bugtraq mailing list - 2003/05

Messages by day:

May 1 (29 messages)

• [RHSA-2003:133-01] Updated man packages fix minor vulnerability (bugzilla@...hat.com)
• [SECURITY] [DSA 297-1] New snort packages fix remote root exploits (joey@...odrom.org (Martin Schulze))
• Re: Portable OpenSSH: Dangerous AIX linker behavior (aixgcc.adv) (Darren Tucker <dtucker@....com.au>)
• Re: April appeared to be a month of IE bugs. Here's another one. ("ERRor" <error@...htamt.ru>)
• [CLA-2003:635] Conectiva Security Announcement - balsa (Conectiva Updates <secure@...ectiva.com.br>)
• Re: OpenSSH/PAM timing attack allows remote users identification (Ethan Benson <erbenson@...ska.net>)
• Re: Portable OpenSSH: Dangerous AIX linker behavior (aixgcc.adv) (Dan Harkless <bugtraq@...kless.org>)
• Re: Qpopper v4.0.x poppassd local root exploit (Randall Gellens <rg_public.1@...gg.qualcomm.com>)
• Re: April appeared to be a month of IE bugs. Here's another one. (Cove Schneider <cove@...dpackets.com>)
• RE: MDaemon SMTP/POP/IMAP server: =>6.0.7: POP remote DoS ("jasonk" <jasonk@...edevel.com>)
• [SECURITY] [DSA 296-1] New kdebase packages fix arbitrary command execution (joey@...odrom.org (Martin Schulze))
• SILLY BEHAVIOR Part II : Internet Explorer 5.5 - 6.0 ("http-equiv@...ite.com" <1@...ware.com>)
• [SECURITY] [DSA 295-1] New pptpd packages fix remote root exploit (joey@...odrom.org (Martin Schulze))
• Re: April appeared to be a month of IE bugs. Here's another one. (Cove Schneider <cove@...dpackets.com>)
• [CLA-2003:633] REVISED: Conectiva Security Announcement - glibc (Conectiva Updates <secure@...ectiva.com.br>)
• Red Hat IA64 products still missing fixes for the ptrace vs kmod vulnerability (Christoph Hellwig <hch@...radead.org>)
• Re: Latest MS SQL Server vulnerabilities revealed (Jeff Moss <jmoss@...ckhat.com>)
• re:Latest MS SQL Server vulnerabilities revealed ("Michael -" <michael@....org>)
• eBay Security Contact ("mattmurphy@...rr.com" <mattmurphy@...rr.com>)
• Re: Portable OpenSSH: Dangerous AIX linker behavior (aixgcc.adv) (Damien Miller <djm@...drot.org>)
• Cisco Security Advisory: Cisco ONS15454, ONS15327, ONS15454SDH, and ONS15600 Nessus Vulnerabilities (Cisco Systems Product Security Incident Response Team <psir…)
• Re: Portable OpenSSH: Dangerous AIX linker behavior (aixgcc.adv) (Shiva Persaud <shivapd@...ibm.com>)
• Re: eBay Security Contact ("Kevin Spett" <kspett@...dynamics.com>)
• Re: Portable OpenSSH: Dangerous AIX linker behavior (aixgcc.adv) (Ben Lindstrom <mouring@...h.eviladmin.org>)
• Re: eBay Security Contact (Anne Carasik <gator@...r.caltech.edu>)
• Re: [Full-Disclosure] eBay Security Contact (Anne Carasik <gator@...r.caltech.edu>)
• Multiple Vulnerabilities in Splatt Forum 4.0 (Frame4 Security Systems <webmaster@...me4.com>)
• RE: eBay Security Contact ("Anthony Patti" <gps@...ustmail.com>)
• Integer Manipulation Attacks ("Michael Howard" <mikehow@...rosoft.com>)

