bugtraq mailing list - 2004/10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2004/10

Mon	Tue	Wed	Thu	Fri	Sat	Sun
				¹ 18	² 12	³ 3
⁴ 6	⁵ 13	⁶ 17	⁷ 16	⁸ 9	⁹ 2	¹⁰ 1
¹¹ 6	¹² 14	¹³ 17	¹⁴ 26	¹⁵ 21	¹⁶ 7	¹⁷ 1
¹⁸ 24	¹⁹ 16	²⁰ 11	²¹ 12	²² 21	²³ 17	²⁴ 2
²⁵ 7	²⁶ 20	²⁷ 21	²⁸ 19	²⁹ 17	³⁰ 17	³¹

Messages by day:

October 1 (18 messages)

Re:[4] Corsaire Security Advisory - Multiple vendor MIME RFC2047 encoding issue ("advisories" <advisories@...saire.com>)
iDEFENSE Security Advisory 09.30.04 - Samba Arbitrary File Access Vulnerability ("customer service mailbox" <customerservice@...fense.com>)
RE: Diebold Global Election Management System (GEMS) Backdoor ("Geoff Vass" <geoff@...zow.com.au>)
iDEFENSE Security Advisory 09.29.04 - Macromedia JRun 4 mod_jrun Apache Module Buffer Overflow Vulnerability ("customer service mailbox" <customerservice@...fen…)
Re: Diebold Global Election Management System (GEMS) Backdoor Account Allows Authenticated Users to Modify Votes (Chris Paget <ivegotta@...bom.co.uk>)
RE: Promiscuous email printing in Canon imageRunner ("Jeff Bates" <JJB@...use.org>)
CFMX vulnerability (Eric Lackey <eric.lackey@...il.com>)
RE: Diebold Global Election Management System (GEMS) Backdoor ("David Schwartz" <davids@...master.com>)
[SECURITY] [DSA 553-1] New getmail packages fix root compromise (joey@...odrom.org (Martin Schulze))
Re: Diebold Global Election Management System (GEMS) Backdoor Acc ount Allows Authenticated Users to Modify Votes (Shawn McMahon <smcmahon@....com>)
TSLSA-2004-0051 - samba (Trustix Security Advisor <tsl@...stix.org>)
Multiple Vulnerabilities in AJ-Fork (Ahmad Muammar <y3dips@...o.or.id>)
SQL Injection vulnerability in bBlog 0.7.3 (James McGlinn <james@...vers.co.nz>)
EEYE: RealPlayer pnen3260.dll Heap Overflow ("Marc Maiffret" <mmaiffret@...e.com>)
Broadcast buffer-overflow in Vypress Messenger 3.5.1 (Luigi Auriemma <aluigi@...istici.org>)
Re: Possible GDI Exploit Vector (Babar Shafiq Nazmi <babarnazmi@...il.com>)
Re: cdrecord local root exploit ("Greg A. Woods" <woods@...nix.com>)
Re: cdrdao local root exploit (newbug Tseng <newbug@...oot.org>)

October 2 (12 messages)

MDKSA-2004:104 - Updated samba packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Oracle 9i Union Flaw (Brandon Petty <bmpfg8@....edu>)
Re: Oracle 9i Union Flaw (Brandon Petty <bmpfg8@....edu>)
Re: Promiscuous email printing in Canon imageRunner (Marco Ivaldi <raptor@...eadbeef.info>)
On Polymorphic Evasion ("Phantasmal Phantasmagoria" <phantasmal@...h.ai>)
Re: cdrecord local root exploit ("Jason T. Miller" <jasomill@...oneview.com>)
dbPowerAmp Buffer Overflow And Dos Vulnerabilities ("GulfTech Security" <security@...ftech.org>)
[FLSA-2004:1733] Updated squirrelmail resolves security vulnerabilities (fedora-legacy-announce@...hat.com)
Security advisory - Xerces-C++ 2.5.0: Attribute blowup ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
In-game format string in Judge Dredd vs. Death 1.01 (Luigi Auriemma <aluigi@...istici.org>)
Re:2. Code execution in Icecast 2.0.1(exploit with shellcode) (me@...ikon.de)
Re: cdrecord local root exploit (Solar Designer <solar@...nwall.com>)

October 3 (3 messages)

Re: On Polymorphic Evasion (Vlad902 <vlad902@...il.com>)
[FLSA-2004:1372] Updated sysstat packages fix security vulnerabilities (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2004:1325] Updated mod_python packages fix security vulnerability (Dominic Hargreaves <dom@...th.li>)

October 4 (6 messages)

[FLSA-2004:1324] Updated libxml2 resolves security vulnerability (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
Re: Oracle 9i Union Flaw ("Peter J. Holzer" <hjp@....ac.at>)
[SECURITY] [DSA 556-1] New netkit-telnet packages fix invalid free (Matt Zimmerman <mdz@...ian.org>)
Buffer Overflow in Spider game (Security Team <security@...admin.com>)
[LoWNOISE] IPSWITCH WhatsUp Gold 8.03 Remote fr33 exploit (ET LoWNOISE <et@...erspace.org>)
[SECURITY] [DSA 557-1] New rp-pppoe packages fix potential root compromise (joey@...odrom.org (Martin Schulze))

October 5 (13 messages)

