bugtraq mailing list - 2003/12

Messages by day:

December 1 (12 messages)

• [VulnDiscuss] Cutenews 1.3 information disclosure (scrap <webmaster@...uriteinfo.com>)
• Virtual Programming VP-ASP Shopping Cart 5.0 multiple SQL Injection Vulnerabilities (S-Quadra Security Research <research@...uadra.com>)
• Re: Remote execution in My_eGallery (Fauvet Ludovic <etix@...box.com>)
• Re: phpBB 2.06 search.php SQL injection (Jay Gates <zarath@...ghtsofchaos.com>)
• Re: GNU screen buffer overflow (Mariusz Woloszyn <emsi@...rtners.pl>)
• Surfboard <= 1.1.8 vulns (Luigi Auriemma <aluigi@...ervista.org>)
• ANNOUNCE: New mailing list for secure application development, SC-L ("Kenneth R. van Wyk" <ken@...wyk.org>)
• Jason Maloney's CGI Guestbook Remote Command Execution Vulnerability. (Shaun Colley <shaunige@...oo.co.uk>)
• where to discuss common criteria issues? (Magosányi Árpád <mag@...uel.tii.matav.hu>)
• [ANNOUNCE] glibc heap protection patch (William Robertson <wkr@...ucsb.edu>)
• [Full-Disclosure] [SECURITY] [DSA-403-1] userland can access Linux kernel memory (debian-security-announce@...ts.debian.org)
• Re: Multiple Remote Issues in Applied Watch IDS Suite (advisory attached) ("Steven M. Christey" <coley@...re.org>)

• MDKSA-2003:110 - Updated kernel packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• TSLSA-2003-0046 - kernel (Trustix Security Advisor <tsl@...stix.org>)
• UnixWare 7.1.1 : Bind: cache poisoning BIND 8 prior to 8.3.7 and BIND 8.4.x prior 8.4.2 (security@....com)
• [RHSA-2003:392-00] Updated 2.4 kernel fixes privilege escalation security vulnerability (bugzilla@...hat.com)
• Re: [ANNOUNCE] glibc heap protection patch ("Eugene Tsyrklevich" <eugene@...urityarchitects.com>)
• Re: [ANNOUNCE] glibc heap protection patch (Stefan Esser <stefan@...pekt.org>)
• Comments on 5 IE vulnerabilities ("Thor Larholm" <thor@...x.com>)
• Linux kernel do_brk() proof-of-concept exploit code (Christophe Devine <DEVINE@....cnam.fr>)
• [iSEC] Linux kernel do_brk() lacks argument bound checking (Paul Starzetz <ihaquer@...c.pl>)
• IBM Directory Server 4.1 Web Admin Gui (ldacgi.exe) XSS Vulnerability ("Oliver Karow" <Oliver.Karow@....de>)
• Re: [ANNOUNCE] glibc heap protection patch (William Robertson <wkr@...ucsb.edu>)
• [RHSA-2003:335-01] Updated Net-SNMP packages fix security and other bugs (bugzilla@...hat.com)
• Re: Linux kernel do_brk() proof-of-concept exploit code (Calum <bugtraq@...strial.co.uk>)
• Cisco Security Advisory: SNMP trap Reveals WEP Key in Cisco Aironet AP (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• [slackware-security] Kernel security update (SSA:2003-336-01) (Slackware Security Team <security@...ckware.com>)
• [slackware-security] minor advisory typo (SSA:2003-336-01b) (Slackware Security Team <security@...ckware.com>)
• Re: [ANNOUNCE] glibc heap protection patch (William Robertson <wkr@...ucsb.edu>)
• Re: Comments on 5 IE vulnerabilities (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)

• do_brk() vulnerability on SGI Altix systems (SGI Security Coordinator <agent99@....com>)
• Yahoo Instant Messenger YAUTO.DLL buffer overflow ("Tri Huynh" <trihuynh@...up.com>)
• GnuPG 1.2.3, 1.3.3 external HKP interface format string issue (S-Quadra Security Research <research@...uadra.com>)
• eZphotoshare Multiple Overflow Vulnerabilities ("Peter Winter-Smith" <peter4020@...mail.com>)
• FreeBSD arp poison patch (<bert_raccoon@...email.ru>)
• SUSE Security Announcement: gpg (SuSE-SA:2003:048) (Roman Drahtmueller <draht@...e.de>)
• GLSA: rsync.gentoo.org rotation server compromised (200312-01) (Daniel Robbins <drobbins@...too.org>)
• Re: Jason Maloney's CGI Guestbook Remote Command Execution Vulnerability. (Nick Cleaton <nick@...aton.net>)
• Websense Blocked Sites XSS ("Mr. P.Taylor" <petert@...gine-sw.com>)
• Altova XMLSpy "phones home" user data (Bruno Lustosa <bruno@...tosa.net>)
• Re: [ANNOUNCE] glibc heap protection patch (Stefan Esser <se@...iracy.de>)
• Microsoft TechNet Security Webcast Week ("Michael Howard" <mikehow@...rosoft.com>)
• XBoard < 4.2.7: pxboard insecure tmp file handling (Martin Mačok <martin.macok@...erground.cz>)
• Re: [ANNOUNCE] glibc heap protection patch (Han Boetes <han@...ncomputer.nl>)
• Re: GNU screen buffer overflow (Kyle Sallee <cromwell@...alab.unc.edu>)
• Re: GnuPG 1.2.3, 1.3.3 external HKP interface format string issue (David Shaw <dshaw@...berwocky.com>)
• Summary: where to discuss common criteria issues? (Magosányi Árpád <mag@...uel.tii.matav.hu>)
• [VulnDiscuss] Multiple OpenSSH/OpenSSL Vulnerabilities Update on IRIX (SGI Security Coordinator <agent99@....com>)
• Re: GNU screen buffer overflow (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
• Re: GNU screen buffer overflow (Casper Dik <casper@...land.sun.com>)