• re:Latest MS SQL Server vulnerabilities revealed (Cesar <cesarc56@...oo.com>)
• Re: OpenSSH/PAM timing attack allows remote users identification (Nicolas Couture <nc@...rmvault.net>)
• Re: eBay Security Contact ("Robert Wineriter" <rwineriter@...com.utah.edu>)
• RE: eBay Security Contact ("Jonathan Grotegut" <jgrotegut@...ectpointe.com>)
• Re: eBay Security Contact ("James Briggs" <james@...ionMessage.com>)
• Re: eBay Security Contact (Bernhard Trabert <securityinfo@...ride.net>)
• [RHSA-2003:113-01] Updated mod_auth_any packages available (bugzilla@...hat.com)
• Dynamic DNS "Spoofing" & IRC ("Intel Nop" <0x90@...isiblenet.net>)
• Re: OpenSSH/PAM timing attack allows remote users identification (ilja van sprundel <ilja@...ric.org>)
• [SECURITY] [DSA 298-1] New EPIC4 packages fix DoS and arbitrary code execution (joey@...odrom.org (Martin Schulze))
• Re: April appeared to be a month of IE bugs. Here's another one. (Joachim Stro"mbergson <Joachim.Strombergson@...ormAsic.com>)
• Privacy Compromise Ifriends Webcam ("morning_wood" <se_cur_ity@...mail.com>)
• RE: Re: eBay Security Contact ("Brad Bemis" <Brad.Bemis@...borne.com>)
• Re: OpenSSH/PAM timing attack allows remote users identification (Marco Ivaldi <raptor@...iaservice.net>)
• Re: Dynamic DNS "Spoofing" & IRC (Markus Kovero <muikku@...kkuverkko.net>)
• Re: Dynamic DNS "Spoofing" & IRC (c4 <c4@...t.nu>)
• Re: OpenSSH/PAM timing attack allows remote users identification (Thilo Schulz <arny@....s.bawue.de>)
• Re: OpenSSH/PAM timing attack allows remote users identification (Michael Shigorin <mike@...n.org.ua>)
• GLSA: openssh (200305-01) (Daniel Ahlberg <aliz@...too.org>)
• Re: OpenSSH/PAM timing attack allows remote users identification (Karl-Heinz Haag <k.haag@...ux-ag.com>)
• Re: eBay Security Contact ("Jon Pastore" <jpastore@...tech.net>)
• Re: Dynamic DNS "Spoofing" & IRC (Niels Bakker <niels=bugtraq@...ker.net>)
• Re: Dynamic DNS "Spoofing" & IRC ("Thomas Wouters" <meeling@...y.nl>)
• HP-UX 11.0 /usr/bin/kermit (bt@...fi.lt)
• HP- (bt@...fi.lt)
• Re: OpenSSH/PAM timing attack allows remote users identification (Nicolas Couture <nc@...rmvault.net>)
• (no subject) (bt@...fi.lt)
• Re: OpenSSH/PAM timing attack allows remote users identification (Marco Ivaldi <raptor@...iaservice.net>)
• HP-UX 11.0 /usr/lbin/rwrite (bt@...fi.lt)
• Slow Internet? ("Jonathan Grotegut" <jgrotegut@...ectpointe.com>)
• Re: HP-UX 11.0 /usr/lbin/rwrite (KF <dotslash@...soft.com>)
• RE: Slow Internet? ("Ed Carp" <erc@...ox.com>)
• Re: from bugtraq: HP-UX 11.0 /usr/bin/kermit (fwd) (Frank da Cruz <fdc@...umbia.edu>)
• Code Injection Vulnerabilities in WebcamXP Chat Feature (Frame4 Security Systems <webmaster@...me4.com>)
• RE: Slow Internet? ("Chris" <chris@...lexantsystems.com>)
• Re: Slow Internet? (Valdis.Kletnieks@...edu)

• rwrite buffer overflow in hp-ux (John Morris <jrm@....hp.com>)
• Microsoft IIS Authentication Manager Account Conformation Vuln? (JeiAr <jeiar@...ms.com>)
• Re: from bugtraq: HP-UX 11.0 /usr/bin/kermit (fwd) (Elmar Knipp <Elmar.Knipp@...pp.de>)
• Re: Dynamic DNS "Spoofing" & IRC (Darren Reed <avalon@...igula.anu.edu.au>)
• Re: from bugtraq: HP-UX 11.0 /usr/bin/kermit (fwd) (Frank da Cruz <fdc@...umbia.edu>)

• Key validity bug in GnuPG 1.2.1 and earlier (David Shaw <dshaw@...berwocky.com>)

• Mod_Survey SYSBASE vulnerability (Joel Palmius <joel.palmius@...se>)
• kermit buffer overflow on hp-ux (John Morris <jrm@....hp.com>)
• SILLY BEHAVIOR Part III : Internet Explorer 5.5 - 6.0 ("http-equiv@...ite.com" <1@...ware.com>)
• CommuniGatePro 4.0.6 [EXPLOIT] (Yaroslav Polyakov <xenon@...attack.com>)
• Re: OpenSSH/PAM timing attack allows remote users identification (Marco Ivaldi <raptor@...iaservice.net>)
• Security Update: [CSSA-2003-019.0] OpenLinux: tcp SYN with FIN packets are not discarded (security@....com)
• [CLA-2003:639] Conectiva Security Announcement - krb5 (Conectiva Updates <secure@...ectiva.com.br>)
• CORE-2003-0303: Multiple Vulnerabilities in Mirabilis ICQ client (CORE Security Technologies Advisories <advisories@...esecurity.com>)
• Microsoft Biztalk Server ISAPI HTTP Receive function buffer overflow (Cesar <cesarc56@...oo.com>)
• Microsoft Biztalk Server DTA vulnerable to SQL injection (Cesar <cesarc56@...oo.com>)
• [CLA-2003:640] Conectiva Security Announcement - vnc (Conectiva Updates <secure@...ectiva.com.br>)

• youbin local root exploit + advisory (Knud Erik Højgaard <address-modified-due-to-out-of-office-and-gay-antivirus-marking-perl-scripts-as-trojans---kain@...op.…)
• Multiple Buffer Overflow Vulnerabilities Found in FTGate Pro Mail Server v. 1.22 (1328) ("Dennis Rand" <der@...owarfare.dk>)
• Security Update: [CSSA-2003-018.0] OpenLinux: file command buffer overflow (security@....com)
• Security Update: [CSSA-2003-017.0] OpenLinux: Various serious Samba vulnerabilities (security@....com)
• Crash in Internet Explorer 6.0 Sp1 ("David F. Madrid" <conde0@...efonica.net>)
• [SECURITY] [DSA 299-1] New leksbot packages fix improper setuid-root execution (Matt Zimmerman <mdz@...ian.org>)
• RE: Microsoft IIS Authentication Manager Account Conformation Vuln? ("Russ" <Russ.Cooper@...on.ca>)
• [SECURITY] [DSA 300-1] New Balsa packages fix buffer overflow (joey@...odrom.org (Martin Schulze))
• Siemens Mobile Phone - Buffer Overflow (subj <r2subj3ct@...lan.org>)
• Re: youbin local root exploit + advisory ("Jeremy C. Reed" <reed@...dmedia.net>)

