPKG <openpkg@...npkg.org>)
FW: [security bulletin] SSRT4717 Management Agents for HP-UX Remote DoS ("Boren, Rich (SSRT)" <rich.boren@...com>)
Status bar exploit hides spoofed URLs Eudora, possibly other e-mail clients (Brett Glass <brett@...iat.org>)
[waraxe-2004-SA#028 - Multiple vulnerabilities in NukeJokes module for PhpNuke] (Janek Vind <come2waraxe@...oo.com>)

May 9 (2 messages)

[ GLSA 200405-01 ] Multiple format string vulnerabilities in neon 0.24.4 and earlier (Kurt Lieber <klieber@...too.org>)
[ GLSA 200405-02 ] Multiple vulnerabilities in LHa (Thierry Carrez <koon@...too.org>)

May 10 (11 messages)

PaX DoS proof-of-concept (Michel Blomgren <michel@...om.se>)
Sasser Worm ftpd Remote Buffer Overflow Exploit (port 5554) ("ElviS .de" <elvi52001@...oo.com>)
OUTLOOK 2003: OuchLook ("http-equiv@...ite.com" <1@...ware.com>)
a litle bypass with IE (Nuno Costa <webcenter@...o.pt>)
Monit 4.1 remote shell exploit (HTTP) (Michel Blomgren <michel@...om.se>)
RE: An undetectable Online Bank Vulnerability? ("M Peterson" <apalamen@...global.net>)
Arbitrary code inclusion in phpShop ("Calum Power" <enune@...h.ai>)
msxml3.dll Parsing Error Crashes Internet Explorer Remotely Upon Refresh ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
Emule 0.42e Remote Denial Of Service Exploit ("Rafel Ivgi, The-Insider" <theinsider@....net.il>)
Re: a litle bypass with IE (nbriscoe@....co.uk (Neil Briscoe))
RE: a litle bypass with IE ("Eric Norbut" <eric@...gi.com>)

May 11 (17 messages)

[Ulf Harnhammar]: LHA Advisory + Patch (David Ahmad <da@...urityfocus.com>)
DEEP SEA PHISHING: Internet Explorer / Outlook Express ("http-equiv@...ite.com" <1@...ware.com>)
Advisory 04/2004: Net(Free)BSD Systrace local root vulnerabilitiy (Stefan Esser <s.esser@...atters.de>)
OpenServer 5.0.5 OpenServer 5.0.6 OpenServer 5.0.7 : X sessions which are not started by scologin cannot use the X authorizatio… (please_reply_to_security@....com)
UPDATED OpenServer 5.0.5 OpenServer 5.0.6 OpenServer 5.0.7 : X sessions which are not started by scologin cannot use the X auth… (please_reply_to_security@....com)
Re: msxml3.dll Parsing Error Crashes Internet Explorer Remotely Upon Refresh (3APA3A <3APA3A@...URITY.NNOV.RU>)
PING: Outlook 2003 Spam ("http-equiv@...ite.com" <1@...ware.com>)
Somebody exploiting (badly designed) yahoo service? ("Aleksandar Milivojevic" <alex@...ivojevic.org>)
[ GLSA 200405-03 ] ClamAV VirusEvent parameter vulnerability (Thierry Carrez <koon@...too.org>)
RE: a litle bypass with IE ("Thor Larholm" <thor@...x.com>)
MDKSA-2004:042 - Updated rsync packages fixes potential to write outside of directory tree. (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Linux Kernel sctp_setsockopt() Integer Overflow (Shaun Colley <shaunige@...oo.co.uk>)
[SECURITY] [DSA 502-1] New exim-tls packages fix buffer overflows (joey@...odrom.org (Martin Schulze))
Re: Somebody exploiting (badly designed) yahoo service? (Charles Mansmann <charles.mansmann@...l.tju.edu>)
MDKSA-2004:043 - Updated apache2 packages fixes a denial of service vulnerability in mod_ssl (Mandrake Linux Security Team <security@...ux-mandrake.com>)
[ GLSA 200405-04 ] OpenOffice.org vulnerability when using DAV servers (Thierry Carrez <koon@...too.org>)
surfboard1.1.6 local exploit. (Anonymous <nobody@...anoici.org>)