• Linksys WRT54G Denial of Service Vulnerability (<test@...hcentric.net>)
• Re: [ANNOUNCE] glibc heap protection patch (William Robertson <wkr@...ucsb.edu>)
• Re: [ANNOUNCE] glibc heap protection patch (xenophi1e <oliver.lavery@...patico.ca>)
• Re: RE: Yahoo Instant Messenger YAUTO.DLL buffer overflow (De Blanc <deblanc01@...oo.com>)
• XSS Vulnerabilities in Alan Ward Acart (<parag0d@...eaker.net>)
• Plaintext Vulnerability in Alan Ward Acart (<parag0d@...eaker.net>)
• XSS vulnerabilities in register.asp in Alan Ward Acart (<parag0d@...eaker.net>)
• [slackware-security] rsync security update (SSA:2003-337-01) (Slackware Security Team <security@...ckware.com>)
• Re: [ANNOUNCE] glibc heap protection patch (Stefan Esser <se@...iracy.de>)
• rsync security advisory (fwd) (Andrea Barisani <lcars@...too.org>)
• TSLSA-2003-0048 - rsync (Trustix Security Advisor <tsl@...stix.org>)
• Improper authentication checking in Alan Ward Acart (<parag0d@...eaker.net>)
• [OpenPKG-SA-2003.051] OpenPKG Security Advisory (rsync) (OpenPKG <openpkg@...npkg.org>)
• Linux kernel do_brk(), another proof-of-concept code for i386 (Julien TINNES <julien@....org>)
• Re: [ANNOUNCE] glibc heap protection patch (Marco Ivaldi <raptor@...eadbeef.info>)
• SuSE Security Announcement: Kernel brk() vulnerability (SuSE-SA:2003:049) (Olaf Kirch <okir@...e.de>)
• [SECURITY] [DSA 404-1] New rsync packages fix unauthorised remote code execution (joey@...odrom.org (Martin Schulze))
• Re: [ANNOUNCE] glibc heap protection patch (Adam Shostack <adam@...eport.org>)
• Re: speedtouch 510 DOS (Bart van Leeuwen <bart@...tsplace.net>)
• Re: [ANNOUNCE] glibc heap protection patch (Troed Sångberg <troed@...gberg.se>)
• Re: Linksys WRT54G Denial of Service Vulnerability (Michael Renzmann <security@...anic.de>)
• Re: [ANNOUNCE] glibc heap protection patch (William Robertson <wkr@...ucsb.edu>)
• Re: Altova XMLSpy "phones home" user data (Greg Steuck <greg-bugtraq2003@...t.cx>)
• SUSE Security Announcement: rsync (SuSE-SA:2003:050) (thomas@...e.de (Thomas Biege))
• Re: FreeBSD arp poison patch (Ryota Hirose <hirose@...m.yamaha.co.jp>)
• [ESA-20031204-032] 'rsync' heap overflow vulnerability (EnGarde Secure Linux <security@...rdiandigital.com>)
• Intresting case of SQL Injection ("Martin Sarsale (runa@...es)" <runa@...a.sytes.net>)
• GLSA: exploitable heap overflow in rsync (200312-03) (Daniel Robbins <drobbins@...too.org>)
• GLSA: kernel (200312-02) (Rajiv Aaron Manglani <rajiv@...too.org>)
• Linux 4inarow game multiple vulnerabilities. (Shaun Colley <shaunige@...oo.co.uk>)
• [CLA-2003:794] Conectiva Security Announcement - rsync (Conectiva Updates <secure@...ectiva.com.br>)
• [RHSA-2003:398-01] New rsync packages fix remote security vulnerability (bugzilla@...hat.com)
• Re: [ANNOUNCE] glibc heap protection patch (Jim Knoble <jmknoble@...ox.com>)