• Multiple Vulnerabilities in SLWebmail ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• SAP database local root vulnerability during installation. (fwd) ("Larry W. Cashdollar" <lwc@...id.ath.cx>)
• Multiple Buffer Overflow Vulnerabilities in SLMail (#NISR07052003A) ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
• Cisco Security Advisory: Cisco VPN 3000 Concentrator Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Problem: Multiple Web Browsers do not do not validate CN on certificates. ("Simson L. Garfinkel" <simsong@...roba.com>)
• Windows Media Player directory traversal vulnerability (Jouko Pynnonen <jouko@...utions.fi>)
• [VulnDiscuss] XSS In Neoteris IVE Allows Session Hijacking (Dave Palumbo <dpalumbo@...oo.com>)
• [SECURITY] [DSA-301-1] New libgtop packages fix buffer overflow (Matt Zimmerman <mdz@...ian.org>)
• [SECURITY] [DSA-302-1] New fuzz packages fix buffer overflow (Matt Zimmerman <mdz@...ian.org>)
• Re: Multiple Vulnerabilities in SLWebmail (H D Moore <slwebmailpost@...italoffense.net>)

• Hotmail & Passport (.NET Accounts) Vulnerability (Muhammad Faisal Rauf Danka <mfrd@...itudex.com>)
• [VulnDiscuss] Re: Hotmail & Passport (.NET Accounts) Vulnerability ("Dan Carter" <d.p.carter@...caster.ac.uk>)
• Multiple Vulnerabilities found in Microsoft .Net Passport Services (Qazi Ahmed <qa@...cert.org>)
• Remote Stack Overflow exploit for Personal FTPD (subj <r2subj3ct@...lan.org>)
• why i love xs4all + mediaplayer thingie ("jelmer" <jelmer@...erus.xs4all.nl>)
• [CLA-2003:643] Conectiva Security Announcement - slocate (Conectiva Updates <secure@...ectiva.com.br>)
• miniPortail (PHP) : Admin Access ("Frog Man" <leseulfrog@...mail.com>)
• Fw: [rt-users] [rt-announce] RT 1.0.7 vulnerable to Cross Site Scripting attacks ("Chris Knipe" <savage@...age.za.org>)
• SRT2003-05-08-1137 - ListProc mailing list ULISTPROC_UMASK overflow (KF <dotslash@...balintersec.com>)
• Re: Remote Stack Overflow exploit for Personal FTPD (subj <r2subj3ct@...lan.org>)
• MDKSA-2003:055 - Updated kopete packages fix vulnerability with GnuPG plugin (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• s0h: Kerio Personal Firewall and Tiny Personal Firewall remote exploit/patch. (descript <descript@...8.s0h.cc>)

• ltris-and-slashem-tty possible trouble (Knud Erik Højgaard <kain@...op.dk>)
• Netbus 1.x exploit (sKyZ <sKyZ@...t3d.Tk>)
• Flooding Internet Explorer 6.0.2800 (6.x?) security zones ! [CRITICAL] ("Marek Bialoglowy" <mb@...temintegra.com>)
• Happymall E-Commerce Remote Command Execution (SecurityTracker <help@...uritytracker.com>)
• TOP 75 Security Tools Translated (Pablo Sabbatella <sabbatella@...kemate.com.ar>)
• II-Labs Advisory: Remote code execution in YaBBse 1.5.2 (php version) (DownBload <downbload@...mail.com>)
• ttcms and ttforum exploits (Charles Reinold <creinold@...mail.com>)
• PowerLink WAN Aggregator - Vunerability ("morning_wood" <se_cur_ity@...mail.com>)
• A Phorum's bug... (WiciU <vviciu@...zta.onet.pl>)
• Re: A Phorum's bug... (Brian Moon <brian@...rum.org>)

• Firebird local root compromise ("bob" <bob@...rs.net>)
• Multiple Buffer Overflow Vulnerabilities Found in CMailServer 4.0 ("Dennis Rand" <der@...owarfare.dk>)
• Re: II-Labs Advisory: Remote code execution in YaBBse 1.5.2 (php version) (ScriptSlave@....net)
• Re: Flooding Internet Explorer 6.0.2800 (6.x?) security zones ! [CRITICAL] (Andreas Marx <amarx@...a-it.de>)
• Firebird Local exploit (bob <moo@...tis.luxadmin.org>)
• unzip directory traversal revisited ("jelmer" <jelmer@...erus.xs4all.nl>)
• BitchX: Crash when channel modes change (Rob Andrews <randrews@...inetworks.com>)

• eServ Memory Leak Enables Denial of Service Attacks ("Matthew Murphy" <mattmurphy@...rr.com>)

• [VulnDiscuss] re: II-Labs Advisory: Remote code execution in YaBBse 1.5.2 (php version) ("Frog Man" <leseulfrog@...mail.com>)
• Secunia Research: Opera browser filename extension buffer overflows (Jakob Balle <jb@...unia.com>)
• Opera 7.11 java.util.zip.* Vulnerability (Marc Schoenefeld <schonef@...-muenster.de>)
• [Drug and Zip] Buffer Overflow (subj <r2subj3ct@...lan.org>)
• makeunicode2.py release (dave@...unitysec.com)
• Apple AirPort Administrative Password Obfuscation (a051203-1) ("@stake Advisories" <advisories@...take.com>)
• Unix Version of the Pi3web DoS (Angelo Rosiello <guilecool@....com>)
• [RHSA-2003:002-01] Updated KDE packages fix security issues (bugzilla@...hat.com)
• Lot of SQL injection on PHP-Nuke 6.5 (secure weblog!) (Albert Puigsech Galicia <ripe@...9ezine.org>)
• [VulnDiscuss] Paper: Spamdoors ("Vision Through Sound" <echolation@...hmail.com>)
• One more flaw in Happymall (Julio Cesar <e2fsck@....com.br>)
• Security Update: [CSSA-2003-020.0] OpenLinux: kernel kmod/ptrace root exploit (security@....com)
• CSS found in Movable Type (DarkHunter <darkhunter7@...kermail.com>)
• Re: CSS found in Movable Type (Jordan Wiens <jwiens@...sp.nerdc.ufl.edu>)
• Snitz Forum 3.3.03 Remote Command Execution (<sharpiemarker@...hmail.com>)
• Re: CSS found in Movable Type (Jordan Wiens <jwiens@...sp.nerdc.ufl.edu>)
• Re: CSS found in Movable Type (<ben@...apart.com>)