May 12 (12 messages)

Re: NISCC Vulnerability Advisory 236929: Vulnerability Issues in TCP (Florian Weimer <fw@...eb.enyo.de>)
Re: a litle bypass with IE (Emilio Casbas <ecasbas@...v.es>)
Re: Linux Kernel sctp_setsockopt() Integer Overflow (Tom Rini <trini@...nel.crashing.org>)
Hiding URLs from Outlook and other mail clients ("Carl" <carl@...nda-rm.co.uk>)
Re: Linux Kernel sctp_setsockopt() Integer Overflow (Stefan Esser <s.esser@...atters.de>)
RE: Somebody exploiting (badly designed) yahoo service? ("Bojan Zdrnja" <Bojan.Zdrnja@....hr>)
MS04-015 - Windows Help Center - Dvdupgrade ("morning_wood" <se_cur_ity@...mail.com>)
[OpenPKG-SA-2004.021] OpenPKG Security Advisory (apache) (OpenPKG <openpkg@...npkg.org>)
Re: Somebody exploiting (badly designed) yahoo service? (David Jacoby <dj@...post24.com>)
Re: msxml3.dll Parsing Error Crashes Internet Explorer Remotely Upon Refresh ("Gao Rui" <gaorui@...osec.pku.edu.cn>)
Re: Somebody exploiting (badly designed) yahoo service? (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Re: NISCC Vulnerability Advisory 236929: Vulnerability Issues in TCP (Bob Beck <beck@...h.cns.ualberta.ca>)

May 13 (14 messages)

NetBSD Security Advisory 2004-007: Systrace systrace_exit() local root (NetBSD Security-Officer <security-officer@...bsd.org>)
Re: surfboard1.1.6 local exploit. (Meredydd <meredydd@...rybuddy.com>)
EEYE: Symantec Multiple Firewall NBNS Response Processing Stack Overflow ("Marc Maiffret" <mmaiffret@...e.com>)
[ GLSA 200405-05 ] Utempter symlink vulnerability (Kurt Lieber <klieber@...too.org>)
Re: NISCC Vulnerability Advisory 236929: Vulnerability Issues in TCP (Darren Reed <avalon@...igula.anu.edu.au>)
EEYE: Symantec Multiple Firewall DNS Response Denial-of-Service ("Marc Maiffret" <mmaiffret@...e.com>)
EEYE: Symantec Multiple Firewall Remote DNS KERNEL Overflow ("Marc Maiffret" <mmaiffret@...e.com>)
EEYE: Symantec Multiple Firewall NBNS Response Remote Heap Corruption ("Marc Maiffret" <mmaiffret@...e.com>)
Showhelp() local CHM file execution (roozbeh afrasiabi <roozbeh_afrasiabi@...oo.com>)
[SECURITY] [DSA 503-1] New mah-jong packages fix denial of service (joey@...odrom.org (Martin Schulze))
[slackware-security] apache (SSA:2004-133-01) (Slackware Security Team <security@...ckware.com>)
Opera Telnet URI Handler Vulnerability also applies to other browsers (Jannes <ddos@...or.de>)
SYM04-008, Symantec Client Firewall Remote Access and Denial of Service Issues (Sym Security <secure@...antec.com>)
[security bulletin] SSRT4722 rev.0 HP-UX Mozilla denial of service ("Boren, Rich (SSRT)" <rich.boren@...com>)

May 14 (20 messages)

