bugtraq mailing list - 2003/06

Messages by day:

June 1 (22 messages)

• Re: Antigen Path Disclosure (Nick FitzGerald <nick@...us-l.demon.co.uk>)
• URLScan detection (Stephen Cope <mail@...sense.kimihia.org.nz>)
• WebStore2000 SQL Injection Vulnerability & Exploit (Bosen <mobile@...en.net>)
• iisCart2000 Administration Security Leak (Bosen <mobile@...en.net>)
• Windows Media Services Remote Command Execution ("Brett Moore" <brett@...twarecreations.co.nz>)
• Re: Algorimic Complexity Attacks (Solar Designer <solar@...nwall.com>)
• Re: Multiple Vulnerabilities In P-Synch Password Management (Idan Shoham <idan@...nch.com>)
• PHP Trans SID XSS (Was: New php release with security fixes) ("Sverre H. Huseby" <shh@...thost.com>)
• MDKSA-2003:063 - Updated apache2 packages fix vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Re: Another ZEUS Server web admin XSS! (<security@...s.com>)
• Remote DoS in Desktop Orbiter (Luca Ercoli <luca.ercoli@...ind.it>)
• Re: Pi3Web 2.0.1 DoS (Holger Zimmermann <zimpel@...rs.sourceforge.net>)
• Php-Nuke:users and admins password hashes vulnerability (bugsman <bugsman@...ero.it>)
• Re: Unix Version of the Pi3web DoS (Holger Zimmermann <zimpel@...rs.sourceforge.net>)
• conexant adsl router backdoor (Luca Bartolomai <mefistofle@...ero.it>)
• JBOSS 3.2.1: JSP source code disclosure (Marc Schoenefeld <schonef@...-muenster.de>)
• Re: b2 cafelog 0.6.1 remote command execution. (mike little <mike@...1.com>)
• Re: gcc (<3.2.3) implicit struct copy exploit (Joe Meslovich <joe@...dgewater.edu>)
• Internet Explorer URL spoofing threat ("M. Burnett" <mb@...o.net>)
• Yahoo! Security Advisory: Yahoo! Voice Chat (Yahoo!Security Contact <security@...oo-inc.com>)
• IIS Web DAV exploit new release (Alumni Alumni <alumni@...kz>)
• Mod_gzip Debug Mode Vulnerabilities ("Matthew Murphy" <mattmurphy@...rr.com>)

• [ PHP-Nuke :] Multiple vulnerabilities in SPChat 2.0 for PHP-Nuke & SPChat 0.8.0 (Rynho Zeros Web <hackargentino@....net>)
• xmame gain root exploit ("Gabriel A. Maggiotti" <gmaggiot@...dad.com.ar>)
• IIS WebDav Denial of Service attacks - Update to SPI Dynamics ("Mark Litchfield" <mark@...software.com>)
• [Windows XP] ntdll.dll Buffer Overflow Vulnerability - Yet Another MS03-007 (":: Operash ::" <nesumin@...thome.net>)
• Format String Vulnerability in Crob Ftp Server (Luca Ercoli <luca.ercoli@...ind.it>)
• Some Network Drivers May Leak Data on IRIX (SGI Security Coordinator <agent99@....com>)

• IRCXpro 1.0 - Clear local and default remote admin passwords ("morning_wood" <se_cur_ity@...mail.com>)
• [RHSA-2003:187-01] Updated 2.4 kernel fixes vulnerabilities and driver bugs (bugzilla@...hat.com)
• [RHSA-2003:047-01] Updated kon2 packages fix buffer overflow (bugzilla@...hat.com)
• Exploit: Quake 3 engine, con\con and heartbeats (just for fun) (Auriemma Luigi <aluigi@...x.com>)
• Re: IRCXpro 1.0 - Clear local and default remote admin passwords ("IRCXpro Support" <support@...xpro.com>)
• Re: Re: IRCXpro 1.0 - Clear local and default remote admin passwords (Darren Reed <avalon@...igula.anu.edu.au>)
• Re: Re: IRCXpro 1.0 - Clear local and default remote admin passwords (Darren Reed <avalon@...igula.anu.edu.au>)
• Re: URLScan detection ("M. Burnett" <mb@...o.net>)
• Re: b2 cafelog 0.6.1 remote command execution. (Cheng-Jih Chen <cjc@....org>)
• b2 cafelog: remote command execution, sql injection and another flaw. ("FraMe" <frame@...palab.com>)
• Tripbit Advisory TA-2003-05 Buffer Overflow Vulnerability in Pi3 Web Server v2.0.2 Beta 1 ("Rushjo@...pbit.org" <rushjo@...pbit.org>)
• [OpenPKG-SA-2003.030] OpenPKG Security Advisory (ghostscript) (OpenPKG <openpkg@...npkg.org>)
• Re: Re: IRCXpro 1.0 - Clear local and default remote admin passwords ("IRCXpro Support" <support@...xpro.com>)
• Re: Tornado www-server v1.2: directory traversal, buffer overflow ("Berend-Jan Wever" <SkyLined@...p.tudelft.nl>)
• Re: Re: IRCXpro 1.0 - Clear local and default remote admin passwords ("morning_wood" <se_cur_ity@...mail.com>)
• Re: Re: IRCXpro 1.0 - Clear local and default remote admin passwords ("morning_wood" <se_cur_ity@...mail.com>)
• CERT Summary CS-2003-02 (CERT Advisory <cert-advisory@...t.org>)
• Vulnerabilities In Pablo Software Solutions FTP Service 1.2 (JeiAr <jeiar@...ms.com>)