• XSS In Neoteris IVE Allows Session Hijacking (Dave Palumbo <dpalumbo@...oo.com>)
• [SNS Advisory No.64] IP Messenger for Win Buffer Overflow Vulnerability ("Secure Net Service(SNS) Security Advisory" <snsadv@....co.jp>)
• fake location bar (Liu Die Yu <liudieyuinchina@...oo.com.cn>)
• Detailed analysis: Buffer overflow in Explorer.exe on Windows XP SP1 ("Executable Security" <exurity@...ers.com>)
• eServ Memory Leak Solution ("mattmurphy@...rr.com" <mattmurphy@...rr.com>)
• Re: CSS found in Movable Type -- Nope (<crys@...works.net>)
• AIX sendmail open relay (Tom Perrine <tep@...c.edu>)
• Phorum Vulnerabilities (<webmaster@...checkup.com>)
• [RHSA-2003:160-01] Updated xinetd packages fix a denial-of-service attack and other bugs (bugzilla@...hat.com)
• Re: Lot of SQL injection on PHP-Nuke 6.5 (secure weblog!) (Rynho Zeros Web <hackargentino@....net>)
• PHPNuke "Your Account" XSS Vulnerability ("Ferruh Mavituna" <ferruh@...ituna.com>)
• [RHSA-2003:160-01] Updated xinetd packages fix a denial-of-service attack and other bugs (bugzilla@...hat.com)
• [VulnDiscuss] UT2003 client passive DoS exploit (Auriemma Luigi <aluigi@...x.com>)
• [RHSA-2003:160-01] Updated xinetd packages fix a denial-of-service attack and other bugs (bugzilla@...hat.com)
• Re: Multiple Buffer Overflow Vulnerabilities Found in CMailServer 4.0 (<millhouse@...s.net>)
• cdrtools2.0 Format String Vulnerability (Stefano Di Paola <st0r1e@...ero.it>)
• Security Update: [CSSA-2003-021.0] OpenLinux: mgetty caller ID buffer overflow and spool perm vulnerabilities (security@....com)
• Cdrecord local root exploit. ("yjm01" <yjm01@...ra.com.br>)
• More and More SQL injection on PHP-Nuke 6.5. (Albert Puigsech Galicia <ripe@...9ezine.org>)

• Memory leak in 3COM 812 DSL routers ("David F. Madrid" <conde0@...efonica.net>)
• Re: Detailed analysis: Buffer overflow in Explorer.exe on Windows XP SP1 (nesumin <nesumin@...thome.net>)
• Inktomi Traffic-Server XSS: man-in-the-middle XSS ! (Hugo "Vázquez" "Caramés" <overclocking_a_la_abuela@...mail.com>)
• BEA WebLogic Server and Express 7.x Passwords Disclosure (K-Otik.com <contrib@...tik.com>)
• VBulletin Preview Message - XSS Vuln ("Ferruh Mavituna" <ferruh@...ituna.com>)
• PalmOS ICMP flood DoS. (Shaun Moore <shaunige@...oo.co.uk>)
• php-proxima Remote File Access Vulnerability ("Mind Warper" <mindwarper@...uxmail.org>)
• Re: VBulletin Preview Message - XSS Vuln (Kier Darby <kier@...lletin.com>)
• [RHSA-2003:172-00] Updated 2.4 kernel fixes security vulnerabilities and various bugs (bugzilla@...hat.com)
• Buffer overflows in multiple IMAP clients (Timo Sirainen <tss@....fi>)
• Flooding Internet Explorer 6.0.2800 (6.x?) security zones ! - UPDATED ("Marek Bialoglowy" <mb@...temintegra.com>)
• [CLA-2003:648] Conectiva Security Announcement - evolution (Conectiva Updates <secure@...ectiva.com.br>)