POA: Outlook Expresss 6.00 ("http-equiv@...ite.com" <1@...ware.com>)
DOE updated cybersecurity //no code or 0day sploits// just info ("System Administrator" <lowdownhaxor@...mail.com>)
IE URL Issue Being Used In Phishing In the Wild [USBank] ("Drew Copley" <dcopley@...e.com>)
Vulnerability Scanning on Windows 2003 localhost will crash RPC (<farking@...wnur.info>)
[security bulletin] SSRT4721 rev.0 HP-UX dtlogin unauthorized privileged access, DoS ("Boren, Rich (SSRT)" <rich.boren@...com>)
SUSE Security Announcement: mc (SuSE-SA:2004:012) (thomas@...e.de (Thomas Biege))
Re: Showhelp() local CHM file execution (roozbeh afrasiabi <roozbeh_afrasiabi@...oo.com>)
Curious fileutils/coreutils behaviour. (David Malone <dwmalone@...i.dit.ie>)
TSLSA-2004-0027 - apache (Trustix Security Advisor <tsl@...stix.org>)
Still Vulnerable in MSIE (Greg Kujawa <greg.kujawa@...mondcellar.com>)
[security bulletin] SSRT3613 rev.0 HP-UX B6848AB GTK+ Support Libraries - elevated privileges ("Boren, Rich (SSRT)" <rich.boren@...com>)
RE: Vulnerability Scanning on Windows 2003 localhost will crash RPC ("Drew Copley" <dcopley@...e.com>)
Symantec Multiple Firewall DNS Response Denial-of-Service Exploit (PoC) (houseofdabus HOD <houseofdabus@...ox.ru>)
TSLSA-2004-0029 - kernel (Trustix Security Advisor <tsl@...stix.org>)
RE: IE URL Issue Being Used In Phishing In the Wild [USBank] ("Drew Copley" <dcopley@...e.com>)
RE: Curious fileutils/coreutils behaviour. (Michael Wojcik <Michael.Wojcik@...rofocus.com>)
Re: Curious fileutils/coreutils behaviour. (David Malone <dwmalone@...i.dit.ie>)
Re: IE URL Issue Being Used In Phishing In the Wild [USBank] ("Todd C. Campbell" <todd.campbell@...e.com>)
[ GLSA 200405-07 ] Exim verify=header_syntax buffer overflow (Thierry Carrez <koon@...too.org>)
Re: Curious fileutils/coreutils behaviour. (Nicolas Rachinsky <list@...hinsky.de>)

May 15 (14 messages)

[ GLSA 200405-06 ] libpng denial of service vulnerability (Thierry Carrez <koon@...too.org>)
RE: Still Vulnerable in MSIE ("Thor Larholm" <thor@...x.com>)
Denial of Service Vulnerability in IEEE 802.11 Wireless Devices (<albatross@....it>)
Re: Curious fileutils/coreutils behaviour. (Michael Shigorin <mike@...n.org.ua>)
Re: Curious fileutils/coreutils behaviour. (Luciano Miguel Ferreira Rocha <strange@....no-ip.org>)
lha buffer overflow(s) again (<lw@...ia.edu.pl>)
more simple and flexible WinBlox(GET CONTROL OF WINNT SYSTEM) (Liu Die Yu <liudieyuinchina@...oo.com.cn>)
Re: IE URL Issue Being Used In Phishing In the Wild [USBank] (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Re: Linux Kernel sctp_setsockopt() Integer Overflow (Michael Tokarev <mjt@....msk.ru>)
Re: Curious fileutils/coreutils behaviour. (Martin <broadcast@...l.ptraced.net>)
CiSCO IOS 12.* source code stolen ("Alexander Antipo" <alexander@...ipov.info>)
Re: Denial of Service Vulnerability in IEEE 802.11 Wireless Devices (Casper Dik <casper@...land.sun.com>)
RE: Still Vulnerable in MSIE (Jelmer <jkuperus@...net.nl>)
Re: Re: Linux Kernel sctp_setsockopt() Integer Overflow (Jirka Kosina <jikos@...os.cz>)

May 16 (2 messages)

Re: lha buffer overflow(s) again (Ulf Härnhammar <Ulf.Harnhammar.9485@...dent.uu.se>)
Re: Linux Kernel sctp_setsockopt() Integer Overflow ("Evgeny Demidov" <demidov@...g.net>)

May 17 (20 messages)