• Updated SGI Apache Version Available for IRIX (SGI Security Coordinator <agent99@....com>)
• kon2 exploit!! ("wsxz" <wsxz@...ra.com.br>)
• CA Unicenter Password Recovery Tool (Tor Houghton <info@...umo.com>)
• Immunix Secured OS 7+ file update (Immunix Security Team <security@...unix.com>)
• Immunix Secured OS 7+ wget update (Immunix Security Team <security@...unix.com>)
• MegaBrowser HTTP and FTP Vulnerabilities (JeiAr <jeiar@...ms.com>)
• public comment period for the Draft Security Vulnerability Reporting and Responding Process (OISAFETY) ("Craig Ozancin" <cozancin@...antec.com>)
• PHP XSS exploit in phpinfo() (silent needle <silentneedle@...mail.com>)
• Xpressions Software: Multiple SQL Injection Attacks To Manage WebStore ("Paul Craig" <pimp@...inwave.net.nz>)
• man[v1.5l]: (catalog) format strings exploit / POC. (Vade 79 <v9@...ehalo.deadpig.org>)
• (Another) Microsoft Internet Explorer FTP Security Hole ("Matthew Murphy" <mattmurphy@...rr.com>)
• Re: CA Unicenter Password Recovery Tool (Joao Gouveia <tharbad@...tik.org>)
• Internet Explorer Object Type Property Overflow ("Derek Soeder" <dsoeder@...e.com>)

• Re: PHP XSS exploit in phpinfo() (Daniel Naber <daniel.naber@...nline.de>)
• possible remote buffer overflow in atftpd ("Rick" <rikul@...erbee.com>)
• [RHSA-2003:192-01] Updated KDE packages fix security issue (bugzilla@...hat.com)
• Re: public comment period for the Draft Security Vulnerability Reporting and Responding Process (OISAFETY) (<dhtml@...h.com>)
• SRT2003-06-05-0935 - HPUX ftpd remote issue via REST (KF <dotslash@...soft.com>)
• AdSubtract Proxy ACL Bypass Vulnerability (advisories@...hq.com)
• Microsoft Internet Explorer %USERPROFILE% Folder Disclosure Vulnerability ("Eiji James Yoshida" <ptrs-ejy@...iij4u.or.jp>)
• ImageFolio All Versions : admin.cgi Directory transversal and file delete exploit. ("Paul Craig" <pimp@...inwave.net.nz>)
• Immunix Secured OS 7+ LPRng update (Immunix Security Team <security@...unix.com>)
• OpenSSH remote clent address restriction circumvention (Mike Harding <mvh@...kyn.com>)
• Solaris syslogd overflow (David Thiel <lx@...undancy.redundancy.org>)
• Monkey Http Daemon (Martin <broadcast@...dyndns.org>)
• Re: Tripbit Advisory TA-2003-05 Buffer Overflow Vulnerability in Pi3 Web Server v2.0.2 Beta 1 (Holger Zimmermann <zimpel@...rs.sourceforge.net>)