• Cisco ACL bug when using VPN crypto engine accelerator, PPPoE dialer or ip route-cache (Olivier <itsce.networkservices@...ntl.ch>)
• [VULNERABILITY] PHP 'poster version.two' (Peter Winter-Smith <peter4020@...mail.com>)
• RE: [VULNERABILITY] PHP 'poster version.two' (Peter Winter-Smith <peter4020@...mail.com>)
• RE: Detailed analysis: Buffer overflow in Explorer.exe on Windows XP SP1 ("Executable Security" <exurity@...ers.com>)
• Multiple Security Vulnerabilities in OpenSSL on IRIX 6.5.19 (SGI Security Coordinator <agent99@....com>)
• [ESA-20030515-015] 'sudo' heap corruption vulnerability (EnGarde Secure Linux <security@...rdiandigital.com>)
• [ESA-20030515-017] 'kernel' several bug and security-related fixes. (EnGarde Secure Linux <security@...rdiandigital.com>)
• [ESA-20030515-016] 'gnupg' key validation bug. (EnGarde Secure Linux <security@...rdiandigital.com>)
• [RHSA-2003:174-01] Updated tcpdump packages fix privilege dropping error (bugzilla@...hat.com)
• [ESA-20030515-016] 'gnupg' key validation bug. (EnGarde Secure Linux <security@...rdiandigital.com>)
• Re[2]: EXPLOIT: Buffer overflow in Explorer.exe on Windows XP SP1 ("einstein, dhtm" <einstein_dhtm@...nt.ru>)
• [ESA-20030515-017] 'kernel' several bug and security-related fixes. (EnGarde Secure Linux <security@...rdiandigital.com>)
• [ESA-20030515-015] 'sudo' heap corruption vulnerability (EnGarde Secure Linux <security@...rdiandigital.com>)
• MDKSA-2003:057 - Updated MySQL packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• MDKSA-2003:056 - Updated xinetd packages fix DoS vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• RE : Memory leak in 3COM DSL routers ("David F. Madrid" <conde0@...efonica.net>)
• Re: Cisco ACL bug when using VPN crypto engine accelerator (NOT A BUG) ("Jan Bervar" <jan@....si>)
• Re: Cisco ACL bug when using VPN crypto engine accelerator, PPPoE dialer or ip route-cache (Ilker Temir <itemir@...co.com>)
• OneOrZero Security Problems (PHP) ("Frog Man" <leseulfrog@...mail.com>)
• Cisco Security Advisory: Cisco IOS Software Processing of SAA Packets (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Re[2]: Lot of SQL injection on PHP-Nuke 6.5 (secure weblog!) (Benjamin Schulz <lists@....cc>)
• Re: Flooding Internet Explorer 6.0.2800 (6.x?) security zones ! - UPDATED ("http-equiv@...ite.com" <1@...ware.com>)
• RE: Flooding Internet Explorer 6.0.2800 (6.x?) security zones ! - UPDATED ("PaweÅ‚ GoleÅ„" <pgolen@...ptotech.com.pl>)

• MDKSA-2003:058 - Updated cdrecord packages fix local root compromise (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• [RHSA-2003:169-01] Updated lv packages fix vulnerability (bugzilla@...hat.com)
• [RHSA-2003:169-01] Updated lv packages fix vulnerability (bugzilla@...hat.com)
• [RHSA-2003:169-01] Updated lv packages fix vulnerability (bugzilla@...hat.com)
• [SECURITY] [DSA-303-1] New mysql packages fix multiple vulnerabilities (Matt Zimmerman <mdz@...ian.org>)
• [SECURITY] [DSA-305-1] New sendmail packages fix insecure temporary file creation (Matt Zimmerman <mdz@...ian.org>)
• Microsoft Solution for Securing Wireless LANs now available ("Michael Howard" <mikehow@...rosoft.com>)
• EzPublish Directory XSS Vulnerability ("Ferruh Mavituna" <ferruh@...ituna.com>)
• Hersmen Contact ("Chris Knipe" <cknipe@...alan.co.za>)
• Venturi Client 2.1 confirmed as open relay [Verizon Wireless Mobile Office] (Josh Steinhurst <j.securityfocus@...inhurst.net>)
• Immunix Secured OS 7+ fileutils update (Immunix Security Team <security@...ex.com>)
• Snowblind Web Server: multiple issues ("euronymous" <just-a-user@...dex.ru>)
• bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification (NetExpress <netexpress@...cali.it>)
• PDF Available: IIS Security and Programming Countermeasures e-book ("Jason Coombs" <jasonc@...ence.org>)
• [OpenPKG-SA-2003.029] OpenPKG Security Advisory (gnupg) (OpenPKG <openpkg@...npkg.org>)
• [SECURITY] [DSA-304-1] New lv packages fix local privilege escalation (Matt Zimmerman <mdz@...ian.org>)

• Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification (Damian Gerow <damian@...tex.net>)
• Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification (NetExpress <netexpress@...cali.it>)
• Buffer overflow vulnerability found in MailMax version 5 (0x36 <release@...6.org>)
• Path Disclosure in Turba of Horde (Lorenzo Manuel Hernandez Garcia-Hierro <security@...enzohgh.com>)
• PHP-Nuke code injection in Yearly Stats at Statistics module (Lorenzo Manuel Hernandez Garcia-Hierro <security@...enzohgh.com>)
• Re: bsdbsdftpd-6.0-ssl-0.6.1-1 attack allows remote users identification (Mika Boström <bostik@....fi>)
• Automatic Harvesting of AOL Instant Messenger Screen Names! (<cyber_flash@...mail.com>)
• Remote code execution in ttCMS <=v2.3 (ScriptSlave@....net)
• Re: Path Disclosure in Turba of Horde (Anil Madhavapeddy <anil@...oil.org>)

• Editing Info ("morning_wood" <se_cur_ity@...mail.com>)

• bazarr slocate ("bazarr@...lip.com" <bazarr@...lip.com>)
• Security Vulnerabilities in MediaBase Apache and PHP on IRIX (SGI Security Coordinator <agent99@....com>)
• RE: PalmOS ICMP flood DoS. ("Jay D. Thomson" <jdthomson@...ile-secure.com>)
• RE: Hersmen Contact ("Simpelaar, Marco" <msimpela@...boro.com>)
• [SECURITY] [DSA 306-1] New BitchX packages fix DoS and arbitrary code execution (joey@...odrom.org (Martin Schulze))
• Maelstrom Buffer Overflow (Luca Ercoli <luca.ercoli@...ind.it>)