FreeBSD Security Advisory FreeBSD-SA-04:15.syscons (FreeBSD Security Advisories <security-advisories@...ebsd.org>)
Full path disclosure in PHP Links (Nikyt0x Argentina <nikyt0x@...mail.com>)
RE: On Polymorphic Evasion (an alphanumeric version) ("m conover" <mconover_001@...mail.com>)
Re: Buffer Overflow in Spider game (Steve Kemp <steve@...ve.org.uk>)
Patch available for critical IBM DB2 Universal Database flaws ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
[security bulletin]SSRT4826 rev.0 Mozilla Application Suite for HP Tru64 UNIX Multiple Potential Security Vulnerabilitie… ("Boren, Rich (SSRT)" <rich.boren@...com…)
SUSE Security Announcement: samba (SUSE-SA:2004:035) (Thomas Biege <thomas@...e.de>)
Patch available for critical IBM DB2 Universal Database flaws ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Re: EEYE: RealPlayer pnen3260.dll Heap Overflow (Chenghuai Lu <luchenghuai@...oo.com>)
[MAXPATROL Security Advisories] Cross site scripting in Invision Power Board ("Alexander Antipov" <Antipov@...urityLab.ru>)
Antivirus, Trojan, Spy ware scanner, Nested file manual scan bypass bug (Bipin Gautam <visitbipin@...mail.com>)
Test your windows OS ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
Re: Full path disclosure in PHP Links ("Scott T. Cameron" <karn@...tehero.com>)

October 6 (17 messages)

ERRATA: Potential Arbitrary File Access (CAN-2004-0815) ("Gerald (Jerry) Carter" <jerry@...ba.org>)
Re: Buffer Overflow in Spider game (van Helsing <vh@...ith.net>)
Re: Full path disclosure in PHP Links - more (LSS Security <exposed@....hr>)
Re: iDEFENSE Security Advisory 10.05.04b: Symantec Norton AntiVirus Reserved Device Name Handling Vulnerability (3APA3A <3APA3A@...URITY.NNOV.RU>)
Full path disclosure and sql injection on CubeCart 2.0.1 (Pedro Sanches <pedro_sanches@...o.pt>)
[Maxpatrol Security Advisory] Multiple vulnerabilities in DCP-Portal ("Alexander Antipov" <antipov@...urityLab.ru>)
GDI+ JPEG exploit (<albatross@....it>)
Patch available for multiple high risk vulnerabilities in RealPlayer ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
Multiple vulnerabilities in BlackBoard (Lin Xiaofeng <Cracklove@...il.Com>)
Patch available for multiple high risk vulnerabilities in RealPlayer ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
SUSE Security Announcement: mozilla (SUSE-SA:2004:036) (krahmer@...e.de (Sebastian Krahmer))
Patch available for high risk flaws in the AtHoc Toolbar ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
[SECURITY] [DSA 559-1] New net-acct packages fix insecure temporary file creation (joey@...odrom.org (Martin Schulze))
CodeCon 2005 Call for Papers (Len Sassaman <rabbi@...itum.com>)
Directory traversal in Tridcomm 1.3 (Luigi Auriemma <aluigi@...istici.org>)
Latest Apple Sec update (Michael Bartosh <mbartosh@....com>)
[GoSecure Advisory] Neoteris IVE Vulnerability (Jian Hui Wang <jhwang@...ecure.ca>)

October 7 (16 messages)

MDKSA-2004:105 - Updated xine-lib packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
[SECURITY] [DSA 558-1] New libapache-mod-dav packages fix potential denial of service (joey@...odrom.org (Martin Schulze))
Re: Multiple vulnerabilities in BlackBoard (Yves Goergen <contact@...lassified.de>)
[HV-HIGH] MS Word multiple exceptions, at least one exploitable (vuln@...view.com)
Patch available for high risk flaws in the AtHoc Toolbar ("NGSSoftware Insight Security Research" <nisr@...tgenss.com>)
[Gosecure Adivsory] Neoteris IVE Vulnerability (Jian Hui Wang <jhwang@...ecure.ca>)
New Microsoft Security Response Center PGP Key [pgp] ("Microsoft Security Response Center" <secure@...rosoft.com>)
Re: Buffer Overflow in Spider game (Matt Zimmerman <mdz@...ian.org>)
HTTP Response Splitting Vulnerability in Wordpress 1.2 ("Chaotic Evil" <chaoticevil@...ring.com>)
[SECURITY] [DSA 600-1] New samba packages fix arbitrary file access (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 560-1] New lesstif packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[sb] [ GLSA 200410-05 ] Cyrus-SASL: Buffer overflow and SASL_PATH vulnerabilities ("Kurt Lieber" <klieber@...too.org>)
Server crash in Flash Messaging 5.2.0g (Luigi Auriemma <aluigi@...istici.org>)
[FLSA-2004:1735] Updated cvs packages fix security vulnerabilities (fedora-legacy-announce@...hat.com)
ASP.NET cannonicalization issue ("Evans, Arian" <Arian.Evans@...hnetsecurity.com>)
RE: Disclosure policy in Re: RealPlayer vulnerabilities ("Drew Copley" <dcopley@...e.com>)

October 8 (9 messages)

Re: ASP.NET cannonicalization issue (Jelson Pat <australia001@...oo.com.au>)
[FLSA-2004:1868] Updated php packages fix security issues (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
Re: RE: Disclosure policy in Re: RealPlayer vulnerabilities ("Jason Coombs PivX Solutions" <jasonc@...ence.org>)
Re: RE: Disclosure policy in Re: RealPlayer vulnerabilities (Martin Viktora <mviktora@...io.com>)
[FLSA-2004:1257] Updated netpbm packages fix security vulnerabilities (Dominic Hargreaves <dom@...th.li>)
Re: RE: Disclosure policy in Re: RealPlayer vulnerabilities (dave <dave@...unitysec.com>)
TSLSA-2004-0053 - cyrus-sasl (Trustix Security Advisor <tsl@...stix.org>)
Limited \secure\ buffer-overflow in some old Monolith games (Luigi Auriemma <aluigi@...istici.org>)
MDKSA-2004:106 - Updated cyrus-sasl packages fix local vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)

October 9 (2 messages)

Re: Yet another IE aperture ("GreyMagic Security" <security@...ymagic.com>)
[FLSA-2004:2068] Updated httpd packages fix security issues (fedora-legacy-announce@...hat.com)