• newsphp - Persistant XSS JavaScript Flaws ("morning_wood" <se_cur_ity@...mail.com>)
• [RHSA-2003:070-01] Updated hanterm packages provide security fixes (bugzilla@...hat.com)
• Re: newsphp - Persistant XSS JavaScript Flaws (NewsPHP_Support <support@...sphp.com>)
• MDKSA-2003:064 - Updated kon2 packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• BAZARR LOCAL ROOT AGAIN. HI GUYS. DONT READ THIS ("bazarr@...lip.com" <bazarr@...lip.com>)
• linux)zblast/xzb[v1.2]: local buffer overflow. (games) (Vade 79 <v9@...ehalo.deadpig.org>)
• Re: Re: newsphp - Persistant XSS JavaScript Flaws ("morning_wood" <se_cur_ity@...mail.com>)
• Re: BAZARR LOCAL ROOT AGAIN. HI GUYS. DONT READ THIS ("Benjamin A. Okopnik" <ben@...lahans.org>)
• Critical Vulnerabilities In Max Web Portal (JeiAr <jeiar@...ms.com>)
• Multiple Buffer Overflow Vulnerabilities Found in MERCUR Mail server v.4.2 (SP2) - IMAP protocol ("Dennis Rand" <der@...owarfare.dk>)
• SuSE Security Announcement: cups (SuSE-SA:2003:028) (Sebastian Krahmer <krahmer@...e.de>)
• SuSE Security Announcement: pptpd (SuSE-SA:2003:029) (Sebastian Krahmer <krahmer@...e.de>)
• NOVL-2003-2966207 - iChain 2.1 Field Patch 3 ("Ed Reed" <ereed@...ell.com>)
• NOVL-2003-2966205 - iChain 2.2 Field Patch 1a (Security@...urityfocus.com, Alerts@...urityfocus.com, Novell@...urityfocus.com, Inc. <secure@...ell.com>)
• NOVL-2003-2966181 - HTTPSTK DOS (Security@...urityfocus.com, Alerts@...urityfocus.com, Novell@...urityfocus.com, Inc. <secure@...ell.com>)
• zenTrack Remote Command Execution Vulnerabilities (<farking@...wnur.info>)

• atftpd bug (gz <techieone@...thome.net>)
• LiveJournal remote file upload ("meme-boi" <meme-boi@...hotmail.org>)
• Cross-Platform Browser vulnerabilities - Critical ("meme-boi" <meme-boi@...hotmail.org>)
• Speak Freely <=7.5 multiple remote and local vulnerabilities (the Hackademy Audit) (Fozzy <fozzy@...france.com>)
• [SECURITY] [DSA-309-1] New eterm packages fix buffer overflow (Matt Zimmerman <mdz@...ian.org>)
• Re: Algorimic Complexity Attacks ("Pavel Kankovsky" <peak@...o.troja.mff.cuni.cz>)
• [SECURITY] [DSA-308-1] New gzip packages fix insecure temporary file creation (Matt Zimmerman <mdz@...ian.org>)
• Re: Algorimic Complexity Attacks (Nicholas Weaver <nweaver@...berkeley.edu>)
• Re: zenTrack Remote Command Execution Vulnerabilities (gr00vy <groovy2600@...oo.com.ar>)
• man[v1.5l] catalog format strings patch. (Vade 79 <v9@...ehalo.deadpig.org>)
• IE-object tag longtype exploit (Alumni <alumni@...kz>)

• Java Virtual Machine Symlink Vulnerability ("meme-boi" <meme-boi@...hotmail.org>)
• Apache 2.x APR Exploit Code ("mattmurphy@...rr.com" <mattmurphy@...rr.com>)
• NMRC Announces New Services; Speaking Engagements (announce@....nmrc.org)

• Linux 2.0 remote info leak from too big icmp citation (Philippe Biondi <biondi@...tel-securite.fr>)
• Re: Cross-Platform Browser vulnerabilities - Critical ("meme-boi" <meme-boi@...hotmail.org>)
• Re: Linux 2.0 remote info leak from too big icmp citation (Andrew Griffiths <andrewg@...net.au>)
• Etherleak information leak in Windows Server 2003 drivers (NGSSoftware Insight Security Research <nisr@...tgenss.com>)
• [SECURITY] [DSA-310-1] New xaos packages fix improper setuid-root execution (Matt Zimmerman <mdz@...ian.org>)
• Re: Algorimic Complexity Attacks ("Pavel Kankovsky" <peak@...o.troja.mff.cuni.cz>)
• Re: Algorimic Complexity Attacks (Nicholas Weaver <nweaver@...berkeley.edu>)
• WebSetup / WebMin Security Vulnerability on IRIX (SGI Security Coordinator <agent99@....com>)
• PSOFT H-Sphere Cross Site Scripting Vulnerabilities ("Lorenzo Hernandez Garcia-Hierro" <novappc@...appc.com>)
• [LSD] HP-UX security vulnerabilities (Last Stage of Delirium <contact@...-pl.net>)
• Nokia GGSN (IP650 Based) DoS ("@stake Advisories" <advisories@...take.com>)
• Several bugs found in "Spyke's PHP Board" ("Marc Bromm" <theblacksheep@...tmail.fm>)
• [FTP Voyager] File List Buffer Overflow Vulnerability (":: Operash ::" <nesumin@...thome.net>)
• [SECURITY] [DSA-311-1] New kernel packages fix several vulnerabilities (Matt Zimmerman <mdz@...ian.org>)
• [FlashFXP] Two Buffer Overflow Vulnerabilities (":: Operash ::" <nesumin@...thome.net>)
• [LeapFTP] "PASV" Reply Buffer Overflow Vulnerability (":: Operash ::" <nesumin@...thome.net>)
• [SmartFTP] Two Buffer Overflow Vulnerabilities (":: Operash ::" <nesumin@...thome.net>)