WebCT: Cross Site Scripting Vulnerability ("spiffomatic 64" <spiffomatic64@...mail.com>)
KDE Security Advisory: URI Handler Vulnerabilities (Waldo Bastian <bastian@....org>)
Re[2]: Denial of Service Vulnerability in IEEE 802.11 Wireless Devices (Jason Ostrom <jpo@...ox.com>)
Wget race condition vulnerability (Hugo "V�zquez" "Caram�s" <overclocking_a_la_abuela@...mail.com>)
Multiple TTT-C XSS vulnerabilities (Kaloyan Georgiev <spam@...fire.org>)
[slackware-security] mc (SSA:2004-136-01) (Slackware Security Team <security@...ckware.com>)
Safari remote arbitrary code execution (kang <kang@...ecure.ws>)
NetChat HTTP Server Stack Overflow (<dbd@...hmail.com>)
RE: Remote Buffer Overflow in MailEnable HTTPMail ("MailEnable Sales" <info@...lenable.com>)
RE: Still Vulnerable in MSIE ("Kujawa, Greg" <Greg.Kujawa@...mondCellar.com>)
Re: Denial of Service Vulnerability in IEEE 802.11 Wireless Devices (Niels Bakker <niels-bugtraq@...ker.net>)
Microsoft Internet Explorer ImageMap URL Spoof Vulnerability (Kurczaba Associates advisories <advisories@...czaba.com>)
Buffer Overflow in ActivePerl ? ("Oliver@...yhat.de" <Oliver@...yhat.de>)
[waraxe-2004-SA#029 - Possible remote file inclusion in PhpNuke 6.x - 7.3] (Janek Vind <come2waraxe@...oo.com>)
oscommerce 2.2 file_manager.php file browsing (Rene <l0om@...luded.org>)
RE: Still Vulnerable in MSIE ("Drew Copley" <dcopley@...e.com>)
RE: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability ("Drew Copley" <dcopley@...e.com>)
[waraxe-2004-SA#030 - Multiple vulnerabilities in PhpNuke 6.x - 7.3] (Janek Vind <come2waraxe@...oo.com>)
Re: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability (thegeekmeister@...e-mail.net)
Desktop.ini flaw results in executing folders (roozbeh afrasiabi <roozbeh_afrasiabi@...oo.com>)

May 18 (26 messages)

ROCKET SCIENCE: Outllook 2003 ("http-equiv@...ite.com" <1@...ware.com>)
Re: Safari remote arbitrary code execution (Adam Shostack <adam@...eport.org>)
MDKSA-2004:044 - Updated libuser packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:045 - Updated passwd packages fix vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:046 - Updated apache packages fix a number of vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Re: Buffer Overflow in ActivePerl ? ("morning_wood" <se_cur_ity@...mail.com>)
IRIX 6.5.24 rpc.mountd infinte loop (SGI Security Coordinator <agent99@....com>)
Re: Buffer Overflow in ActivePerl ? (rich.sf@...ogic.com)
Advisory 05/2004: phpMyFAQ local file inclusion vulnerability (Stefan Esser <s.esser@...atters.de>)
RE: Re: Buffer Overflow in ActivePerl ? ("Bill Royds" <full-disclosure@...ds.net>)
Re: Buffer Overflow in ActivePerl? (Axel Beckert <beckert@...s.de>)
Re: Buffer Overflow in ActivePerl ? (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Re: Re: Buffer Overflow in ActivePerl? ("Volker Tanger" <volker.tanger@...ewe.de>)
Re: Re: Buffer Overflow in ActivePerl ? (npguy <npguy@...surfer.com.np>)
[slackware-security] kdelibs (SSA:2004-238-01) (Slackware Security Team <security@...ckware.com>)
Zen Cart login.php SQL Injection Vulnerability (Oliver Minack <oliverm@...pmode.de>)
[SECURITY] [DSA 504-1] New heimdal packages fix potential buffer overflow (joey@...odrom.org (Martin Schulze))
Re: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability (Jan Kluka <kluka@...junk-please.ii.fmph.uniba.sk>)
Overflow@...iHTTPd ("Han_B" <han_b@...epro.com.cn>)
Vapid Labs Security Advisory for PrimeBase Database 4.2 (update) ("Larry W. Cashdollar" <lwc@...id.ath.cx>)
Unknown IE bug with css-styles (<henkie_is_leet@...mail.com>)
WebCT: XSS vulnerability ("spiffomatic 64" <spiffomatic64@...mail.com>)
[ GLSA 200405-08 ] Pound format string vulnerability (Thierry Carrez <koon@...too.org>)
Re: Re: Buffer Overflow in ActivePerl ? ("morning_wood" <se_cur_ity@...mail.com>)
RE: RE: Still Vulnerable in MSIE ("skid" <skid@...global.net>)
Re: Buffer Overflow in ActivePerl ? (overlord_q@...mail.com)

