bugtraq mailing list - 2007/09

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev month] [next month>] [year] [list]

bugtraq mailing list - 2007/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
					¹ 17	²
³ 7	⁴ 15	⁵ 15	⁶ 13	⁷ 13	⁸ 6	⁹
¹⁰ 15	¹¹ 12	¹² 17	¹³ 10	¹⁴ 13	¹⁵ 5	¹⁶
¹⁷ 22	¹⁸ 19	¹⁹ 21	²⁰ 21	²¹ 51	²² 6	²³
²⁴ 25	²⁵ 39	²⁶ 8	²⁷ 24	²⁸ 10	²⁹ 3	³⁰

Messages by day:

September 1 (17 messages)

Re: Sony: The Return Of The Rootkit (Jason Brooke <jason@....org>)
Re: Sony: The Return Of The Rootkit (Paul Sebastian Ziegler <psz@...erved.de>)
Olate Download 3.4.2 ~ userupload.php ~ Upload Executable Files ("imei Addmimistrator" <addmimistrator@...il.com>)
[SECURITY] [DSA 1365-1] New id3lib3.8.3 packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
Olate Download 3.4.2~uploads folder ~ directory traversal ("imei Addmimistrator" <addmimistrator@...il.com>)
Toms Gstebuch 1.00 - XSS (cod3in@...il.com)
[SECURITY] [DSA 1366-1] New clamav packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: Sony: The Return Of The Rootkit (Chad Perrin <perrin@...theon.com>)
[ MDKSA-2007:172 ] - Updated clamav packages vulnerabilities (security@...driva.com)
Re: Sony: The Return Of The Rootkit ("Tyler Reguly" <ht@...puterdefense.org>)
Re: Sony: The Return Of The Rootkit (Juha-Matti Laurio <juha-matti.laurio@...ti.fi>)
[Paper] The Anatomy of Third Party Pop Up Attacks. (Aditya K Sood <zeroknock@...niche.org>)
[SECURITY] [DSA 1364-1] New vim packages fix several vulnerabilities (Moritz Muehlenhoff <jmm@...ian.org>)
Re: ePersonnel_RC_2004 Remote File Bug (the.tiger100@...il.com)
[SECURITY] [DSA 1363-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
Re: Sony: The Return Of The Rootkit ("John Hammond" <josephhammond@...mail.com>)
SolpotCrew Advisory #15 (home_edition2001) - Weblogicnet (files_dir) Remote File Inclusion (home_edition2001@....mildnet.org)

September 3 (7 messages)

Re: MkPortal "All Guests are Admin" Exploit (nospam@...edcoding.com)
[SECURITY] [DSA 1288-2] New pptpd packages fix regression (Moritz Muehlenhoff <jmm@...ian.org>)
Telecom Italy Alice Messenger Hp.Revolution.RegistryManager.dll (v.1) remote arbitrary registry key manipulation (retrog@...ce.it)
DeepSec IDSC 2007 Vienna Registration Now Open ("Paul Böhm" <paul@...hm.org>)
Multiple vulnerabilities in Joomla 1.5 RC 1 ("Omid" <omid@...kers.ir>)
Re: n.runs-SA-2007.027 - Sophos Antivirus UPX parsing Arbitrary CodeExecution Advisory (Sergio Alvarez <sergio.alvarez@...ns.com>)
Re: [Full-disclosure] n.runs-SA-2007.027 - Sophos Antivirus UPX parsing Arbitrary CodeExecution Advisory (Jan Münther <jan.muenther@...ns.com>)

September 4 (15 messages)