• [iSEC] Linux kernel do_brk() vulnerability details (Paul Starzetz <paul@...c.pl>)
• Re: RE: Yahoo Instant Messenger YAUTO.DLL buffer overflow ("Tri Huynh" <trihuynh@...up.com>)
• MDKSA-2003:111 - Updated rsync packages fix heap overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Hot fix for do_brk bug (canon@...sc.gov)
• Re: Websense Blocked Sites XSS (3APA3A <3APA3A@...URITY.NNOV.RU>)
• netscreen flaw? (tito <mochafrap@....ph>)
• Problem with Appleshare IP FTP server (Spencer Clark <spengy@...ng.sytes.net>)
• SRT2003-12-04-0723 - PLDaniels Ebola remote overflow (KF <dotslash@...soft.com>)
• [Fwd: Security Alert; possible buffer overflow in all Mathopd versions] (Gregor Lawatscheck <gpel@...x.net>)
• Cross Site Scripting in VP-ASP (Xnuxer Research Laboratory <xnuxer@...ux.net>)
• Re: Linksys WRT54G Denial of Service Vulnerability (Eerik.Kiskonen@...tronics.fi)
• Jason Maloney's Guestbook XSS Vulnerability. (Shaun Colley <shaunige@...oo.co.uk>)
• Re: Intresting case of SQL Injection (Markus Fischer <mfischer@...t.josefine.at>)
• Intresting case of SQL Injection (Sys Sec <syssec@...igsa.com>)
• Re: Altova XMLSpy "phones home" user data (Alexander Falk <al@...ova.com>)
• Yahoo Messenger Flaw allows injection of JavaScript into IM Windows (Chet Simpson <secure@...nnelpro.com>)
• RE: Intresting case of SQL Injection ("Scovetta, Michael V" <Michael.Scovetta@...com>)
• [CLA-2003:796] Conectiva Security Announcement - kernel (Conectiva Updates <secure@...ectiva.com.br>)
• Re: Apple Safari 1.1 (v100) (Mary Carol Scherb <mcsjgs@....net>)
• RE: Websense Blocked Sites XSS (Greg Meehan <GMeehan@...eTimeFitness.com>)
• Re: Intresting case of SQL Injection (Florian Weimer <fw@...eb.enyo.de>)
• Re: netscreen flaw? (Bryan Burns <bburns@...screen.com>)
• Re: Hot fix for do_brk bug (Goetz Babin-Ebell <babin-ebell@...stcenter.de>)
• RE: Websense Blocked Sites XSS ("Hubbard, Dan" <dhubbard@...sense.com>)
• RE: Websense Blocked Sites XSS ("Mr. P.Taylor" <petert@...gine-sw.com>)
• RE: Websense Blocked Sites XSS ("Mr. P.Taylor" <petert@...gine-sw.com>)
• Re: Hot fix for do_brk bug (Gunnar Wolf <gwolf@...lf.cx>)
• Re: Intresting case of SQL Injection (Nick FitzGerald <nick@...us-l.demon.co.uk>)

• rpc.mountd Vulnerabilities update on IRIX (SGI Security Coordinator <agent99@....com>)

• eZ Multiple Packages Stack Overflow Vulnerability ("Peter Winter-Smith" <peter4020@...mail.com>)
• Immunix Secured OS 7.3, 7+ rsync update (Immunix Security Team <security@...unix.com>)
• rpc.mountd Vulnerabilities update on IRIX ("SGI Security Coordinator" <agent99@....com>)
• Re: Hot fix for do_brk bug (Pavel harry_x Palát <harry_x@...ylon5.cz>)
• cdwrite 1.3 insecure tmp file handling vulnerability. (Shaun Colley <shaunige@...oo.co.uk>)
• Patchmanagement.org announcement (Adam Shostack <adam@...eport.org>)
• FAT32 directory auth bypass on Linux Abyssws < 1.2 (Luigi Auriemma <aluigi@...ervista.org>)
• Land Down Under 601 (<gdayworld@...mail.com>)
• Re: [Fwd: Security Alert; possible buffer overflow in all Mathopd versions] (Peter Geissler <blasty@...kz.nl>)
• [SCSA-022] Multiple vulnerabilities in Xoops ("Security Corporation Security Advisory" <advisory@...urity-corporation.com>)
• Re: Websense Blocked Sites XSS ("Eric \"MightyE\" Stevens" <trash@...htye.org>)
• Dell BIOS DoS (James Evans <jae7@...igh.edu>)

• @Mail web interface multiple security vulnerabilities (S-Quadra Security Research <research@...uadra.com>)
• MDKSA-2003:112 - Updated cvs packages fix malformed module request vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• MDKSA-2003:113 - Updated screen packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Re: Dell BIOS DoS (jon schatz <jon@...isionbyzero.com>)
• Internet Explorer URL parsing vulnerability (<bugtraq@...thedingbat.com>)
• BNCweb File Disclosure Vulnerability (Matthias Bethke <matthias.bethke@....net>)
• Is this the first case of a Distributed Denial of Physical Service? (<tonyl@....ltd.uk>)
• Multiple Vendor SOAP server (XML parser) attribute blowup DoS (Amit Klein <Amit.Klein@...ctumInc.com>)
• ebola 0.1.4 remote exploit ("c0wboy@...33" <c0wboy@...cali.it>)
• Re: Is this the first case of a Distributed Denial of Physical Service? (Nick Johnson <arachnid@...dot.net>)
• [CLA-2003:798] Conectiva Security Announcement - gnupg (Conectiva Updates <secure@...ectiva.com.br>)
• Re: Dell BIOS DoS ("Steve Shockley" <steve.shockley@...ckley.net>)
• Re: Internet Explorer URL parsing vulnerability (<soulshok@...pie.dk>)
• RE: Dell BIOS DoS (David Brodbeck <DavidB@...l.interclean.com>)
• Internet Explorer URL parsing vulnerability ("John W. Noerenberg II" <jwn2@...lcomm.com>)
• Re: Hot fix for do_brk bug (Mariusz Woloszyn <emsi@...rtners.pl>)