October 10 (1 message)

[ GLSA 200410-09 ] LessTif: Integer and stack overflows in libXpm (Luke Macken <lewk@...too.org>)

October 11 (6 messages)

Eudora 6.2.0.7 attachment spoof (psz@...hs.usyd.edu.au (Paul Szabo))
[MAxpatrol Security Advisory] Multiple vulnerabilities in GoSmart Message Board ("Alexander Antipov" <antipov@...urityLab.ru>)
[SECURITY] [DSA 562-1] New mysql packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 458-3] New python2.2 packages really fix buffer overflow and restore functionality (joey@...odrom.org (Martin Schulze))
Multiple vulnerabilities in ZanfiCmsLite (Lin Xiaofeng <Cracklove@...il.Com>)
[MAxpatrol Security Advisory] Multiple vulnerabilities in GoSmart Message Board ("Alexander Antipov" <antipov@...urityLab.ru>)

October 12 (14 messages)

Writing Trojans that bypass Windows XP Service Pack 2 Firewall (<americanidiot@...hmail.com>)
Microsoft cabarc directory traversal (Jelmer <jkuperus@...net.nl>)
Adobe acrobat / Adobe Reader 6 can read local files (Jelmer <jkuperus@...net.nl>)
MonkeyShell: using XML-RPC for access to a remote shell (Abe Usher <securitylist@...rp-ideas.net>)
FW: problem in voip environment ("Walton, John Michael (John)" <jmwalton@...ya.com>)
Insecure Default Service DACL's in Windows 2003 ("Ziots, Edward" <EZiots@...espan.org>)
Micronet wireless broadband router SP916BM admin password reset when power off (MrJoe <mrjoe@...t.sk>)
Regression in IE: Accessing remote/local content in IE (GM#009-IE) (GreyMagic Security <security@...ymagic.com>)
UnixWare 7.1.3up UnixWare 7.1.4 : CUPS before 1.1.21 allows remote attackers to cause a denial of service (please_reply_to_security@....com)
Microsoft Internet Explorer Install Engine Control Buffer Overflow ("NGSSoftware Insight Security Research" <nisr@...software.com>)
[SECURITY] [DSA 563-2] New cyrus-sasl packages really fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
CORE-2004-0802: IIS NNTP Service XPAT Command Vulnerabilities (CORE Security Technologies Advisories <advisories@...esecurity.com>)
UnixWare 7.1.4 : Multiple Vulnerabilities in libpng (please_reply_to_security@....com)
CORE-2004-0802: IIS NNTP Service XPAT Command Vulnerabilities (CORE Security Technologies Advisories <advisories@...esecurity.com>)

October 13 (17 messages)

RE: Insecure Default Service DACL's in Windows 2003 ("Kurt Dillard" <kurtdill@...rosoft.com>)
Reverse Engineering the First Pocket PC Trojan (kers0r <root@...lum-nz.com>)
Re: Regression in IE: Accessing remote/local content in IE (GM#009-IE) (Nick FitzGerald <nick@...us-l.demon.co.uk>)
Microsoft IIS 5.x/6.0 WebDAV (XML parser) attribute blowup DoS ("Amit Klein (AKsecurity)" <aksecurity@...pop.com>)
[SECURITY] [DSA 563-1] New cyrus-sasl packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
Re: CORE-2004-0802: IIS NNTP Service XPAT Command Vulnerabilities ("wirepair" <wirepair@...uemail.net>)
MS October Security bulletins (<albatross@....it>)
[hackgen-2004-#002] - Remote file inclusion bug in ocPortal 1.0.3. (Exoduks <exoduks@...il.com>)
[HV-HIGH] RIM Blackberry buffer overflow, DoS, data loss (vuln@...view.com)
[SECURITY] [DSA 564-1] New mpg123 packages fix arbitrary code exceution (joey@...odrom.org (Martin Schulze))
XXS in fusetalk forum ("Matthew Oyer" <root@...ffomatic64.com>)
XXS in SCT email client ("Matthew Oyer" <root@...ffomatic64.com>)
Buffer-overflow in ShixxNOTE 6.net (Luigi Auriemma <aluigi@...istici.org>)
BindView Advisory: Memory Leak and DoS in NT4 RPC server (advisory <advisory@...l.bos.bindview.com>)
[FLSA-2004:2102] Updated samba packages fix security vulnerability (fedora-legacy-announce@...hat.com)
Multiple Cross Site Scripting Vulnerabilities in FuseTalk ("steven" <steven@...ebug.org>)
ACROS Security: Poisoning Cached HTTPS Documents in Internet Explorer ("ACROS Security" <lists@...os.si>)

October 14 (26 messages)