• Plaintext Password in Settings.ini of CesarFTP ("Andreas Constantinides" <megahz@...ahz.org>)
• Maelstrom exploit (Claes Nyberg <md0claes@...tud.chalmers.se>)
• Plaintext Password in Settings.ini of CesarFTP ("Andreas Constantinides" <megahz@...ahz.org>)
• [Fwd: 127 Research and Development: 127 Day!] (northern snowfall <dbailey27@...ritech.net>)
• Re: bazarr slocate (Matt Zimmerman <mdz@...ian.org>)
• Maelstrom Local Buffer Overflow Exploit ("akcess ." <akcss@...uxmail.org>)
• ntoskrnl crashing hard via isqlw.exe ("wirepair" <wirepair@...uemail.net>)
• ntoskrnl.exe and isql.exe hard crash (update) NetWare the root cause ("wirepair" <wirepair@...uemail.net>)
• More vulnerabilities in ttForum/ttCMS -> SQL injection (ScriptSlave@....net)
• Maelstrom Local Buffer Overflow Exploit, FreeBSD 4.8 edition (Knud Erik Højgaard <kain@...op.dk>)
• Blue screen in Windows ("David F. Madrid" <idoru@...eosoft.net.uy>)
• PHP-Nuke Denial of Service attack and more SQL Injections (Lorenzo Manuel Hernandez Garcia-Hierro <security@...enzohgh.com>)
• PHP-Nuke module PHP-Banner-Exchange path disclosure (Lorenzo Manuel Hernandez Garcia-Hierro <security@...enzohgh.com>)
• BadBlue Remote Administrative Interface Access Vulnerability ("mattmurphy@...rr.com" <mattmurphy@...rr.com>)

• [RHSA-2003:175-01] Updated gnupg packages fix validation bug (bugzilla@...hat.com)
• [RHSA-2003:175-01] Updated gnupg packages fix validation bug (bugzilla@...hat.com)
• Verity/Search'97 ObjectStoreSearch ("morning_wood" <se_cur_ity@...mail.com>)
• [INetCop Security Advisory] WsMP3d Directory Traversing Vulnerability. ("dong-h0un U" <xploit@...kermail.com>)
• [INetCop Security Advisory] Remote Heap Corruption Overflow vulnerability in WsMp3d. ("dong-h0un U" <xploit@...kermail.com>)
• [[ TH 026 Inc. ]] SA #4 - Blackmoon FTP Server cleartext passwords and User enumeration (Daniel Nyström <exce@...winder.nu>)
• Restricted Zone: the OUTLOOK EXPRESS ("http-equiv@...ite.com" <1@...ware.com>)
• [AP] Owl Intranet Engine CSS Bug (methodic@...pcap.net)
• [RHSA-2003:175-01] Updated gnupg packages fix validation bug (bugzilla@...hat.com)
• Maelstrom bugfix (was Maelstrom Local Buffer Overflow Exploit, FreeBSD 4.8 edition) (achurch@...urch.org (Andrew Church))
• [VulnDiscuss] SudBoxBoutique : Admin Access (PHP) ("Frog Man" <leseulfrog@...mail.com>)
• [CLA-2003:653] Conectiva Security Announcement - bugzilla (Conectiva Updates <secure@...ectiva.com.br>)
• MDKSA-2003:059 - Updated lpr packages fix local root vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Demarc Puresecure v1.6 - Plaintext password issue - ("Ryan Purita" <ryan@...ally-connected.com>)
• MDKSA-2003:058-1 - Updated cdrecord packages fix local root compromise (Mandrake Linux Security Team <security@...ux-mandrake.com>)

• Eudora 5.2.1 attachment spoof (psz@...hs.usyd.edu.au (Paul Szabo))
• WsMp3d remote exploit. ("dong-h0un U" <xploit@...kermail.com>)
• Security advisory: LSF 5.1 local root exploit (Tomasz Grabowski <cadence@...llo.aci.com.pl>)
• [slackware-security] mod_ssl RSA blinding fixes (SSA:2003-141-05) (Slackware Security Team <security@...ckware.com>)
• [slackware-security] quotacheck security fix in rc.M (SSA:2003-141-06) (Slackware Security Team <security@...ckware.com>)
• [slackware-security] BitchX security fixes (SSA:2003-141-02) (Slackware Security Team <security@...ckware.com>)
• [slackware-security] EPIC4 security fixes (SSA:2003-141-01) (Slackware Security Team <security@...ckware.com>)
• [slackware-security] glibc XDR overflow fix (SSA:2003-141-03) (Slackware Security Team <security@...ckware.com>)
• [slackware-security] GnuPG key validation fix (SSA:2003-141-04) (Slackware Security Team <security@...ckware.com>)
• QuickTime/Darwin Streaming Server security issues (Sir Mordred <mordred@...ail.com>)
• MDKSA-2003:061 - Updated gnupg packages fix validation bug (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• XMB 1.8 Partagium cross site scripting vulnerability (Marc Ruef <marc.ruef@...putec.ch>)
• XMB 1.8 Partagium cross site scripting vulnerability (Marc Ruef <marc.ruef@...putec.ch>)
• Potential security vulnerability in Nessus (je@...ure.net)
• Bug found in: Polymorph 0.4.0 ("Ceq" <ceq@...ode.net>)