May 19 (37 messages)

MDKSA-2004:047 - Updated kdelibs packages fix URI handling vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Re: Buffer Overflow in ActivePerl ? (<noderat@...mail.com>)
Re: Unknown IE bug with css-styles ("Paolo Mattiangeli" <security@...trodiascolto.it>)
Re: Buffer Overflow in ActivePerl ? (Josh Tolley <josh@...ntreeinc.com>)
RE: RE: Still Vulnerable in MSIE (Jelmer <jkuperus@...net.nl>)
RE: Buffer Overflow in ActivePerl ? ("Drew Copley" <dcopley@...e.com>)
[FLSA-2004:1268] Updated libtool resolves security vulnerability (fedora-legacy-announce@...hat.com)
[FLSA-2004:1224] Updated mc resolves security vulnerability (fedora-legacy-announce@...hat.com)
[FLSA-2004:1305] Updated metamail resolves security vulnerability (fedora-legacy-announce@...hat.com)
[FLSA-2004:1546] Updated utempter resolves security vulnerability (fedora-legacy-announce@...hat.com)
Re: Buffer Overflow in ActivePerl ? (rich.sf@...ogic.com)
[FLSA-2004:1285] Updated mutt resolves security vulnerability (fedora-legacy-announce@...hat.com)
[FLSA-2004:1296] Updated libtool resolves security vulnerability (fedora-legacy-announce@...hat.com)
RE: Re: Buffer Overflow in ActivePerl ? ("Petter O. Bruland" <pbruland@...r.com>)
(no subject) ("steven.mcdonald" <steven.mcdonald@...ightbb.com>)
Advisory 07/2004: CVS remote vulnerability (Stefan Esser <s.esser@...atters.de>)
Advisory 08/2004: Subversion remote vulnerability (Stefan Esser <s.esser@...atters.de>)
Advisory 06/2004: libneon date parsing vulnerability (Stefan Esser <s.esser@...atters.de>)
Re: Buffer Overflow in ActivePerl ? (Curt Sampson <cjs@...ic.net>)
[FLSA-2004:1546] Updated utempter resolves security vulnerability -- Reissue: updated 8.0 version numbers (fedora-legacy-announce@...hat.com)
Ph0rum phorum_uriauth replay attack (Konstantin Gavrilenko <mlists@...ont.com>)
FreeBSD Security Advisory FreeBSD-SA-04:10.cvs (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
[SECURITY] [DSA 506-1] New neon packages fix buffer overflow (joey@...odrom.org (Martin Schulze))
A new Sanctum paper: "Blind XPath Injection" (Amit Klein <amit.klein@...ctuminc.com>)
[SECURITY] [DSA 505-1] New cvs packages fix remote exploit (joey@...odrom.org (Martin Schulze))
SUSE Security Announcement: cvs (SuSE-SA:2004:013) (krahmer@...e.de (Sebastian Krahmer))
Idea for proactive worm protection (Peter Surda <shurdeek@...tehat.org>)
Non-logged Brute Force Attack Vulnerability for Fantastico-Created Databases on cPanel Based Hosts ("Michael Curtis" <email@...to.us>)
[SECURITY] [DSA 507-1] New cadaver packages fix buffer overflow (joey@...odrom.org (Martin Schulze))
Re: Buffer Overflow in ActivePerl ? (David Cantrell <david@...trell.org.uk>)
Re: Buffer Overflow in ActivePerl ? (David Ahmad <da@...urityfocus.com>)
Reporting a Security Vulnerability in a Microsoft Product ("Microsoft Security Response Center" <secure@...rosoft.com>)
MDKSA-2004:048 - Updated cvs packages fix remotely exploitable vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:049 - Updated libneon packages fix heap variable overflow issues (Mandrake Linux Security Team <security@...ux-mandrake.com>)
[OpenPKG-SA-2004.023] OpenPKG Security Advisory (subversion) (OpenPKG <openpkg@...npkg.org>)
[OpenPKG-SA-2004.022] OpenPKG Security Advisory (cvs) (OpenPKG <openpkg@...npkg.org>)
[OpenPKG-SA-2004.024] OpenPKG Security Advisory (neon) (OpenPKG <openpkg@...npkg.org>)