[FLSA-2004:1833] Updated lha resolves security vulnerabilities (fedora-legacy-announce@...hat.com)
[FLSA-2004:1737] Updated httpd packages fix a mod_proxy security vulnerability (fedora-legacy-announce@...hat.com)
[FLSA-2004:1888] Updated mod_ssl package fixes Apache security vulnerabilities (fedora-legacy-announce@...hat.com)
[ GLSA 200410-10 ] gettext: Insecure temporary file handling (Luke Macken <lewk@...too.org>)
[SECURITY] [DSA 565-1] New sox packages fix buffer overflow (joey@...odrom.org (Martin Schulze))
IT Underground Talks (Dave Aitel <dave@...unitysec.com>)
EEYE: Windows Shell ZIP File Decompression DUNZIP32.DLL Buffer Overflow Vulnerability ("Derek Soeder" <dsoeder@...e.com>)
EEYE: Windows VDM #UD Local Privilege Escalation ("Derek Soeder" <dsoeder@...e.com>)
MSN Gaming Heartbeat Component Buffer Overflow ("NGSSoftware Insight Security Research" <nisr@...software.com>)
Format String Vulnerability in Valve's CS-Source (Some One <mc.iglo@...lan.de>)
[ GLSA 200410-09 ] LessTif: Integer and stack overflows in libXpm (Luke Macken <lewk@...too.org>)
Bypass of Antivirus software with GDI+ bug exploit Mutations (Andrey Bayora <andrey@...denbit.org>)
Bypass of Antivirus software with GDI+ bug exploit Mutations (Andrey Bayora <andrey@...denbit.org>)
RE: Bypass of Antivirus software with GDI+ bug exploit Mutations ("Todd Towles" <toddtowles@...okshires.com>)
RE: Bypass of Antivirus software with GDI+ bug exploit Mutations ("Cassidy Macfarlane" <cmacfarlane@...mmond-Miller.co.uk>)
Buffer Overflow In Microsoft Excel ("Brett Moore" <brett.moore@...urity-assessment.com>)
SetWindowLong Shatter Attacks ("Brett Moore" <brett.moore@...urity-assessment.com>)
[CLA-2004:872] Conectiva Security Announcement - cups (Conectiva Updates <secure@...ectiva.com.br>)
[CLA-2004:873] Conectiva Security Announcement - samba (Conectiva Updates <secure@...ectiva.com.br>)
[HV-MED] UPDATE: RIM Blackberry DoS, data loss (vuln@...view.com)
[SECURITY] [DSA 563-3] New cyrus-sasl packages fix arbitrary code execution on sparc and arm (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 566-1] New CUPS packages fix information leak (joey@...odrom.org (Martin Schulze))
CESA-2004-006: libtiff (chris@...ry.beasts.org)
3COM Wireless router (3CRADSL72) information disclosure (Karb0nOxyde - <karb0noxyde@...il.com>)
New Remote Microsoft JPEG DoS Vulnerability + Other Potential Security Vulnerabilitys in asycpict.dll 1.0 Advisory (John Bissell <monkey321_1@...mail.com>)
ACROS Security: Unsanitized Session ID Cookie Allows Modifying Server Response ("ACROS Security" <lists@...os.si>)

October 15 (21 messages)

ACROS Security: HTML Injection in JRun Management Console ("ACROS Security" <lists@...os.si>)
ACROS Security: Session Fixation in JRun Management Console ("ACROS Security" <lists@...os.si>)
UPDATE: Format String Vulnerability in Valve's CS-Source (Some One <mc.iglo@...lan.de>)
[OpenPKG-SA-2004.043] OpenPKG Security Advisory (tiff) (OpenPKG <openpkg@...npkg.org>)
Re: Adobe acrobat / Adobe Reader 6 can read local files (Nick Leoncavallo <nleoncavallo@...oo.com>)
[FLSA-2004:2102] Updated samba packages fix security vulnerability [updated] (fedora-legacy-announce@...hat.com)
Re: Insecure Default Service DACL's in Windows 2003 (Jean-Baptiste Marchand <jbm@....fr>)
[OpenPKG-SA-2004.044] OpenPKG Security Advisory (modssl) (OpenPKG <openpkg@...npkg.org>)
a path disclosure and a posibility file inclusion and vulneability in thepeak file upload v1.3 (keitel andres ortega <justint@...ail.net>)
TSLSA-2004-0054 - multi (Trustix Security Advisor <tsl@...stix.org>)
Re: EEYE: Windows Shell ZIP File Decompression DUNZIP32.DLL Buffer Overflow Vulnerability (Bipin Gautam <visitbipin@...mail.com>)
Re: Insecure Default Service DACL's in Windows 2003 (Jean-Baptiste Marchand <Jean-Baptiste.Marchand@....fr>)
Microsoft Windows NetDDE Service Buffer Overflow ("NGSSoftware Insight Security Research" <nisr@...software.com>)
ProFTPD 1.2.x remote users enumeration bug (LSS Security <exposed@....hr>)
Re: Format String Vulnerability in Valve's CS-Source (Luigi Auriemma <aluigi@...istici.org>)
Norton AntiVirus 2004 Script Blocking Failure (Includes PoC and rant) (Daniel Milisic <dmilisic@...ealshoebox.com>)
Directory traversal in Yak! 2.1.2 (Luigi Auriemma <aluigi@...istici.org>)
Re: Writing Trojans that bypass Windows XP Service Pack 2 Firewall (Martin Mkrtchian <dotsecure@...il.com>)
Clientexec Billing Software (bugtraq@...xy.com)
[SECURITY] [DSA 567-1] New libtiff packages fix remote code execution (joey@...odrom.org (Martin Schulze))
More details on BID 11408 (3com 3cradsl72 wireless router) ("Ivan Casado" <casadoi@...com>)

October 16 (7 messages)

Re: Writing Trojans that bypass Windows XP Service Pack 2 Firewall (<mrinfosec@...hmail.com>)
RE: Writing Trojans that bypass Windows XP Service Pack 2 Firewall ("Polazzo Justin" <Justin.Polazzo@...ilities.gatech.edu>)
[IE 6 SP2] Possible URL Spoofing ("Andrew Hunter" <andiroohunter@....com>)
Re: Bypass of Antivirus software with GDI+ bug exploit Mutations (<ennis@....net>)
Re: Writing Trojans that bypass Windows XP Service Pack 2 Firewall (devis <devis@...ynix.net>)
[FLSA-2004:2072] Updated CUPS packages fix security vulnerability (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2004:1237] Updated gaim package resolves security issues (fedora-legacy-announce@...hat.com)

October 17 (1 message)

Multiple Vulnerabilities in CoolPHP (R00tCr4ck <root@...erspy.org>)