• RE: Internet Explorer URL parsing vulnerability ("http-equiv@...ite.com" <1@...ware.com>)
• Re: Hot fix for do_brk bug (canon@...sc.gov)
• Dell BIOS DoS ("Ross Draper" <Ross.Draper@...icradio.com>)
• Re: Dell BIOS DoS (Craig Paterson <craigp@...pett.com>)
• Re: ebola 0.1.4 remote exploit (Paul L Daniels <pldaniels@...aniels.com>)
• Re: Internet Explorer URL parsing vulnerability ("Eric \"MightyE\" Stevens" <trash@...htye.org>)
• RE: Internet Explorer URL parsing vulnerability ("http-equiv@...ite.com" <1@...ware.com>)
• Re: Dell BIOS DoS (Alexandros Papadopoulos <apapadop@....edu>)
• Re: Multiple Vendor SOAP server (XML parser) attribute blowup DoS (Marc Schoenefeld <schonef@...-muenster.de>)
• Re: Yahoo Instant Messenger YAUTO.DLL buffer overflow (Marc Bejarano <bugtraq-post@...j.org>)
• Multiple Vulnerabilities Sybase Anywhere 9 ("Next Generation Insight Security Research (NGS Software)" <mark@...software.com>)
• Cisco Security Advisory: Vulnerability in Authentication Library for ACNS (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Cisco Security Advisory: Unity Vulnerabilities on IBM-based Servers (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Visitorbook LE Multiple Vulnerabilities (Paul Johnston <paul@...tpoint.ltd.uk>)
• Re: Dell BIOS DoS (der Mouse <mouse@...ents.Montreal.QC.CA>)
• Re: Internet Explorer URL parsing vulnerability (Nick FitzGerald <nick@...us-l.demon.co.uk>)
• SGI Advanced Linux Environment security update #6 (SGI Security Coordinator <agent99@....com>)
• RE: Dell BIOS DoS ("Lyal Collins" <lyalc@...mail.com.au>)
• NetGear WAB102 ("Jon Kamm @hotmail" <jonkamm@...mail.com>)
• Re: Dell BIOS DoS (Jim Paris <jim@...n.com>)
• Re: Dell BIOS DoS (Eric Anderson <anderson@...uoregon.edu>)
• Mobile Device Security, Was: Re: Dell BIOS DoS ("Karsten W. Rohrbach" <karsten@...rbach.de>)
• Re: Internet Explorer URL parsing vulnerability (Pedro Castro <noupy@...l.telepac.pt>)
• Re: Dell BIOS DoS (Seth Arnold <sarnold@...ex.com>)

• A new TCP/IP blind data injection technique? (Michal Zalewski <lcamtuf@...ttot.org>)
• MDKSA-2003:114 - Updated ethereal packages fix multiple remotely exploitable vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Flashget 0.9 - 1.2 Local DialUp Password Hi-Jacking ("Rafel Ivgi" <nuritrv18@...eqint.net>)
• MDKSA-2003:112-1 - Updated cvs packages fix malformed module request vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• [SCSA-023] Multiple vulnerabilities in Mambo Server ("Security Corporation Security Advisory" <advisory@...urity-corporation.com>)
• GeoHttpServer[webcam] Causes MFC42.DLL to overflow ("Rafel Ivgi" <nuritrv18@...eqint.net>)
• RE: Internet Explorer URL parsing vulnerability (Lance James <lance.james@...bone.com>)
• Mambo Open Source 4.0.14 SQL injection (Chintan Trivedi <chesschintan@...mail.com>)
• Re: Internet Explorer URL parsing vulnerability (William Stockall <wstockal@...pusmart.ab.ca>)
• Re: Internet Explorer URL parsing vulnerability (Andreas Plesner Jacobsen <apj@...t.dk>)
• Re: Internet Explorer URL parsing vulnerability (Tiago Pierezan Camargo <tiago@...enova.net>)
• Re: Multiple Vendor SOAP server (XML parser) attribute blowup DoS (Amit Klein <Amit.Klein@...ctumInc.com>)
• Re: A new TCP/IP blind data injection technique? (Kris Kennaway <kris@...eBSD.ORG>)
• [RHSA-2003:390-01] Updated gnupg packages disable ElGamal keys (bugzilla@...hat.com)
• Re: A new TCP/IP blind data injection technique? (Shachar Shemesh <fulldisc@....consumer.org.il>)
• Re: A new TCP/IP blind data injection technique? (Shachar Shemesh <fulldisc@....consumer.org.il>)
• Re: A new TCP/IP blind data injection technique? (Michal Zalewski <lcamtuf@...ttot.org>)
• [CORE-2003-12-05] DCE RPC Vulnerabilities New Attack Vectors Analysis (Core Security Technologies <advisories@...esecurity.com>)
• Re: A new TCP/IP blind data injection technique? (Nick Cleaton <nick@...aton.net>)
• Re: Dell BIOS DoS ("Thor" <thor@...merofgod.com>)
• irssi - potential remote crash (Timo Sirainen <tss@....fi>)
• Re: Internet Explorer URL parsing vulnerability (Charles Richmond <cmr@...c.com>)
• Re: NetGear WAB102 ("bg1337" <bg1337@....net>)
• A .NET class bug that can hang a machine instantly (Walt Smith <walt@...tiva.com>)
• Finjan Software Discovers a New Critical Vulnerability In Yahoo E-mail Service (Dror Shalev <drorshalev@...jan.com>)
• GLSA: cvs (200312-04) (Rajiv Aaron Manglani <rajiv@...too.org>)
• RE: A new TCP/IP blind data injection technique? ("David Gillett" <gillettdavid@...a.edu>)
• Cyclonic Webmail 4 multiple vulnerabilities ("Somers Raf" <raf.Somers@...dora.be>)
• Remotely Anywhere Message Injection Vulnerability ("Oliver Karow" <Oliver.Karow@....de>)
• RE: Internet Explorer URL parsing vulnerability ("Mimmus" <dviggiani@...cali.it>)
• Re: A new TCP/IP blind data injection technique? (Valdis.Kletnieks@...edu)
• Re: A new TCP/IP blind data injection technique? (Casper Dik <casper@...land.sun.com>)
• Re: A new TCP/IP blind data injection technique? (Valdis.Kletnieks@...edu)
• RE: A new TCP/IP blind data injection technique? (Michael Wojcik <Michael.Wojcik@...rofocus.com>)
• Multiple vendor SOAP server (XML parser) denial of service (DTD parameter entities) (Amit Klein <Amit.Klein@...ctumInc.com>)
• eZ and eZphotoshare fixes ("Peter Winter-Smith" <peter4020@...mail.com>)