May 20 (9 messages)

SGI ProPack v2.4: Kernel Update #4 - Security and other fixes (SGI Security Coordinator <agent99@....com>)
SGI ProPack 3: Kernel Update #1 - Security and other fixes (SGI Security Coordinator <agent99@....com>)
[slackware-security] cvs (SSA:2004-140-01) (Slackware Security Team <security@...ckware.com>)
[security bulletin] SSRT4696 rev. 0 HP ProCurve Routing Switches TCP Denial of Service (DoS) ("Boren, Rich (SSRT)" <rich.boren@...com>)
[ GLSA 200405-14 ] Buffer overflow in Subversion ("Joshua J. Berry" <condordes@...too.org>)
Question About Ethics and Full Disclosure ("Tom" <tommy@...videsecurity.com>)
Auditor security collection released - a swiss army knife for security assessments. (Max <mmo@...ote-exploit.org>)
Internet explorer .clsid vulnerability (roozbeh afrasiabi <roozbeh_afrasiabi@...oo.com>)
RE: Question About Ethics and Full Disclosure ("Drew Copley" <dcopley@...e.com>)

May 21 (13 messages)

Re: Question About Ethics and Full Disclosure ("T.J." <tjtoocool@...eaker.net>)
RE: Question About Ethics and Full Disclosure ("Kevin E. Casey" <kcasey@...oweb.com>)
Eudora 6.1.1 attachment spoof, LaunchProtect (psz@...hs.usyd.edu.au (Paul Szabo))
RE: Internet explorer .clsid vulnerability ("Thor Larholm" <thor@...x.com>)
[SNS Advisory No.72] Symantec Norton AntiVirus 2004 ActiveX Control Vulnerability (snsadv@....co.jp (snsadv))
Stupid Phishing Tricks ("http-equiv@...ite.com" <1@...ware.com>)
Re: Question About Ethics and Full Disclosure (Michal Zalewski <lcamtuf@...edump.cx>)
Re: Non-logged Brute Force Attack Vulnerability forFantastico-Created Databases on cPanel Based Hosts ("Michael Curtis" <email@...to.us>)
e107 web portal Referers HTTP Injection (Chinchilla <kingchinchilla@...mail.com>)
MDKSA-2004:046-1 - apache-mod_perl packages are now available (Mandrake Linux Security Team <security@...ux-mandrake.com>)
[OpenPKG-SA-2004.025] OpenPKG Security Advisory (rsync) (OpenPKG <openpkg@...npkg.org>)
[ GLSA 200405-16 ] Multiple XSS Vulnerabilities in SquirrelMail (Rajiv Aaron Manglani <rajiv@...too.org>)
Re: Non-logged Brute Force Attack Vulnerability for Fantastico-Created Databases on cPanel Based Hosts (Kenneth Peiruza <kenneth@...urity.gft.com>)

May 22 (1 message)

Allegro RomPager/2.10 DoS exploit (Seth Alan Woolley <seth@...tology.org>)

May 23 (5 messages)

BNBT BitTorrent Tracker Denial Of Service ("badpack3t" <badpack3t@...urity-protocols.com>)
Re: Internet explorer .clsid vulnerability (roozbeh afrasiabi <roozbeh_afrasiabi@...oo.com>)
Exploit codes for CVS Vulnerability and snort rules from ISC (K-OTiK Security <Special-Alerts@...tik.com>)
MDKSA-2004:050 - Updated kernel packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Liferay Cross Site Scripting Flaw ("Giri, Sandeep" <giris@...haw.com>)

May 24 (6 messages)