Marshal MailMarshal TAR Unpacking Vulnerability ("S. Vandersee" <discuss@...solutions.de>)
[security bulletin] HPSBUX02156 SSRT061236 rev.3 - HP-UX Running Thunderbird, Remote Unauthorized Access or Elevation of Privileges or Den… (security-alert@...com)
212cafeBoard Sql injection ("Lopez Bran" <wenzel.vete@...il.com>)
Re: [Sec] Re: [Full-disclosure] n.runs-SA-2007.027 - Sophos Antivirus UPX parsing Arbitrary CodeExecution Advisory (Thierry Zoller <Thierry.Zoller@...ns.com>)
Wireshark DNP3 Dissector Infinite Loop Vulnerability (Aviram Jenik <aviram@...ondsecurity.com>)
Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability (tusharvartak@...mail.com)
[security bulletin] HPSBUX02153 SSRT061181 rev.5 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial … (security-alert@...com)
Re: Built2Go_PHP_Link_Portal_v1.79 >> RFI (scoutt_42@...oo.com)
Re: Multiple vulnerabilities in Joomla 1.5 RC 1 (admin@...e9.org.uk)
MITKRB5-SA-2007-006: kadmind RPC lib buffer overflow, uninitialized pointer (Tom Yu <tlyu@....EDU>)
[SECURITY] [DSA 1367-1] New krb5 packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1368-1] New librpcsecgss packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
New version of Pass-The-Hash Toolkit v1.1 ("Hernan Ochoa" <hernan@...il.com>)
Tutorial on Fuzzled (Tim Brown <timb@...-dimension.org.uk>)
Digital Armaments 2007 September-October Hacking Challenge: Symbian (info@...italarmaments.com)

September 5 (15 messages)

Re: Apache tomcat calendar example cross site scripting and cross site request forgery vulnerability (Mark Thomas <markt@...che.org>)
[USN-511-1] Kerberos vulnerability (Kees Cook <kees@...ntu.com>)
[ MDKSA-2007:173 ] - Updated tar packages fix vulnerabilities (security@...driva.com)
rPSA-2007-0176-1 gd php php-mysql php-pgsql php5 php5-cgi php5-mysql php5-pear php5-pgsql php5-soap php5-xsl (rPath Update Announcements <announce-noreply@...t…)
Cisco Security Advisory: Cisco Video Surveillance IP Gateway and Services Platform Authentication Vulnerabilities (Cisco Systems Product Security Incident Respo…)
Cisco Security Advisory: Denial of Service Vulnerabilities in Content Switching Module (Cisco Systems Product Security Incident Response Team <psirt@...co.com>)
PHP < 5.2.3 glob() denial of service (laurent.gaffie@...il.com)
PHP < 5.2.4 setlocale() denial of service (laurent.gaffie@...il.com)
PHP < 5.2.3 fnmatch() denial of service (laurent.gaffie@...il.com)
PHP <=5.2.4 iconv_substr() denial of service (laurent.gaffie@...il.com)
Format string and clients disconnection in Alien Arena 2007 6.10 (Luigi Auriemma <aluigi@...istici.org>)
rPSA-2007-0177-1 kdebase kdelibs (rPath Update Announcements <announce-noreply@...th.com>)
Re: Olate Download 3.4.2 ~ userupload.php ~ Upload Executable Files (lcat <lcat@...il.dp.ua>)
rPSA-2007-0178-1 fetchmail (rPath Update Announcements <announce-noreply@...th.com>)
updated patch: MITKRB5-SA-2007-006: kadmind RPC lib buffer overflow, uninitialized pointer (Tom Yu <tlyu@....EDU>)

September 6 (13 messages)

Sophos Anti-Virus 6.5.4 Vulnerability (disclosure@...textis.co.uk)
[HISPASEC] 2K7SEPT6 Total Commander 7.01 Remote FTP Client Directory Traversal ("Gynvael Coldwind" <gynvael@...illium.org>)
[HISPASEC] 2K7SEPT6 X-Diesel Unreal Commander v0.92 (build 573) multiple FTP-based vulnerabilities ("Gynvael Coldwind" <gynvael@...illium.org>)
Re: PHP < 5.2.3 glob() denial of service ("Jonathan Yu" <jonathan.i.yu@...il.com>)
PHP <= 5.2.4 multiple Iconv functions denial of service (laurent.gaffie@...il.com)
rPSA-2007-0179-1 krb5 krb5-server krb5-services krb5-test krb5-workstation (rPath Update Announcements <announce-noreply@...th.com>)
iTunes 7.3.x - Heap overflow in album cover parsing (David Thiel <david@...cpartners.com>)
[ MDKSA-2007:175 ] - Updated eggdrop package fix remote buffer overflow (security@...driva.com)
[SECURITY] [DSA 1367-2] New krb5 packages fix arbitrary code execution (Moritz Muehlenhoff <jmm@...ian.org>)
[ MDKSA-2007:174 ] - Updated krb5 packages fix vulnerabilities (security@...driva.com)
[SECURITY] [DSA 1369-1] New gforge packages fix SQL injection (Moritz Muehlenhoff <jmm@...ian.org>)
[HISPASEC] 2K7SEPT6 Magellan Explorer 3.32 build 2305 Remote FTP Client Directory Traversal ("Gynvael Coldwind" <gynvael@...illium.org>)
[ MDKSA-2007:176 ] - Updated kdebase and kdelibs packages fix location bar spoofing issues (security@...driva.com)