• Re: A new TCP/IP blind data injection technique? (Michal Zalewski <lcamtuf@...ttot.org>)
• Advisory: Dark Age of Camelot - Weak encryption of network traffic exposed personal information. (Todd Chapman <tchapman@...ninedev.com>)
• Secunia Advisory: URL Spoofing ("http-equiv@...ite.com" <1@...ware.com>)
• GLSA: gnupg (200312-05) (Rajiv Aaron Manglani <rajiv@...too.org>)
• Re: A new TCP/IP blind data injection technique? (stanislav shalunov <shalunov@...ernet2.edu>)
• [slackware-security] cvs security update (SSA:2003-345-01) (Slackware Security Team <security@...ckware.com>)
• Multiple vulnerabilites in vendor IKE implementations, including Cisco, (Thor Lancelot Simon <tls@....tjls.com>)
• PGP secret keys (was Re: Dell BIOS DoS) (Matthew Wakeling <mnw21-bugtraq@...pleads.com>)
• Re: A .NET class bug that can hang a machine instantly (Mickey Williams <miwilliams2@....com>)
• MDKSA-2003:115 - Updated net-snmp packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Re: A new TCP/IP blind data injection technique? (Michal Zalewski <lcamtuf@...ttot.org>)
• Re: Secunia Advisory: URL Spoofing (Thomas Kristensen <tk@...unia.com>)
• Re: A new TCP/IP blind data injection technique? (Barney Wolff <barney@...abus.com>)
• [slackware-security] lftp security update (SSA:2003-346-01) (Slackware Security Team <security@...ckware.com>)
• Re: Insecure IKE Implementations Clarification (Thor Lancelot Simon <tls@....tjls.com>)
• Re: A new TCP/IP blind data injection technique? (Stephen Frost <sfrost@...wman.net>)
• Re: A new TCP/IP blind data injection technique? (Jeff Kell <jeff-kell@....edu>)

• UPDATED UnixWare 7.1.1 : Bind: cache poisoning BIND 8 prior to 8.3.7 and BIND 8.4.x prior 8.4.2 (security@....com)
• Re: Insecure IKE Implementations Clarification (Florian Weimer <fw@...eb.enyo.de>)
• SSH vs. IKE trust models (was Re: Insecure IKE Implementations Clarification) (Thor Lancelot Simon <tls@....tjls.com>)
• Re: Insecure IKE Implementations Clarification (Thor Lancelot Simon <tls@....tjls.com>)
• Re: Insecure IKE Implementations Clarification (Florian Weimer <fw@...eb.enyo.de>)
• Re: Multiple vulnerabilites in vendor IKE implementations, including Cisco, (Thor Lancelot Simon <tls@....tjls.com>)
• Re: Insecure IKE Implementations Clarification (Thor Lancelot Simon <tls@....tjls.com>)
• Re: Insecure IKE Implementations Clarification (Florian Weimer <fw@...eb.enyo.de>)
• Re: SSH vs. IKE trust models (was Re: Insecure IKE Implementations Clarification) (Florian Weimer <fw@...eb.enyo.de>)
• Re: Multiple vulnerabilites in vendor IKE implementations, including Cisco, (Sharad Ahlawat <sha@...co.com>)
• Re: Multiple vulnerabilites in vendor IKE implementations, including Cisco, (Thor Lancelot Simon <tls@....tjls.com>)
• Advisory: Dark Age of Camelot - Weak encryption of network traffic exposed personal information. (Todd Chapman <tchapman@...ninedev.com>)
• Several Things about IE bugs (Liu Die Yu <liudieyuinchina@...oo.com.cn>)
• Re: Insecure IKE Implementations Clarification (itojun@...jun.org (Jun-ichiro itojun Hagino))
• Re: A .NET class bug that can hang a machine instantly (David Greenaway <bt2134231@...idgreenaway.com>)
• Re[2]: A new TCP/IP blind data injection technique? (Marius Huse Jacobsen <mahuja@....net>)

• Breaking the checksum (a new TCP/IP blind data injection technique) (Michal Zalewski <lcamtuf@...ttot.org>)
• lftp buffer overflows (Härnhammar, Ulf <Ulf.Harnhammar.9485@...dent.uu.se>)