October 18 (24 messages)

cPanel symlink chmod issue (Karol Więsek <appelast@...mnbass.art.pl>)
[FLSA-2004:1804] Updated kernel resolves security vulnerabilities (Dominic Hargreaves <dom@...th.li>)
cPanel hardlink backup issue (Karol Więsek <appelast@...mnbass.art.pl>)
cPanel hardlink chown issue (Karol Więsek <appelast@...mnbass.art.pl>)
Re: New Remote Microsoft JPEG DoS Vulnerability + Other Potential Security Vulnerabilitys in asycpict.dll 1.0 Advisory (SysAdminKC <SysAdminKC@...il.com>)
Re: New Remote Microsoft JPEG DoS Vulnerability + Other Potential Security Vulnerabilitys in asycpict.dll 1.0 Advisory ("marco correnti" <correntim@...l.com>)
Re: Format String Vulnerability in Valve's CS-Source (Some One <mc.iglo@...lan.de>)
Re: 3COM Wireless router (3CRADSL72) information disclosure ("mccauley@....net" <mccauley@....net>)
ms04-031 pre-auth ?? (Sinan Eren <sinan.eren@...unitysec.com>)
Web browsers - a mini-farce (Michal Zalewski <lcamtuf@...ttot.org>)
IISShield and ASP.NET canonicalization ("Tiago Halm" <thalm@...d.my-bulldog.com>)
Multiple vulnerabilities in Sage Saleslogix ("Carl" <carl@...nda-security.co.uk>)
iDEFENSE Security Advisory 10.18.04: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability ("customer service mailbox" <customerservice@...fense.c…)
Re: Adobe acrobat / Adobe Reader 6 can read local files (Shannon Eric Peevey <speeves@...kin.com>)
Re: [IE 6 SP2] Possible URL Spoofing ("http-equiv@...ite.com" <1@...ware.com>)
Re: Directory traversal in Yak! 2.1.2 (bil <bil_912@...lgoose.com>)
Re: EEYE: Windows VDM #UD Local Privilege Escalation (Jim Hatfield <subscriber@...ignia.com>)
Re: Norton AntiVirus 2004 Script Blocking Failure (Includes PoC and rant) (<secure@...antec.com>)
[SECURITY] [DSA 569-1] New netkit-telnet-ssl packages fix denial of service (joey@...odrom.org (Martin Schulze))
IBM Lotus Notes/Domino fails to encode Square Brackets ( [ ] ) in computed field/text, allowing XSS (Juan C Calderon <juan.calderon@...com>)
[Powie's PSCRIPT Forum] Multiple SQL-Injection Vulnerabilities (Christoph Jeschke <ponders@...or.de>)
[SECURITY] [DSA 568-1] New cyrus-sasl-mit packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 556-2] New netkit-telnet packages really fix denial of service (joey@...odrom.org (Martin Schulze))
Re: IBM Lotus Notes/Domino fails to encode Square Brackets ( [ ] ) in computed field/text, allowing XSS (Juan C Calderon <juan.calderon@...com>)

October 19 (16 messages)

ProFTPD 1.2.x remote users enumeration bug - correction (LSS Security <exposed@....hr>)
Mutiple AntiVirus Reserved Device Name Handling Vulnerability ("Sowhat ." <smaillist@...il.com>)
Re: Writing Trojans that bypass Windows XP Service Pack 2 Firewall (Jay Calvert <jrcalvert@...il.com>)
apexec.pl is still vulnerable against Directory Traversal. (Zero_X www.lobnan.de Team <zero-x@...uxmail.org>)
RE: Writing Trojans that bypass Windows XP Service Pack 2 Firewall (Simon Zuckerbraun <szucker@...-pr-1.com>)
Re: [IE 6 SP2] Possible URL Spoofing ("Paul Kurczaba" <paul@...pis.com>)
[CLA-2004:875] Conectiva Security Announcement - gtk+ (Conectiva Updates <secure@...ectiva.com.br>)
UnixWare 7.1.4 UnixWare 7.1.3 : The error handling in the inflate and inflateBack functions in ZLib compression library allows … (please_reply_to_security@....com)
Major Client Crash in 3D FTP (Bakchodiya <bakchodiya@...oo.com>)
RE: [IE 6 SP2] Possible URL Spoofing ("Dror Shalev" <dshalev@...jan.com>)
Re: New Remote Microsoft JPEG DoS Vulnerability + Other Potential Security Vulnerabilitys in asycpict.dll 1.0 Advisory ("Chris Norton" <kicktd_list@...mail.com>)
Remote Rootkit Scanner for Windows (Andres Tarasco <atarasco@....es>)
avoiding stackguard (<vallez@...il.com>)
Multiple AntiVirus Reserved Device Name Handling Vulnerability ("Sowhat ." <smaillist@...il.com>)
Broadcast crash in Vypress Tonecast 1.3 (Luigi Auriemma <aluigi@...istici.org>)
Google Script Insertion Exploit (Jim Ley <jim@...bering.com>)

October 20 (11 messages)

Netscape Webmail Cross Site Scripting Vulnerability ("Steven Adair" <sadair@...edu>)
America Online Webmail Cross Site Scripting Vulnerability ("Steven Adair" <sadair@...edu>)
MS-DOS Device Name Denial Of Service Vulnerability in Abyss Web Server X1 for Windows (R00tCr4ck <root@...erspy.org>)
MDKSA-2004:109 - Updated libtiff packages fix multiple vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Buffer-overflow in Age of Sail II 1.04.151 (Luigi Auriemma <aluigi@...istici.org>)
[EXPL] (MS04-032) Microsoft Windows XP Metafile (.emf) Heap Overflow (PoC) (houseofdabus HOD <houseofdabus@...ox.ru>)
RE: How to Break Windows XP SP2 + Internet Explorer 6 SP2 ("Thor Larholm" <thor@...x.com>)
Norton AntiVirus 2004/2005 Script Blocking Redux ("Daniel Milisic" <dmilisic@...ealbox.com>)
How to Break Windows XP SP2 + Internet Explorer 6 SP2 ("http-equiv@...ite.com " <1@...ware.com>)
[SECURITY] [DSA 571-1] New libpng3 packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 570-1] New libpng packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))