• Re: zenTrack Remote Command Execution Vulnerabilities (gr00vy <groovy2600@...oo.com.ar>)
• BookCMS - Remote Default Administrator Password ("morning_wood" <se_cur_ity@...mail.com>)
• Immunix Secured OS 7+ tetex update (Immunix Security Team <security@...unix.com>)
• [SECURITY] [DSA-312-1] New powerpc kernel fixes several vulnerabilities (Matt Zimmerman <mdz@...ian.org>)
• Re: Apache 2.x APR Exploit Code (Lars Eilebrecht <lars@...che.org>)
• Directory traversal in NucaWeb Server (Over_G <overg@...l.ru>)
• Imperfect Broadcast Address Checking on IRIX (SGI Security Coordinator <agent99@....com>)
• Potential Denial of Service using PIOCSWATCH ioctl on IRIX (SGI Security Coordinator <agent99@....com>)

• [OpenPKG-SA-2003.031] OpenPKG Security Advisory (gzip) (OpenPKG <openpkg@...npkg.org>)
• Low risk vulnerabilities in ftp file list handling (alan@...p22.swansea.linux.org.uk)
• Denial of Service Attack against ArGoSoft Mail Server Version 1.8 ("Rushjo@...pbit.org" <rushjo@...pbit.org>)
• Re: Etherleak information leak in Windows Server 2003 drivers (Ofir Arkin <ofir@...-security.com>)

• MDKSA-2003:066 - Updated kernel packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• SRT2003-06-12-1212 - FakeBO syslog() format string issue. (KF <dotslash@...soft.com>)
• libmysqlclient 4.x and below mysql_real_connect() buffer overflow. (pokleyzz <pokleyzz@...n-associates.net>)

• SRT2003-06-12-0853 - ike-scan local root format string issue (KF <dotslash@...soft.com>)
• [ANNOUNCE] kses 0.1.0 (Ulf Harnhammar <ulfh@...ate.UU.SE>)
• Cross site scripting in Post-Nuke ("David F. Madrid" <idoru@...eosoft.net.uy>)
• Sphera Hosting Director Control Panel Multiple Vulnerabilities: XSS-Session Hijacking-DoS/Buffer Overflow-Another User A… ("Lorenzo Hernandez Garcia-Hierro" <nova…)
• SuSE Security Announcement: radiusd-cistron (SuSE-SA:2003:030) (Thomas Biege <thomas@...e.de>)
• [SECURITY] [DSA-318-1] New lyskom-server packages fix denial of service (Matt Zimmerman <mdz@...ian.org>)
• [SECURITY] [DSA-319-1] New webmin packages fix remote session ID spoofing (Matt Zimmerman <mdz@...ian.org>)
• BAZARR THUG LIFE , DONT READ OR VIRUS INFECT YOU ("bazarr@...lip.com" <bazarr@...lip.com>)

• -10Day CERT Advisory on PDF Files (<hack4life@...hmail.com>)
• SRT2003-06-13-0945 - Progress PATH based dlopen() issue (KF <dotslash@...soft.com>)
• SRT2003-06-13-1009 - Progress _dbagent -installdir dlopen() issue (KF <dotslash@...soft.com>)
• BlackICE PC Protection Cross Site Scripting Evasion (Marc Ruef <marc.ruef@...putec.ch>)
• [SECURITY] [DSA-320-1] New mikmod packages fix buffer overflow (Matt Zimmerman <mdz@...ian.org>)
• [SECURITY] [DSA-321-1] New radiusd-cistron packages fix buffer overflow (Matt Zimmerman <mdz@...ian.org>)

• pMachine (PHP) : Include() Security Hole ("Frog Man" <leseulfrog@...mail.com>)