• Re: Several Things about IE bugs ("http-equiv@...ite.com" <1@...ware.com>)
• SUSE Security Announcement: lftp (SuSE-SA:2003:051) (thomas@...e.de (Thomas Biege))
• Cisco Security Advisory: Cisco PIX Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Cisco Security Advisory: Cisco FWSM Vulnerabilities (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
• Cyrus IMSP remote root vulnerability (Felix Lindner <felix.lindner@...ns.com>)
• DameWare Mini Remote Control Server <= 3.72 Buffer Overflow ("wirepair" <wirepair@...uemail.net>)
• GLSA: Malformed dcc send requests in xchat-2.0.6 lead to a denial of service (Kurt Lieber <klieber@...too.org>)
• Buffer overflow/privilege escalation in MacOS X (Max <rusmir@...a.net>)
• RE: SQL Injection Vuln In osCommerce 2.2-MS1 (JeiAr <security@...ftech.org>)
• Re: SSH vs. IKE trust models (was Re: Insecure IKE Implementations Clarification) (Jimi Thompson <jimit@...ealbox.com>)
• re: Breaking the checksum (a new TCP/IP blind data injection technique) (anon <anonpoet@...onnu.isu.edu>)
• Issues In CGINews and CGIForum (JeiAr <security@...ftech.org>)
• Get admin rights using Doro (pdf creator) (Ramon Kukla <ml@...tsonline.net>)
• osCommerce 2.2-MS1 SQL Injection Vulnerability (JeiAr <security@...ftech.org>)
• re:Breaking the checksum (a new TCP/IP blind data injection technique (Michal Zalewski <lcamtuf@...ttot.org>)

• [RHSA-2003:403-01] Updated lftp packages fix security vulnerability (bugzilla@...hat.com)
• Invision Power Top Site List SQL Inection (JeiAr <security@...ftech.org>)
• MDKSA-2003:116 - Updated lftp packages fix buffer overflow vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Re: Buffer overflow/privilege escalation in MacOS X (Dave G. <daveg@...take.com>)
• Invision Power Board SQL Injection Vuln [ All Versions ] (JeiAr <security@...ftech.org>)
• Self-signed certs unrestricted in Windows XP (Andrew Daviel <advax@...umf.ca>)
• Multiple DUWare Product Vulnerabilities (JeiAr <security@...ftech.org>)
• Re: Buffer overflow/privilege escalation in MacOS X (Seth Arnold <sarnold@...ex.com>)
• J2EE 1.4 reference implementation: database component allows remote code execution (Marc Schoenefeld <schonef@...-muenster.de>)
• Re: Buffer overflow/privilege escalation in MacOS X (Max <rusmir@...a.net>)
• Microsoft's plans for making XP more secure ("Richard M. Smith" <rms@...puterbytesman.com>)
• Aardvark Topsites 4.1.0 Vulnerabilities (JeiAr <security@...ftech.org>)
• Re: Buffer overflow/privilege escalation in MacOS X (Mariusz Woloszyn <emsi@...rtners.pl>)
• [RHSA-2003:320-01] Updated httpd packages fix Apache security vulnerabilities (bugzilla@...hat.com)
• ms03-043 (MrNice MrNice <balzen81@...mail.com>)
• Re: Self-signed certs unrestricted in Windows XP ("Kurt Seifried" <bt@...fried.org>)
• RE: Self-signed certs unrestricted in Windows XP ("Menashe Eliezer" <menashe@...jan.com>)
• Re:Re: SQL Injection Vuln In osCommerce 2.2-MS1 (JeiAr <security@...ftech.org>)

• Server side scripts viewing in Goahead webserver <= 2.1.7 (Luigi Auriemma <aluigi@...ervista.org>)
• [OpenPKG-SA-2003.053] OpenPKG Security Advisory (lftp) (OpenPKG <openpkg@...npkg.org>)
• [OpenPKG-SA-2003.052] OpenPKG Security Advisory (cvs) (OpenPKG <openpkg@...npkg.org>)
• eZ remote exploit (Iván Rodriguez Almuiña <kralor@...omputer.net>)
• WebArtFactory CMS Vulnerability (Noticias <noticias@...entechsecurity.com>)
• Re: Internet Explorer and Opera local zone restriction bypass (william schulze <was@...romedia.com>)
• Edonkey/Overnet Plugins capable of Virus/Worm behavior (Julian Ashton <ashton@...tmedia.com>)
• Re: ms03-043 ("Michael H. Warfield" <mhw@...tsend.com>)
• osCommerce Malformed Session ID XSS Vuln (JeiAr <security@...ftech.org>)
• NetBSD Security Advisory 2003-018: DNS negative cache poisoning (NetBSD Security Officer <security-officer@...BSD.org>)
• Cross-site scripting vulnerability in SARA v<=4.2.7 ("Thomas M. Payerle" <payerle@...sics.umd.edu>)