• MDKSA-2003:060 - Updated LPRng packages fix insecure temporary file vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Compaq Insight Manager - related to Bugtraq ID 2500 ("Brewis, Mark" <mark.brewis@....com>)
• Re: Restricted Zone: the OUTLOOK EXPRESS (Jeff Beckley <beckley@...lcomm.com>)
• [slackware-security] REVISED quotacheck security fix in rc.M (SSA:2003-141-06a) (Slackware Security Team <security@...ckware.com>)
• Eudora 5.2.1 buffer overflow DoS (psz@...hs.usyd.edu.au (Paul Szabo))
• nessus NASL scripting engine security issues (Sir Mordred <mordred@...ail.com>)
• iisPROTECT SQL injection in admin interface (Gyrniff <frohn@...erbruger.dk>)
• Re: iisPROTECT SQL injection in admin interface (bugtraq@...security.net)
• Re: QuickTime/Darwin Streaming Server security issues ("Joe Testa" <Joe_Testa@...id7.com>)
• Re: iisPROTECT SQL injection in admin interface ("C. David Wilde" <cdw@...inuxguy.com>)
• Magic Winmail Server v.2.*: format string (D4rkGr3y <grey_1999@...l.ru>)
• EServ/2.99: problems (D4rkGr3y <grey_1999@...l.ru>)
• Prishtina FTP v.1.*: remote DoS (D4rkGr3y <grey_1999@...l.ru>)
• Outlook Web Access authentication bypass (Chris Robertson <Chris.Robertson@...till.com>)
• Re: Options Parsing Tool library buffer overflows. (Julien Lanthea <contact@...nthea.net>)
• RE: Outlook Web Access authentication bypass (Chris Robertson <Chris.Robertson@...till.com>)
• Re: Demarc Puresecure v1.6 - Plaintext password issue - (David Barroso <dbarroso@...sec.com>)
• bazarr CALL POLICE ("bazarr@...lip.com" <bazarr@...lip.com>)
• ST FTP Service v3.0: directory traversal (D4rkGr3y <grey_1999@...l.ru>)

• uml_net bug (Ktha <ktha@...hmail.com>)
• Re: Demarc Puresecure v1.6 - Plaintext password issue - ("Kurt Seifried" <kurt@...fried.org>)
• PHP source code injection in BLNews (Over_G <overg@...l.ru>)
• UPB: Discussion Board/Web-Site Takeover ("euronymous" <just-a-user@...dex.ru>)
• Some problems in Privatefirewall 3.0 ("UkR security teamâ„¢" <cuctema@...ru>)
• TextPortal Default Password Vulnerability ("bugtracklist.fm" <bugtracklist@...email.hu>)
• PHP source code injection in BLNews (Over_G <overg@...l.ru>)

• NII Advisory - Buffer Overflow in Analogx Proxy ("K. K. Mookhey" <cto@....co.in>)

• Re: Eudora 5.2.1 attachment spoof (psz@...hs.usyd.edu.au (Paul Szabo))
• [RHSA-2003:171-01] Updated CUPS packages fix denial of service attack (bugzilla@...hat.com)
• Re: BEA WebLogic (Helmut Springer <delta@...-s.org>)
• Possible XSS on iPlanet Messaging Server (Hugo "Vázquez" "Caramés" <overclocking_a_la_abuela@...mail.com>)
• ATM on linux Exploit(les,local) (axis ph4nt0m <axis@...nt0m.net>)
• Re: uml_net bug (3APA3A <3APA3A@...URITY.NNOV.RU>)
• NuxAcid#002 - Buffer Overflow in UpClient (Gino Thomas <g.thomas@...-acid.org>)
• [Priv8security Advisory] Batalla Naval remote overflow ("wsxz" <wsxz@...ra.com.br>)
• The PACKET 0' DEATH FastTrack network vulnerability (random nut <random_nut@...oo.com>)
• PalmVNC 1.40 Insecure Records (flur <flur@...rnet.org>)
• S21SEC-016 - Vignette SSI Injection (S21SEC <vul-serv@...sec.com>)
• SuSE Security Announcement: glibc (SuSE-SA:2003:027) (Thomas Biege <thomas@...e.de>)
• S21SEC-021 - Vignette License access and modification (S21SEC <vul-serv@...sec.com>)
• S21SEC-019 - Vignette /vgn/style internal information leak (S21SEC <vul-serv@...sec.com>)
• [CLA-2003:655] Conectiva Security Announcement - BitchX (Conectiva Updates <secure@...ectiva.com.br>)
• BRS WebWeaver: POST and HEAD Overflaws ("euronymous" <just-a-user@...dex.ru>)
• S21SEC-020 - Vignette user enumeration (S21SEC <vul-serv@...sec.com>)
• S21SEC-017 - Vignette /vgn/legacy/save SQL access (S21SEC <vul-serv@...sec.com>)
• S21SEC-024 - Vignette TCL Injection (S21SEC <vul-serv@...sec.com>)
• Re: bazarr CALL POLICE (Michael Nelson <michaelnel@...thlink.net>)
• Buffer Overflow? Local Malformed URL attack on D-Link 704p router (Chris R <admin@...urityindex.net>)
• S21SEC-018 - Vignette memory leak AIX Platform (S21SEC <vul-serv@...sec.com>)
• S21SEC-023 - Vignette multiple Cross Site Scripting vulnerabilities (S21SEC <vul-serv@...sec.com>)
• CORE-2003-0403: Axis Network Camera HTTP Authentication Bypass (CORE Security Technologies Advisories <advisories@...esecurity.com>)
• [VulnDiscuss] Exploit: Quake 3 engine, con\con and heartbeats (just for fun) (Auriemma Luigi <aluigi@...x.com>)