• XSS Vulnerability in LedNews (CGI/Perl) v0.7 ("gilbert vilvoorde" <gilbert_vilvoorde@...mail.com>)
• FW: iDEFENSE Security Advisory 06.16.03: Linux-PAM getlogin() Spoofing Vulnerability (Dave Ahmad <da@...urityfocus.com>)
• Next kon2root - Redhat 9 (c0ntex <c0ntex@...hmail.com>)
• dnsdigger (Michael Thumann <mthumann@...w.de>)
• Improving Web Application Security: Threats and Countermeasures ("Michael Howard" <mikehow@...rosoft.com>)
• Directory traversal vulnerability on Xoops/E-xoops CMS module "tutorials" ("ac3" <ac3@....security-lab.org>)
• Multiple Vulnerabilities In Snitz Forums (JeiAr <jeiar@...ms.com>)
• Multiple Vulnerabilities Found in Mailtraq (DoS, Password Decryption, Directory Traversal) ("SecurITeam BugTraq Monitoring" <bugtraq@...uriteam.com>)
• Dantz Retrospect Client 5.0.540 for Mac OS X - permission issues (Alan McCarty <amccarty@...rnell.com>)
• MDKSA-2003:068 - Updated gzip packages fix insecure temporary file creation (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• MDKSA-2003:067 - Updated ethereal packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• [CLA-2003:661] Conectiva Security Announcement - apache (Conectiva Updates <secure@...ectiva.com.br>)

• Cross-Site Scripting in Unparsable XML Files (GM#013-IE) (GreyMagic Software <security@...ymagic.com>)
• Re: pMachine (PHP) : Include() Security Hole (martin f krafft <madduck@...duck.net>)
• Script Injection to Custom HTTP Errors in Local Zone (GM#014-IE) (GreyMagic Software <security@...ymagic.com>)
• Re: Cross-Site Scripting in Unparsable XML Files (GM#013-IE) (jelmer <kuper237@...net.nl>)
• Re: Cross-Site Scripting in Unparsable XML Files (GM#013-IE) ("Kevin Spett" <kspett@...dynamics.com>)
• Linux 2.0 remote info leak from too big icmp citation (Philippe Biondi <biondi@...tel-securite.fr>)
• Re: Cross-Site Scripting in Unparsable XML Files (GM#013-IE) (Matt Moore <matt.moore@...test-limited.com>)
• ZH2003-2SP Security Patch for atftp 0.6.*-0.7 (Astharot <secfoc@...il.it>)
• [SECURITY] [DSA-323-1] New noweb packages fix insecure temporary file creation (Matt Zimmerman <mdz@...ian.org>)
• dune[0.6.7+-]: remote buffer overflow exploit. (httpd) (Vade 79 <v9@...ehalo.deadpig.org>)
• [SECURITY] [DSA-322-1] New typespeed packages fix buffer overflow (Matt Zimmerman <mdz@...ian.org>)
• Portmon file arbitrary read/write access vulnerability (Luca Ercoli <luca.ercoli@...ind.it>)
• cdrtools exploit (Claes Nyberg <md0claes@...tud.chalmers.se>)
• Perl "Safe.pm" vulnerability on IRIX (SGI Security Coordinator <agent99@....com>)
• MIPSPro Compiler Predictable Temp File vulnerability (SGI Security Coordinator <agent99@....com>)

• [SECURITY] [DSA-324-1] New ethereal packages fix multiple vulnerabilities (Matt Zimmerman <mdz@...ian.org>)
• Denial of service in Cajun P13x/P33x switch family firmware 3.x (Jacek Lipkowski <sq5bpf@...ra.com.pl>)
• phpMyAdmin XSS Vulnerabilities, Transversal Directory Attack , Information Encoding Weakness and Path Disclosures (Lorenzo Manuel Hernandez Garcia-Hierro <s…)
• [RHSA-2003:196-01] Updated Xpdf packages fix security vulnerability (bugzilla@...hat.com)
• MHFTPD vulnerability (Frank Denis <j@...networks.com>)
• [slackware-security] 2.4.21 kernels available (SSA:2003-168-01) (Slackware Security Team <security@...ckware.com>)
• Portmon file arbitrary read/write access vulnerability (David Hancock <dmhancoc@...ibm.com>)
• Re: CuteFTP 5.0 XP, Buffer Overflow (<robert@...balscape.com>)
• Resolution of Issue - Compaq Insight Manager - related to Bugtraq ID 2500 ("Brewis, Mark" <mark.brewis@....com>)
• old squid remote (gunzip <techieone@...thome.net>)
• ConnecTalk Security Advisory: Qpopper leaks information during authentication ("Marc Lafortune" <mlafortune@...nectalk.com>)
• ASP replacement for ISM.DLL available ("Michael Howard" <mikehow@...rosoft.com>)
• PALM DESKTOP SOFTWARE / WIN 2000 ("Scott R. Patronik" <scottrp@...alnet.com>)
• MDKSA-2003:069 - Updated BitchX packages fix DoS vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• [SECURITY] [DSA-316-3] New jnethack packages fix buffer overflow, incorrect permissions (Matt Zimmerman <mdz@...ian.org>)
• Multiple buffer overflows and XSS in Kerio MailServer ("David F.Madrid" <conde0@...efonica.net>)
• Re: ConnecTalk Security Advisory: Qpopper leaks information during authentication (Justin Wheeler <jwheeler@...ademons.com>)