• Re: Edonkey/Overnet Plugins capable of Virus/Worm behavior (Eric Anderson <anderson@...uoregon.edu>)
• SGI Advanced Linux Environment security update #7 (SGI Security Coordinator <agent99@....com>)
• [RHSA-2003:405-01] Updated apache packages fix minor security vulnerability (bugzilla@...hat.com)
• GLSA: lftp (200312-07) (Rajiv Aaron Manglani <rajiv@...too.org>)
• CyberGuard proxy / firewall XSS (Jamie Fisher <contact_jamie_fisher@...oo.co.uk>)
• Happy Holidays ("Mark Litchfield" <mark@...software.com>)
• MDKSA-2003:117 - Updated irssi packages fix remote crash (Mandrake Linux Security Team <security@...ux-mandrake.com>)
• Re: Buffer overflow/privilege escalation in MacOS X (David Riley <oscar@...-rileys.net>)
• Re: Cross-site scripting vulnerability in SARA v<=4.2.7 (<toddr@....com>)
• RE: Edonkey/Overnet Plugins capable of Virus/Worm behavior ("ashton" <ashton@...tmedia.com>)
• Re: Edonkey/Overnet Plugins capable of Virus/Worm behavior (Julian Ashton <ashton@...tmedia.com>)
• Re: Edonkey/Overnet Plugins capable of Virus/Worm behavior (Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>)
• SARA 5.0 (<toddr@....com>)
• Multiple Vulnerabilities In ASPapp Products (JeiAr <security@...ftech.org>)
• Autorank PHP SQL Injection Vulnerabilities (JeiAr <security@...ftech.org>)
• RE: Edonkey/Overnet Plugins capable of Virus/Worm behavior ("Max" <max@...andcarrie.com>)
• Re: Edonkey/Overnet Plugins capable of Virus/Worm behavior (Alexander Demenshin <aldem-bugtraq@...em.net>)
• RE: Edonkey/Overnet Plugins capable of Virus/Worm behavior (<Aaron_Yemm@....com>)
• RE: Edonkey/Overnet Plugins capable of Virus/Worm behavior ("ashton" <ashton@...tmedia.com>)

• [Exploit]: DameWare Mini Remote Control Server Overflow Exploit (Adik <netninja@...mail.kg>)
• Subscribe Me Pro/Enterprise - Remote Code Execution via Backticked Perl Variable Injection. ("Paul Craig - Pimp Industries" <headpimp@...p-industries.com>)
• Re: Cross-site scripting vulnerability in SARA v<=4.2.7 (bugtraq@...ntcorporation.com)
• Re: Multiple vulnerabilites in vendor IKE implementations, including Cisco, (Chris <serlin@...soc.org>)
• Re: Multiple vulnerabilites in vendor IKE implementations, including Cisco, (Sharad Ahlawat <sha@...co.com>)
• RE: Edonkey/Overnet Plugins capable of Virus/Worm behavior ("ashton" <ashton@...tmedia.com>)
• Re: Edonkey/Overnet Plugins capable of Virus/Worm behavior (<nagual@...email.ch>)
• Security bug in Xerox Document Centre ("J.A. Gutierrez" <spd@...va.cps.unizar.es>)
• AOL Instant Messanger - Buddy Icon Warn Exploit (Josh Camacho <sfocus@...omus.com>)
• Re: Edonkey/Overnet Plugins capable of Virus/Worm behavior ("Eric \"MightyE\" Stevens" <trash@...htye.org>)
• Re: Buffer overflow/privilege escalation in MacOS X - hfs.util also (KF <dotslash@...soft.com>)
• Directory traversal and XSS in Active Webcam <= 4.3 (Luigi Auriemma <aluigi@...ervista.org>)
• RE: Edonkey/Overnet Plugins capable of Virus/Worm behavior ("Andre Lorbach" <alorbach@....adiscon.com>)
• MDKSA-2003:118 - Updated XFree86 packages fix xdm vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)

• RE: [Exploit]: DameWare Mini Remote Control Server Overflow Exploit ("Kevin Mitnick" <kmitnick@...thi.com>)
• Re: [Exploit]: DameWare Mini Remote Control Server Overflow Exploit (Jelmer <jkuperus@...net.nl>)
• RE: [Exploit]: DameWare Mini Remote Control Server Overflow Exploit ("Kevin Mitnick" <kmitnick@...thi.com>)
• Re: [Exploit]: DameWare Mini Remote Control Server Overflow Exploit (Jelmer <jkuperus@...net.nl>)
• [Exploit]: DameWare Mini Remote Control Server Overflow Exploit (stripped) (Adik <netninja@...mail.kg>)
• DameWare Mini Remote Control < v3.73 remote exploit by kralor (Iván Rodriguez Almuiña <kralor@...omputer.net>)
• Remote crash in tcpdump from OpenBSD (Przemyslaw Frasunek <venglin@...ebsd.lublin.pl>)
• Re: Security bug in Xerox Document Centre (brandon pierce <brandonp@...ynclh.com>)
• Multicast from Orinoco wireless stations (Andrew Daviel <advax@...umf.ca>)
• Re: Remote crash in tcpdump from OpenBSD (Henning Brauer <hb-bugtraq@...s.de>)
• [SCSA-024] BES-CMS including file vulnerability ("Security Corporation Security Advisory" <advisory@...urity-corporation.com>)

• Re: Remote crash in tcpdump from OpenBSD (Przemyslaw Frasunek <venglin@...ebsd.lublin.pl>)
• phpBB v2.06 search_id sql injection exploit ("f3sy1 f3sy1" <f3sy1@...l.ru>)
• PHP-NUKE version <= 6.9 'cid' sql injection exploit (r00t@...eam.ru)

• ProjectForum Multiple Vulnerabilities ("Peter Winter-Smith" <peter4020@...mail.com>)
• Internet Explorer file downloading security alerts bypass (Hugo "V�zquez" "Caram�s" <overclocking_a_la_abuela@...mail.com>)
• XSS vulnerability in XOOPS 2.0.5.1 (Chintan Trivedi <chesschintan@...mail.com>)
• osCommerce SQL Injection && DoS && Cross Site Scripting (JeiAr <security@...ftech.org>)