October 21 (12 messages)

Re: Norton AntiVirus 2004 Script Blocking Failure (Includes PoC and rant) (<secure@...antec.com>)
Re: [Unpatched] New 0day exploit for XPSP2 (Juergen Schmidt <ju@...sec.de>)
MDKSA-2004:108 - Updated cvs packages fix vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
mpg123 "getauthfromurl" buffer overflow (Carlos Barros <barros@...rossecurity.com>)
MDKSA-2004:107 - Updated mozilla packages fix vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
Critical Vulnerability in Altiris Deployment Server architecture (Brian Gallagher <bugtraq@...mondsea.com>)
CAN-2004-0814: Linux terminal layer races (Alan Cox <alan@...rguk.ukuu.org.uk>)
SuSE Security Announcement: kernel (SUSE-SA:2004:037) (Marcus Meissner <meissner@...e.de>)
NSFOCUS SA2004-02 : HP-UX stmkfont Local Privilege Escalation Vulnerability (NSFOCUS Security Team <security@...ocus.com>)
[SECURITY] [DSA 573-1] New cupsys packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
cPanel check only the first 8 characters of webmail password (Andrey Bayora <andrey@...denbit.org>)
[SECURITY] [DSA 572-1] New ecartis packages fix unauthorised access to admin interface (joey@...odrom.org (Martin Schulze))

October 22 (21 messages)

SQL Injection in UBB.threads 3.4.x ("Florian Rock" <florianrock@....de>)
MDKSA-2004:111 - Updated wxGTK2 packages fix vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
[HV-LOW] Unsafe WAV header handling can cause DoS on Windows (vuln@...view.com)
Re: cPanel check only the first 8 characters of webmail password ("Evert Daman" <linux@...ipix.org>)
Re: IBM Lotus Notes/Domino fails to encode Square Brackets ( [ ] ) in computed field/text, allowing XSS (Risk inc… (Juan C Calderon <juan.calderon@...com>)
MDKSA-2004:110 - Updated gaim packages fix vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
HTTP Response Splitting in Serendipity 0.7-beta4 ("Chaotic Evil" <chaoticevil@...ring.com>)
Re: Critical Vulnerability in Altiris Deployment Server architecture (KF_lists <kf_lists@...netops.com>)
Virus/Trojan trying to connect external:445 and 212.175.149.149.6667 (Murat Bicer <mbicer@...il.com>)
[KDE security advisory] Multiple integer overflows in kpdf (Dirk Mueller <mueller@....org>)
J2ME security vulnerabilities (Adam Gowdiak <zupa@....poznan.pl>)
RE: Virus/Trojan trying to connect external:445 and 212.175.149.149.6667 ("Todd Towles" <toddtowles@...okshires.com>)
MDKSA-2004:112 - Updated squid packages fix SNMP processing vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:114 - Updated gpdf packages fix DoS vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:115 - Updated kdegraphics packages fix DoS vulnerability (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:116 - Updated cups packages fix DoS vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
MDKSA-2004:113 - Updated xpdf packages fix vulnerabilities (Mandrake Linux Security Team <security@...ux-mandrake.com>)
[Security Bulletin] SSRT4807 HP-UX stmkfont local unauthorized privileged access ("Boren, Rich (SSRT)" <rich.boren@...com>)
[Fwd: Altiris Carbon Copy Remote Control local SYSTEM exploitation.] (KF_lists <kf_lists@...netops.com>)
SuSE Security Announcement: libtiff (SUSE-SA:2004:038) (Marcus Meissner <meissner@...e.de>)
Re: Virus/Trojan trying to connect external:445 and 212.175.149.149.6667 (darren windham <elcamino74ss@...il.com>)

October 23 (17 messages)

Windows DoS in certain pGina configurations ("Steven" <steven@...ebug.org>)
Hack Dot AE (Spy Hat <spyhat@...hat.com>)
Re: avoiding stackguard (Crispin Cowan <crispin@...unix.com>)
iDEFENSE Security Advisory XX.XX.04 - Novell SuSe Linux LibTIFF Heap Overflow Vulnerability ("customer service mailbox" <customerservice@...fense.com>)
[CLA-2004:877] Conectiva Security Announcement - mozilla (Conectiva Updates <secure@...ectiva.com.br>)
AOL Journals BlogID incrementing discloses account names and e-mail ("Steven" <steven@...ebug.org>)
Is Windows up to snuff for running our world? ("Richard M. Smith" <rms@...puterbytesman.com>)
Update: Web browsers - a mini-farce (MSIE gives in) (Michal Zalewski <lcamtuf@...ttot.org>)
Norton AntiVirus 2004/2005 Script Blocking Redux (Daniel Milisic <dmilisic@...ealbox.com>)
Ability FTP Server 2.34 Buffer Overflow Exploit ("J�r�me" ATHIAS <jerome.athias@...amail.com>)
Re: Full path disclosure and sql injection on CubeCart 2.0.1 (<sculptex@...lptex.co.uk>)
windows 2000 server terminal server denial of service (Nick Caramella <root@...amella.freeserve.co.uk>)
rssh: pizzacode security alert (Derek Martin <code@...zashack.org>)
[FLSA-2004:1719] Updated Tripwire packages fix security flaw (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
[FLSA-2004:1947] Updated glibc packages fix flaws (Marc Deslauriers <marcdeslauriers@...eotron.ca>)
dwc_articles possible sql injection (Rene <l0om@...luded.org>)
rssh: pizzacode security alert ("Derek Martin" <code@...zashack.org>)

October 24 (2 messages)

python does mangleme (with IE bugs!) (ned <nd@...inemenace.org>)
Re: Update: Web browsers - a mini-farce (MSIE gives in) (Daniel Veditz <dveditz@...zio.com>)