• SQL Inject in ProFTPD login against Postgresql using mod_sql ("runlevel " <runlevel@...uxmail.org>)
• [ANNOUNCE]: ScanADS 1.0 ("Tiago Halm" <thalm@...cabo.pt>)
• [ANNOUNCE]: IISBanner 1.0 ("Tiago Halm" <thalm@...cabo.pt>)
• phpBB password disclosure by sql injection ("Rick" <rikul@...lsouth.net>)
• [VulnDiscuss] Intrusec 55808 Trojan Analysis ("David J. Meltzer" <djm@...rusec.com>)

• SurfControl Web Filter for Microsoft ISA Server Vulnerability (thomas adams <tgadams@...lsouth.net>)
• Re: PALM DESKTOP SOFTWARE / WIN 2000 (Christopher Rector <crector@...med.edu>)
• Re: ConnecTalk Security Advisory: Qpopper leaks information during authentication ** Forget this one... ** ("Marc Lafortune" <mlafortune@...nectalk.com>)
• Maelstrom Local Buffer Overflow Exploit, FreeBSD 4.8 edition (NC Agent <NC_Agent@...ppers-familie.de>)
• SRT2003-06-20-1232 - Progress 4GL Compiler datatype overflow (KF <dotslash@...soft.com>)
• [SECURITY] [DSA-325-1] New eldav packages fix insecure temporary file creation (Matt Zimmerman <mdz@...ian.org>)
• [RHSA-2003:026-01] Updated Netscape packages are now available (bugzilla@...hat.com)
• [VulnDiscuss] Re: phpBB password disclosure by sql injection (-= Jimmino =- <australia001@...oo.com.au>)
• BAZARR FAREWELL ("assasa sasasaaa" <bazrar@...mail.com>)
• HP-UX pcltotiff (security-alert@...com)

• GNATS (The GNU bug-tracking system) multiple buffer overflow vulnerabilities. ("dong-h0un U" <xploit@...kermail.com>)
• Intrusec 55808 Trojan Analysis ("David J. Meltzer" <djm@...rusec.com>)
• Linux /proc sensitive information disclosure (Paul Starzetz <paul@...rzetz.de>)

• Local file retrieving in QNX Internet Appliance Toolkit http-daemon (web.server) ("Michael Bemmerl" <security@...robox.net>)

• pMachine (PHP) : Include() Security Hole ("Frog Man" <leseulfrog@...mail.com>)
• Myserver 0.4.1 DOS.. (eip@...ey.no-ip.com)
• Many XSS Vulnerabilities in XMB Forum. (Knight Commander <knight4vn@...oo.com>)
• [KSA-001] Multiple vulnerabilities in Tutos (François SORIN <francois.sorin@...eval.com>)
• Bypassing ZoneAlarm (limited) (<aceh@...vetch.bg>)
• Re: Algorimic Complexity Attacks ("Pavel Kankovsky" <peak@...o.troja.mff.cuni.cz>)
• gid bin from /usr/ports/korean/elm (FreeBSD) (Knud Erik Højgaard <kain@...op.dk>)
• Re: gid bin from /usr/ports/korean/elm (FreeBSD) (Knud Erik Højgaard <kain@...op.dk>)
• PerlEdit ("morning_wood" <se_cur_ity@...mail.com>)
• RE: PALM DESKTOP SOFTWARE / WIN 2000 ("Phillip R. Paradis" <prp17@...lphia.net>)
• XSS Exploit In phpBB viewtopic.php (silent needle <silentneedle@...mail.com>)
• TA-2003-06 Denial of Service Attack against Armida Databased Web Server v1.0 ("Rushjo@...pbit.org" <rushjo@...pbit.org>)
• Internet Explorer >=5.0 : Buffer overflow (Digital Scream <digitalscream@...l.xakep.ru>)
• TA-2003-06 php-form-misconfiguration in VisNetic WebMail v.5.8.6.6 ("Rushjo@...pbit.org" <rushjo@...pbit.org>)
• TA-2003-06 Directory Transversal Vulnerability in iWeb Server 2 ("Rushjo@...pbit.org" <rushjo@...pbit.org>)
• Invalid SquirrelMail Exploit (Jonathan Angliss <jon@...irrelmail.org>)
• Sambar Server : Crashing service with search.pl (Lorenzo Manuel Hernandez Garcia-Hierro <security@...enzohgh.com>)