Netgear RP114 URL filter fails if URL is too long (Marc Ruef <marc.ruef@...putec.ch>)
e107 web portal user.php XSS (Cross Site Scripting) (Chris Norton <kicktd@...security.us>)
[SECURITY] [DSA 508-1] New xpcd packages fix buffer overflow (Matt Zimmerman <mdz@...ian.org>)
cPanel mod_phpsuexec Vulnerability (Rob Brown <rob@...uad.com>)
SSH URI handler remote arbitrary code execution (kang <kang@...ecure.ws>)
DoS in Vocaltec VoIP gateway in ASN.1/H.323/H.225 stack ("Alexander" <pk95@...dex.ru>)

May 25 (3 messages)

[ GLSA 200405-19 ] Opera telnet URI handler file creation/truncation vulnerability (Kurt Lieber <klieber@...too.org>)
[CLA-2004:841] Conectiva Security Announcement - libneon (Conectiva Updates <secure@...ectiva.com.br>)
[CLA-2004:842] Conectiva Security Announcement - mailman (Conectiva Updates <secure@...ectiva.com.br>)

May 26 (12 messages)

[security bulletin] SSRT4749 HP-UX Java Runtime Environment (JRE) remote DoS ("Boren, Rich (SSRT)" <rich.boren@...com>)
SGI Advanced Linux Environment 3 Security Update #1 (SGI Security Coordinator <agent99@....com>)
FreeBSD Security Advisory FreeBSD-SA-04:11.msync (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
SUSE Security Announcement: kdelibs (SuSE-SA:2004:014) (krahmer@...e.de (Sebastian Krahmer))
[security bulletin] SSRT4719 hp OpenView Select Access remote unauthorized access ("Boren, Rich (SSRT)" <rich.boren@...com>)
IRIX libcpr vulnerability (SGI Security Coordinator <agent99@....com>)
IEBUG: Archives of Internet Explorer (Liu Die Yu <liudieyuinchina@...oo.com.cn>)
[Full-Disclosure] iDEFENSE Security Advisory 05.26.04: 3Com OfficeConnect Remote 812 ADSL Router Telnet Protocol Denial of Servi… (idlabs-advisories@...fense.com)
[security bulletin]SSRT4724 HP integrated Lights Out (iLO) Denial of Service (DoS) using port zero ("Boren, Rich (SSRT)" <rich.boren@...com>)
Orenosv HTTP/FTP Server Denial Of Service ("badpack3t" <badpack3t@...urity-protocols.com>)
Re: IRIX libcpr vulnerability (Jan Schaumann <jschauma@...meister.org>)
[CLA-2004:843] Conectiva Security Announcement - kde (Conectiva Updates <secure@...ectiva.com.br>)

May 27 (14 messages)

Re: [ GLSA 200405-18 ] Buffer Overflow in Firebird (b0f www.b0f.net <b0fnet@...oo.com>)
[sb] [ GLSA 200405-22 ] Apache 1.3: Multiple vulnerabilities ("Kurt Lieber" <klieber@...too.org>)
Re: [ GLSA 200405-18 ] Buffer Overflow in Firebird ("KF (lists)" <kf_lists@...netops.com>)
DoS in MiniShare 1.3.2 ("Donato Ferrante" <fdonato@...istici.org>)
Re: [ GLSA 200405-18 ] Buffer Overflow in Firebird ("KF (lists)" <kf_lists@...netops.com>)
[OpenPKG-SA-2004.026] OpenPKG Security Advisory (apache) (OpenPKG <openpkg@...npkg.org>)
The Dangers of Cross-Site-Scripting: Rogers Hi-Speed Internet Network [Canada] ("http-equiv@...ite.com" <1@...ware.com>)
Re: Exchange pop3 remote exploit (Tal Schaeffer <tal_schaeffer@...mail.com>)
Re: iDEFENSE Security Advisory 05.27.04: 3Com OfficeConnect Remote 812 ADSL Router Authentication Bypass Vulnerability (Seth Alan Woolley <seth@...tology.org>)
MDKSA-2004:051 - Updated mailman packages fix password retrieval vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Re: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability (<sandrijeski@...oo.com>)
Sun-Java-App-Server PE 8.0 path disclosure (Marc Schoenefeld <schonef@...-muenster.de>)
WildTangent Web Driver Long FileName Stack Overflow ("NGSSoftware Insight Security Research" <nisr@...software.com>)
Re: Linux Kernel sctp_setsockopt() Integer Overflow (Michael Tokarev <mjt@....msk.ru>)