October 25 (7 messages)

Re: python does mangleme (with IE bugs!) ("Berend-Jan Wever" <skylined@...p.tudelft.nl>)
[BUGZILLA] Vulnerabilities in Bugzilla 2.16.6 and 2.18rc2 (David Miller <justdave@...zilla.org>)
re: How to Break Windows XP SP2 + Internet Explorer 6 SP2 ("Michael Evanchik" <Mike@...haelEvanchik.com>)
Re: Google Script Insertion Exploit ("J�r�me" ATHIAS <jerome.athias@...amail.com>)
Re: Is Windows up to snuff for running our world? ("Thor" <thor@...merofgod.com>)
STG Security Advisory: [SSA-20041022-08] MoniWiki XSS vulnerability (<advisory@...security.com>)
Some Voters Say Machines Failed, Incorrect Choices Appear on Screens (fwd) (Atom 'Smasher' <atom@...picious.org>)

October 26 (20 messages)

RE: Update: Web browsers - a mini-farce (MSIE gives in) (David Brodbeck <DavidB@...l.interclean.com>)
Fake RedHat - Fedora Security Patch / Trojan Source Code & Analysis (K-OTiK Security <Special-Alerts@...tik.com>)
Mozilla Firefox (tested on 0.9.3) html-code crash. (ducch apple <admin@...oyfam.com>)
Re: Update: Web browsers - a mini-farce (MSIE gives in) (<gabrield89@...mail.com>)
Re: How to Break Windows XP SP2 + Internet Explorer 6 SP2 (michael evanchik <mcbain@....com>)
[CLA-2004:878] Conectiva Security Announcement - zlib (Conectiva Updates <secure@...ectiva.com.br>)
Bug in hotmail (security <security@...amiteit.nl>)
Re: CAN-2004-0814: Linux terminal layer races ("Pavel Kankovsky" <peak@...o.troja.mff.cuni.cz>)
Two Vulnerabilities in OpenWFE Web Client (Joxean Koret <joxeankoret@...oo.es>)
RE: Critical Vulnerability in Altiris Deployment Server architecture ("Brooks, Shane" <SBrooks@...ngelake.com>)
Posting w/o checking facts (Harry Hoffman <hhoffman@...solutions.net>)
PTms04-030 ("pigrelax" <pigrelax@...dex.ru>)
libxml2 remote buffer overflows (not in xml parsing code though) (infamous41md@...pop.com)
SUSE Security Announcement: xpdf, gpdf, kpdf, pdftohtml, cups (SUSE-SA:2004:039) (Thomas Biege <thomas@...e.de>)
OpenSSL 0.9.7e released (fwd from mark@...nssl.org) (je@...ure.net)
libgd integer overflow (infamous41md@...pop.com)
MailCarrier 2.51 SMTP server Buffer Overflow [PoC included] ("J�r�me" ATHIAS <jerome.athias@...amail.com>)
pacsec.jp advisory: Firewire/IEEE 1394 Considered Harmful to Physical Security (Dragos Ruiu <dr@....net>)
Hawking Technologies HAR11A router considered insecure (Marcus Garvey <dartroller@....scientist.com>)
inetutils tftp client, DNS resolving bofs (infamous41md@...pop.com)

October 27 (21 messages)

pppd out of bounds memory access, possible DOS (infamous41md@...pop.com)
[USN-3-1] GhostScript utility script vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-5-1] gettext vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-7-1] imagemagick vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-6-1] postgresql contributed script vulnerability (Martin Pitt <martin.pitt@...onical.com>)
[USN-8-1] gaim vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
wvtfpd remote root heap overflow (infamous41md@...pop.com)
Re: Some Voters Say Machines Failed, Incorrect Choices Appear on Screens (fwd) (Valdis.Kletnieks@...edu)
zgv image viewing heap overflows (infamous41md@...pop.com)
Rendering large binary file as HTML makes Mozilla Firefox stop responding ("Peter Kruse" <kruse@...sesecurity.dk>)
Re: Update: Web browsers - a mini-farce (MSIE gives in) (Valdis.Kletnieks@...edu)
debian dhcpd, old format string bug (infamous41md@...pop.com)
[FLSA-2004:2089] Updated mozilla packages fix security vulnerabilities (Dominic Hargreaves <dom@...th.li>)
MMDF deliver local root exploit for SCO OpenServer 5.0.7 x86 (Ramon de Carvalho Valle <ramondecarvalho@...oo.com.br>)
PuTTY SSH client vulnerability (Anatole Shaw <anatole@...ionalsky.com>)
[CLA-2004:879] Conectiva Security Announcement - kernel (Conectiva Updates <secure@...ectiva.com.br>)
Re: Update: Web browsers - a mini-farce (MSIE gives in) (Valdis.Kletnieks@...edu)
RE: Update: Web browsers - a mini-farce (MSIE gives in) (Michael Wojcik <Michael.Wojcik@...rofocus.com>)
Crashs in Master of Orion III 1.2.5 (Luigi Auriemma <aluigi@...istici.org>)
[CLA-2004:880] Conectiva Security Announcement - foomatic-filters (Conectiva Updates <secure@...ectiva.com.br>)
iDEFENSE Security Advisory 10.27.04 - PuTTY SSH2_MSG_DEBUG Buffer Overflow Vulnerability ("customer service mailbox" <customerservice@...fense.com>)

October 28 (19 messages)