• MDKSA-2003:070 - Updated ethereal packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Re: GNATS (The GNU bug-tracking system) multiple buffer overflow vulnerabilities. ("dong-h0un U" <xploit@...kermail.com>)
• CFP: Industrial Experience in Security (Crispin Cowan <crispin@...unix.com>)
• [SECURITY] [DSA-330-1] New tcptraceroute packages fix failure to drop root privileges (Matt Zimmerman <mdz@...ian.org>)
• Remote Buffer Overrun WebAdmin.exe ("Mark Litchfield" <mark@...software.com>)
• lbreakout2server[v2-2.5+]: remote format string exploit. (Vade 79 <v9@...ehalo.deadpig.org>)
• GuestBookHost : Cross Site Scripting ("Julien L." <jlanthea@...nthea.net>)
• Re: TA-2003-06 Directory Transversal Vulnerability in iWeb Server 2 ("akcess ." <akcss@...uxmail.org>)
• [Symantec Security Advisor] Symantec Security Check ActiveX Buffer Overflow ("Sym Security" <symsecurity@...antec.com>)
• Re: Invalid SquirrelMail Exploit (3APA3A <3APA3A@...URITY.NNOV.RU>)
• Sharp Zaurus SL-5500 upgrade ROM v3.1 - serious Samba issue (Bjorn Tore Sund <bjornts@...uib.no>)
• RE: [Symantec Security Advisor] Symantec Security Check ActiveX Buffer Overflow ("Jason Coombs" <jasonc@...ence.org>)
• Re: WebAdmin from ALT-N remote exploit PoC ("wirepair" <wirepair@...uemail.net>)
• Re: Sharp Zaurus SL-5500 upgrade ROM v3.1 - serious Samba issue (dave@...unitysec.com)
• Multiple IPv6-Induced Bugs & Vulnerabilities on IRIX (SGI Security Coordinator <agent99@....com>)
• RE: [Symantec Security Advisor] Symantec Security Check ActiveX Buffer Overflow (Chris Wysopal <weld@...nwatch.org>)

• phpBB 2.0.5 Released ("Boyce, Nick" <nick.boyce@....com>)
• Re: Algorimic Complexity Attacks (Götz Babin-Ebell <babin-ebell@...stcenter.de>)
• RE: [Symantec Security Advisor] Symantec Security Check ActiveX Buffer Overflow ("Eric Lawrence" <ericlaw@...hange.Microsoft.com>)
• Re: Cross-Site Scripting in Unparsable XML Files (GM#013-IE) ("Steven M. Christey" <coley@...re.org>)
• Re: Bypassing ZoneAlarm (limited) (Dan Harkless <bugtraq@...kless.org>)
• Re: Internet Explorer >=5.0 : Buffer overflow (KF <dotslash@...soft.com>)
• Re: Remote Buffer Overrun WebAdmin.exe ("David A. Pérez" <david@...borio.com>)
• [RHSA-2003:173-01] Updated ypserv packages fix a denial of service vulnerability (bugzilla@...hat.com)
• [RHSA-2003:173-01] Updated ypserv packages fix a denial of service vulnerability (bugzilla@...hat.com)
• [RHSA-2003:067-01] Updated XFree86 packages provide security and bug fixes (bugzilla@...hat.com)
• [RHSA-2003:067-00] Updated XFree86 packages provide security and bug fixes (bugzilla@...hat.com)
• [RHSA-2003:067-01] Updated XFree86 packages provide security and bug fixes (bugzilla@...hat.com)
• [RHSA-2003:066-01] Updated XFree86 packages provide security and bug fixes (bugzilla@...hat.com)
• Privilege escalation applet, Java Media Framework (Marc Schoenefeld <schonef@...-muenster.de>)
• Authentication Vulnerability in NetScreen ScreenOS (HedgeHog <hedgehog703@...cast.net>)
• [RHSA-2003:067-01] Updated XFree86 packages provide security and bug fixes (bugzilla@...hat.com)
• [RHSA-2003:173-01] Updated ypserv packages fix a denial of service vulnerability (bugzilla@...hat.com)
• [RHSA-2003:064-01] Updated XFree86 4.1.0 packages are available (bugzilla@...hat.com)
• [CLA-2003:662] Conectiva Security Announcement - ethereal (Conectiva Updates <secure@...ectiva.com.br>)
• OptiSwitch remote root compromise (CrazZzy Slash <slash@...c.kg>)