• Multiple Vulnerabilities in Sun-One Application Server ("SPI Labs" <spilabs@...dynamics.com>)
• Re: CORE-2003-0403: Axis Network Camera HTTP Authentication Bypass (Kee Hinckley <nazgul@...ewhere.com>)
• [CLA-2003:656] Conectiva Security Announcement - netpbm (Conectiva Updates <secure@...ectiva.com.br>)
• Security Update: [CSSA-2003-SCO.9] OpenServer 5.0.5 OpenServer 5.0.6 : Buffer overflows and other security vulnerabilities in Squid (security@....com)
• Re: NII Advisory - Buffer Overflow in Analogx Proxy (Godwin Stewart <gstewart@...mcop.net>)
• [RHSA-2003:145-01] Updated kernel fixes security vulnerabilities and updates drivers (bugzilla@...hat.com)
• [RHSA-2003:177-01] Updated up2date and rhn_register clients available (bugzilla@...hat.com)
• [RHSA-2003:186-01] Updated httpd packages fix Apache security vulnerabilities (bugzilla@...hat.com)
• [RHSA-2003:186-01] Updated httpd packages fix Apache security vulnerabilities (bugzilla@...hat.com)
• [SECURITY] [ANNOUNCE] Apache 2.0.46 released (Apache HTTP Server Project <jwoolley@...che.org>)

• Postnuke: path disclosure (0.7.2.3 and prior) ("rkc" <rkc@...ompiled.com>)
• Son hServer v0.2: directory traversal (D4rkGr3y <grey_1999@...l.ru>)
• Remote PC Access Server 2.2 Vulnerability (postmaster@...ch.co.il)
• Re: S21SEC-024 - Vignette TCL Injection (Stefan Bethke <s.bethke@...lence.com>)
• Tornado www-server v1.2: directory traversal, buffer overflow (D4rkGr3y <grey_1999@...l.ru>)
• Internet Information Services 5.0 Denial of service ("SPI Labs" <spilabs@...dynamics.com>)
• Bandmin 1.4 XSS Exploit (silent needel <silentneedle@...mail.com>)
• [RHSA-2003:186-01] Updated httpd packages fix Apache security vulnerabilities (bugzilla@...hat.com)
• Webfroot Shoutbox 2.32 directory traversal and code injection. (pokleyzz <pokleyzz@...n-associates.net>)
• Geeklog 1.3.7sr1 and below multiple vulnerabilities. (pokleyzz <pokleyzz@...n-associates.net>)
• b2 cafelog 0.6.1 remote command execution. (pokleyzz <pokleyzz@...n-associates.net>)
• [VulnDiscuss] Abusing DNS protocol (OTERO Hernan Gustavo EDS <bazhgo@...hint.net>)
• Proxy - Cookie - PhP - .htaccess Questions ("morning_wood" <se_cur_ity@...mail.com>)
• RE: Proxy - Cookie - PhP - .htaccess Questions ("JT" <ptourvi1@...ny.rr.com>)

• [VulnDiscuss] Re: Abusing DNS protocol ("Richard Johnson" <rdump@...er.com>)
• PAFileDB SQL Injection Vulnerability & Ratings Cheat Fix (JeiAr <jeiar@...ms.com>)
• Algorimic Complexity Attacks (Scott A Crosby <scrosby@...rice.edu>)
• Another ZEUS Server web admin XSS! (Hugo "Vázquez" "Caramés" <overclocking_a_la_abuela@...mail.com>)
• Activity Monitor 2002 remote Denial of Service (Luca Ercoli <luca.ercoli@...ind.it>)
• New php release with security fixes (je@...ure.net)
• PHRACK MAGAZINE Call for Papers (#61) (phrack staff <rm@...fault.net>)
• Multiple Vulnerabilities In P-Synch Password Management (JeiAr <jeiar@...ms.com>)
• [slackware-security] CUPS DoS vulnerability fixed (SSA:2003-149-01) (Slackware Security Team <security@...ckware.com>)
• MDKSA-2003:062 - Updated cups packages fix Denial of Service vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• IIS WEBDAV Denial of Service attacks ("Mark Litchfield" <mark@...software.com>)
• ICQLite executable trojaning (3APA3A <3APA3A@...URITY.NNOV.RU>)
• Philboard Forum Vulnerability (aresu@...en.net)
• BAZARR CODE NINER PINK TEAM GO GO GO ("bazarr@...lip.com" <bazarr@...lip.com>)
• RE: Alert: MS03-019, Microsoft... wrong, again. ("Marc Maiffret" <marc@...e.com>)
• [SECURITY] [DSA-307-1] New gps packages fix multiple vulnerabilities (Matt Zimmerman <mdz@...ian.org>)
• gcc (<3.2.3) implicit struct copy exploit (Luke Hutchison <lukehlistemail@....edu>)
• [RHSA-2003:181-01] Updated ghostscript packages fix vulnerability (bugzilla@...hat.com)
• NSFOCUS SA2003-05: Microsoft IIS ssinc.dll Over-long Filename Buffer Overflow Vulnerability (NSFOCUS Security Team <security@...ocus.com>)
• iDEFENSE Security Advisory 05.30.03: Apache Portable Runtime Denial of Service and Arbitrary Code Execution Vulnerability (Dave Ahmad <da@...urityfocus.com>)

• Antigen Path Disclosure ("morning_wood" <se_cur_ity@...mail.com>)
• Additional Details of Apache 2.x Security Flaw (Attack Vectors) ("Matthew Murphy" <mattmurphy@...rr.com>)
• Re: Antigen Path Disclosure (Nick FitzGerald <nick@...us-l.demon.co.uk>)
• Re: Antigen Path Disclosure ("morning_wood" <se_cur_ity@...mail.com>)
• Re: Antigen Path Disclosure (w g <xillwillx@...oo.com>)

380 messages

Powered by blists - more mailing lists