• An undetectable Online Bank Vulnerability? (Mark Peterson <apalamen@...global.net>)
• CesarFTP v0.99g CPU OverLoad [Proof of concept] (zib zib <zibelette@....com>)
• Re: Remote crash in tcpdump from OpenBSD (<mrh_tech@...oo.com>)
• Directory traversal bug in DCAM server <= 8.2.5 (Luigi Auriemma <aluigi@...ervista.org>)
• Re: Internet Explorer URL parsing vulnerability ("nesumin" <nesumin@...thome.net>)
• [Opera 7] Arbitrary File Delete Vulnerability (":: Operash ::" <nesumin@...thome.net>)
• Re: phpBB v2.06 search_id sql injection exploit (Micheal Cottingham <micheal@...healcottingham.com>)
• QuikStore Shopping Cart Discloses Installation Path & Files to Remote Users ("Dr`Ponidi Haryanto" <drponidi@...kermail.com>)

• Winnie The Pooh Hacking Squadron Presents: 0day 31337 vulnerability in indent 2.2.9 ("Winnie The Pooh Hacking Squadron" <wtphs@...h.com>)
• Re: Reported Command Injection in Squirrelmail GPG ("Brian G. Peterson" <brian@...verock.com>)
• Re: An undetectable Online Bank Vulnerability? (Seth Arnold <sarnold@...ex.com>)
• Multiple Vulns in Psychoblogger beta1 (Andrew Smith <parenthesis@...tehaven.net>)
• Remote Code Execution in Knowledge Builder. (Zero_X www.lobnan.de Team <zero-x@...uxmail.org>)
• IE 5.22 on Mac Transmitting HTTP Referer from Secure Page (<deane@...nebarker.net>)
• OpenBB 1.06 SQL Injection (n.teusink@...net.nl)
• Bugtraq Security Systems ADV-0001 (Bugtraq Security Systems <research@...traq.org>)
• DANGER ZONE: Internet Explorer ("http-equiv@...ite.com" <1@...ware.com>)
• directory traversal bug in Pserv 3.0b2 (Donato Ferrante <fdonato@...istici.org>)
• New VISA scam exploits IE vulnerability (Marek Szuba <cyberman@...pw.edu.pl>)
• Hijacking Apache https by mod_php (Steve Grubb <linux_4ever@...oo.com>)

• PHP-NUKE 7.0 FINAL (and olders) sql injection (r00t@...eam.ru)
• Landesk Management Suite IRCRBOOT.DLL buffer overflow ("Tri Huynh" <trihuynh@...up.com>)

• php-ping: Executing arbritary commands (ppp-design <security@...-design.de>)
• RE: DANGER ZONE: Internet Explorer (<tlarholm@...x.com>)
• GLSA: cvs (200312-08) (Rajiv Aaron Manglani <rajiv@...too.org>)
• SQL Injection in phpBB's groupcp.php (Jay Gates <zarath@...ghtsofchaos.com>)
• [Hat-Squad] Remote buffer overflow in Mdaemon Raw message Handler (Hat-Squad Security Team <service@...-squad.com>)
• Buffer-overflow in Jordan's telnet server (Luigi Auriemma <aluigi@...ervista.org>)
• RE: DANGER ZONE: Internet Explorer ("http-equiv@...ite.com" <1@...ware.com>)
• Cross Site Scripting vulnerability in miniBB 1.7 (latest) and earlier (Chintan Trivedi <chesschintan@...mail.com>)

• NetObserve Security Bypass Vulnerability ("Peter Winter-Smith" <peter4020@...mail.com>)
• Re: php-ping: Executing arbritary commands (ppp-design <security@...-design.de>)
• Gallery v1.3.3 Cross Site Scripting Vulnerabillity ("The-Insider" <nuritrv18@...eqint.net>)
• IE 5.x-6.0 allows executing arbitrary programs using showHelp() (Arman Nayyeri <arman-n@...eaker.net>)
• [SECURITY] [DSA 405-1] New xsok packages fix local group games exploit (joey@...odrom.org (Martin Schulze))
• RE: php-ping: Executing arbritary commands ("Golden_Eternity" <bugtraq@...disoft.com>)
• RE: IE 5.22 on Mac Transmitting HTTP Referer from Secure Page (<tlarholm@...x.com>)
• TOCTOU with NT System Service Hooking (Andrey Kolishak <andr@...dy.ru>)
• Re: Gallery v1.3.3 Cross Site Scripting Vulnerabillity ("Bharat Mediratta" <bharat@...alto.com>)

• Local Denial Of Service Attack Against Apple MacOS X, MacOS X Server, and Darwin. (Matt Burnett <marukka@....com>)
• Re: NetObserve Security Bypass Vulnerability ("Peter Winter-Smith" <peter4020@...mail.com>)
• RE: Winnie The Pooh Hacking Squadron Presents: 0day 31337 vulnerability in indent 2.2.9 (<kindergarten@...h.com>)
• Re: Local Denial Of Service Attack Against Apple MacOS X, MacOS X Server, and Darwin. ("William A. Carrel" <william.a@...rel.org>)

373 messages

Powered by blists - more mailing lists