High Risk Vulnerability in Quicktime for Windows ("NGSSoftware Insight Security Research" <nisr@...software.com>)
EEYE: RealPlayer Zipped Skin File Buffer Overflow ("Marc Maiffret" <mmaiffret@...e.com>)
RE: Update: Web browsers - a mini-farce (MSIE gives in) (Michael Wojcik <Michael.Wojcik@...rofocus.com>)
Multiple Vulnerabilites in Quake II Server ("Richard Stanway" <bugtraq@...ur1ty.net>)
[security bulletin] SSRT3526 Serviceguard potential increase in privilege ("Boren, Rich (SSRT)" <rich.boren@...com>)
High Risk Vulnerability in RealPlayer ("NGSSoftware Insight Security Research" <nisr@...software.com>)
[USN-9-1] tetex-bin vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[USN-4-1] Standard C library script vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
Presentation: Bypassing client application protection techniques with notepad (3APA3A <3APA3A@...urity.nnov.ru>)
[SECURITY] [DSA 574-1] New cabextract packages fix unintended directory traversal (joey@...odrom.org (Martin Schulze))
[SECURITY] [DSA 575-1] New catdoc packages fix temporary file vulnerability (joey@...odrom.org (Martin Schulze))
Re: Update: Web browsers - a mini-farce (MSIE gives in) (MCMuir@...output.com)
Re: debian dhcpd, old format string bug (Tarragon Allen <tarragon@...he.net.au>)
Re: zgv image viewing heap overflows (Chris Frey <cdfrey@...direct.ca>)
PHP4 cURL functions bypass open_basedir (FraMe <frame@...palab.com>)
Re: Some Voters Say Machines Failed, Incorrect Choices Appear on Screens (fwd) (Paul Schmehl <pauls@...allas.edu>)
RE: Update: Web browsers - a mini-farce (MSIE gives in) (David Brodbeck <DavidB@...l.interclean.com>)
RE: Update: Web browsers - a mini-farce (MSIE gives in) (Michael Wojcik <Michael.Wojcik@...rofocus.com>)
Re: Update: Web browsers - a mini-farce (MSIE gives in) (Valdis.Kletnieks@...edu)

October 29 (17 messages)

New URL spoofing bug in Microsoft Internet Explorer (<0-1-2-3@....de>)
Re: Mozilla Firefox (tested on 0.9.3) html-code crash. (Crispin Cowan <crispin@...unix.com>)
[USN-12-1] ppp Denial of Service (Martin Pitt <martin.pitt@...onical.com>)
[USN-11-1] libgd2 vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
[SECURITY] [DSA 577-1] New postgresql packages fix symlink vulnerability (joey@...odrom.org (Martin Schulze))
Re: Mozilla Firefox (tested on 0.9.3) html-code crash. (Michal Zalewski <lcamtuf@...edump.cx>)
[SECURITY] [DSA 576-1] New Squid packages fix several vulnerabilities (joey@...odrom.org (Martin Schulze))
[OpenPKG-SA-2004.047] OpenPKG Security Advisory (apache) (OpenPKG <openpkg@...npkg.org>)
Re: debian dhcpd, old format string bug (infamous41md@...pop.com)
local buffer overflow in htpasswd for apache 1.3.31 not fixed in .33? (Larry Cashdollar <lwc@...id.ath.cx>)
Re: libgd integer overflow (Richard Dawe <rich@...kda.gotadsl.co.uk>)
RE: New URL spoofing bug in Microsoft Internet Explorer ("Larry Seltzer" <larry@...ryseltzer.com>)
RE: libgd integer overflow (infamous41md@...pop.com)
[USN-10-1] XML library vulnerabilities (Martin Pitt <martin.pitt@...onical.com>)
RE: Update: Web browsers - a mini-farce (MSIE gives in) (Tim Newsham <newsham@...a.net>)
Re: Update: Web browsers - a mini-farce (MSIE gives in) (Valdis.Kletnieks@...edu)
RE: Update: Web browsers - a mini-farce (MSIE gives in) (Tim Newsham <newsham@...a.net>)

October 30 (17 messages)

Re: Update: Web browsers - a mini-farce (MSIE gives in) (Michael Shigorin <mike@...n.org.ua>)
Re: New URL spoofing bug in Microsoft Internet Explorer (GuidoZ <uberguidoz@...il.com>)
Re: Update: Web browsers - a mini-farce (MSIE gives in) (infamous41md@...pop.com)
RE: Update: Web browsers - a mini-farce (MSIE gives in) (David Brodbeck <DavidB@...l.interclean.com>)
Re: New URL spoofing bug in Microsoft Internet Explorer ("Christopher J. Pilkington" <christopher.j.pilkington@...il.com>)
Re: New URL spoofing bug in Microsoft Internet Explorer ("J�r�me" ATHIAS <jerome.athias@...amail.com>)
[OpenPKG-SA-2004.046] OpenPKG Security Advisory (postgresql) (OpenPKG <openpkg@...npkg.org>)
Re: local buffer overflow in htpasswd for apache 1.3.31 not fixed in .33? (André Malo <nd@...lig.de>)
Re: Update: Web browsers - a mini-farce (MSIE gives in) (Chris Paget <ivegotta@...bom.co.uk>)
Re: New URL spoofing bug in Microsoft Internet Explorer (GuidoZ <uberguidoz@...il.com>)
Re: local buffer overflow in htpasswd for apache 1.3.31 not fixed in .33? (Michael Engert <michi@...lo.engert.org>)
Re: New URL spoofing bug in Microsoft Internet Explorer (GuidoZ <uberguidoz@...il.com>)
Re: New URL spoofing bug in Microsoft Internet Explorer (<0-1-2-3@....de>)
[OpenPKG-SA-2004.048] OpenPKG Security Advisory (squid) (OpenPKG <openpkg@...npkg.org>)
bogofilter-SA-2004-01: RFC 2047 Denial-of-service in 0.17.4 <= bogofilter <= 0.92.7 (Matthias Andree <matthias.andree@....de>)
RE: New URL spoofing bug in Microsoft Internet Explorer ("Larry Seltzer" <larry@...ryseltzer.com>)
Re: New URL spoofing bug in Microsoft Internet Explorer ("http-equiv@...ite.com " <1@...ware.com>)

393 messages

Powered by blists - more mailing lists