May 28 (11 messages)

MDKSA-2004:052 - Updated kolab-server package fixes world readable file vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
[PHP] include() bypassing filter with php://input (Himeur Nourredine <lostnoobs@...urity-challenge.com>)
Re: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability ("http-equiv@...ite.com" <1@...ware.com>)
Re: [PHP] include() bypassing filter with php://input (Keary Suska <hierophant@...sys.net>)
[VulnDiscuss] Re: WildTangent Web Driver Long FileName Stack Overflow (Cesar <cesarc56@...oo.com>)
SGI Advanced Linux Environment security update #20 (SGI Security Coordinator <agent99@....com>)
JPortal SQL Injects (Maciek Wierciski <ziemni@...p.pl>)
SGI Advanced Linux Environment 3 Security Update #2 (SGI Security Coordinator <agent99@....com>)
Re: [PHP] include() bypassing filter with php://input (clez <bt_sf_com_20040528@...z.net>)
Mollensoft ftp Server ver 3.6 Buffer overflow (Chintan Trivedi <chesschintan@...mail.com>)
Re: Linux Kernel sctp_setsockopt() Integer Overflow ("Michael Tokarev" <mjt@....msk.ru>)

May 29 (3 messages)

Re: Linux Kernel sctp_setsockopt() Integer Overflow (Jirka Kosina <jikos@...os.cz>)
EnderUNIX Security Anouncement (Isoqlog and Spamguard) (Murat Balaban <murat@...erunix.org>)
LDU (land down under) xss vulnerability (tim de gier <timdegier@...e.nl>)

May 30 (8 messages)

Re: EnderUNIX Security Anouncement (Isoqlog and Spamguard) (Aycan iRiCAN <aycan@...e.gen.tr>)
[waraxe-2004-SA#031 - Multiple vulnerabilities in e107 version 0.615] (Janek Vind <come2waraxe@...oo.com>)
[SECURITY] [DSA 509-1] New gatos packages fix privilege escalation (Matt Zimmerman <mdz@...ian.org>)
RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability (Roman Medina <roman@...labs.com>)
RE: Re: EnderUNIX Security Anouncement (Isoqlog and Spamguard) ("Simon Lorentsen" <s.lorentsen@...cks.com>)
[SECURITY] [DSA 510-1] New jftpgw packages fix format string vulnerability (Matt Zimmerman <mdz@...ian.org>)
[Full-Disclosure] iDEFENSE Security Advisory 05.27.04: 3Com OfficeConnect Remote 812 ADSL Router Authentication Bypass Vulnerabi… (idlabs-advisories@...fense.com)
SecurityLab.Ru Report: The Top 10 Most Critical Vulnerabilities in May 2004 ("Alexander" <pk95@...dex.ru>)

May 31 (11 messages)

Re: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability (Robert J Taylor <robert@...mestaylor.com>)
Re: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability (Valdis.Kletnieks@...edu)
Users who have expired passwords can still log on to the domain if the FQDN is exactly eight characters long in Windows 2000 (<albatross@....it>)
Re: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability (Peter Pentchev <roam@...glet.net>)
Looking for a security contact of RealNetworks Live Rhapsody ("Philip Stoev" <philip@...ev.org>)
[SECURITY] [DSA 511-1] New ethereal packages fix buffer overflows (Matt Zimmerman <mdz@...ian.org>)
Re: [PHP] include() bypassing filter with php://input (Ali Campbell <bugtraq@...campbell.org.uk>)
Possible bug in PHPNuke and other CMS (Luca Falavigna <fala83@...ero.it>)
Re: [PHP] include() bypassing filter with php://input (bugtraq subscriber <bugtraq@...orb.net>)
Re: Linux Kernel sctp_setsockopt() Integer Overflow (Shaun Colley <shaunige@...oo.co.uk>)
LinkSys WRT54G administration page availble to WAN ("Alan W. Rateliff, II" <lists@...eliff.net>)

373 messages

Powered by blists - more mailing lists