• various portmon vulnerabilities (Nik Reiman <nik@...leo.net>)
• [KSA-002] Multiple Vulnerabilities In Moregroupware (François SORIN <francois.sorin@...urity-corporation.com>)
• BEFSR81 SNMP Community String Information Disclosure Vulnerability (franck dunter <dunter76@...mail.com>)
• Linux 2.4.x execve() file read race vulnerability (Paul Starzetz <paul@...rzetz.de>)
• Re: Internet Explorer >=5.0 : Buffer overflow (xenophi1e <oliver.lavery@...patico.ca>)
• Windows Media Services Remote Command Execution #2 ("Brett Moore" <brett.moore@...urity-assessment.com>)
• Re: OptiSwitch remote root compromise (KF <dotslash@...soft.com>)
• RE: Authentication Vulnerability in NetScreen ScreenOS ("Brian Soby" <tmpbox5@...mail.com>)
• RE: Authentication Vulnerability in NetScreen ScreenOS (Hugo van der Kooij <hvdkooij@...derkooij.org>)
• Bahamut IRCd <= 1.4.35 and several derived daemons (Joel Eriksson <je-secfocus@...nux.com>)
• Re: Bahamut IRCd <= 1.4.35 and several derived daemons (Barnaba Marcello <l.barnaba@...nssl.it>)
• Symantec NAV 7.6 CE Major Fault (Pal Juvancz <Pal.Juvancz@...licworks.qld.gov.au>)

• [CLA-2003:664] Conectiva Security Announcement - radiusd-cistron (Conectiva Updates <secure@...ectiva.com.br>)
• Windows 2000 SP4 is out ("Eric Johansen" <eric.johansen@...ing.com>)
• WebBBS Guestbook : Cross Site Scripting (<lavieangel@...omain.com>)
• Re: Bahamut IRCd <= 1.4.35 and several derived daemons (Roman Bogorodskiy <bogorodskiy@...ox.ru>)
• hello-exploit.c (Lucas <lgates@...ra.com.br>)
• Re: TA-2003-06 Directory Transversal Vulnerability in iWeb Server 2 ("Rushjo@...pbit.org" <rushjo@...pbit.org>)
• Bahamut DoS (dreamer@...kness.gr)
• Development Impacts of Security Changes in Windows Server 2003 ("Michael Howard" <mikehow@...rosoft.com>)
• VMware Workstation 4.0: Possible privilege escalation on the host via symlink manipulation (VMware <vmware-security-alert@...are.com>)
• MDKSA-2003:072 - Updated ypserv packages fix DoS vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• MDKSA-2003:071 - Updated xpdf packages fix arbitrary code execution vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• wzdftpd remote DoS (Roman Bogorodskiy <bogorodskiy@...ox.ru>)
• Re: TA-2003-06 Directory Transversal Vulnerability in iWeb Server ("Steven M. Christey" <coley@...re.org>)
• [CLA-2003:665] Conectiva Security Announcement - kopete (Conectiva Updates <secure@...ectiva.com.br>)
• Re: Let's have fun with EICAR test file ("Kurt Seifried" <bt@...fried.org>)
• Re: VMware Workstation 4.0: Possible privilege escalation on the host via symlink manipulation (VMware <vmware-security-alert@...are.com>)

• Re: [Security] [vendor-sec] Linux 2.4.x execve() file read race vulnerability (Crispin Cowan <crispin@...unix.com>)
• [VulnDiscuss] Hotmail (Accounts) Vulnerability ("Victor Manuel Alvarez Castro [oc]" <valvarez@...ther.com>)

• Multiple vulnerabilities in paBox ("silentscripter" <silentscripter@...ern.org>)

• Megabook 2.0 -XSS & UA execution ("morning_wood" <se_cur_ity@...mail.com>)
• Aprelium Abyss webserver X1 arbitrary code execution and header injection (Fozzy <fozzy@...france.com>)
• [SECURITY] [DSA-331-1] New imagemagick packages fix insecure temporary file creation (Matt Zimmerman <mdz@...ian.org>)
• [SECURITY] [DSA-332-1] New Linux 2.4.17 source code and MIPS kernel images fix several vulnerabilities (Matt Zimmerman <mdz@...ian.org>)
• [SECURITY] [DSA-333-1] New acm packages fix integer overflow (Matt Zimmerman <mdz@...ian.org>)
• [SECURITY] [DSA-335-1] New mantis packages fix insecure file permissions (Matt Zimmerman <mdz@...ian.org>)
• [SECURITY] [DSA-334-1] New xgalaga packages fix buffer overflow (Matt Zimmerman <mdz@...ian.org>)

303 messages

Powered by blists - more mailing lists