September 7 (13 messages)

FLEA-2007-0050-1 krb5 krb5-workstation (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
FLEA-2007-0052-1 gd (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
FLEA-2007-0051-1 star (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
FLEA-2007-0053-1 fetchmail (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
Buffalo AirStation WHR-G54S CSRF vulnerability (Henri Lindberg - Smilehouse Oy <henri.lindberg@...lehouse.com>)
[ MDKSA-2007:177 ] - Updated MySQL packages fix vulnerabilities (security@...driva.com)
Safari 3.0.3 (522.15.5) Buffer overflow (azizov@...efence.ru)
Re: Buffalo AirStation WHR-G54S CSRF vulnerability ("Adrian P" <unknown.pentester@...il.com>)
Re: Toms Gstebuch 1.00 - XSS (administrator@...s-seiten.at)
[USN-511-2] Kerberos vulnerability (Kees Cook <kees@...ntu.com>)
Microsoft SQL Server Distributed Management Objects OLE DLL for SQL Enterprise Manager (sqldmo.dll) remote buffer overflow poc (retrog@...ce.it)
[ MDKSA-2007:174-1 ] - Updated krb5 packages fix vulnerabilities (security@...driva.com)
hack.lu 2007 18-20 October, Luxembourg (info@...k.lu)

September 8 (6 messages)

ZDI-07-050: Trend Micro ServerProtect RPCFN_SetComputerName() Stack Overflow Vulnerability (zdi-disclosures@...m.com)
Re: Re: Toms Gstebuch 1.00 - XSS (hd1979@...il.com)
TxxCMS_Multiple File inclusion Vulnerabilies (nnc@...lloutzone.eu)
ZDI-07-051: Trend Micro ServerProtect TMregChange() Stack Overflow Vulnerability (zdi-disclosures@...m.com)
IMF 2007 - 2nd Call for Participation (Oliver Goebel <goebel@...t.uni-stuttgart.de>)
Netjuke 1.0-rc2 - sql injection & XSS (cod3in@...il.com)

September 10 (15 messages)

phpMyQuote 0.20 Version Multiple Sql And Xss Vulnerabilities (yollubunlar@...lubunlar.org)
Proxy Anket v3.0.1 Sql injection Vulnerable (yollubunlar@...lubunlar.org)
Husrev Forums v2.0.1:PoWerBoard Sql (yollubunlar@...lubunlar.org)
[SECURITY] [DSA 1365-2] New id3lib3.8.3 packages fix denial of service (Moritz Muehlenhoff <jmm@...ian.org>)
[SECURITY] [DSA 1370-1] New phpmyadmin packages fix several vulnerabilities (Thijs Kinkhorst <thijs@...ian.org>)
Announcing ShmooCon 08 and the CFP (B Potter <gdead@...oo.com>)
PHP <=5.2.4 open_basedir bypass & code exec & denial of service (laurent.gaffie@...il.com)
/* PHP <=5.2.4 open_basedir bypass & code exec & denial of service errata ... working on windows too .. */ (laurent.gaffie@...il.com)
Symantec Product Security: Symantec Device Driver Local Elevation of Privilege (secure@...antec.com)
Re: PHP <=5.2.4 open_basedir bypass & code exec & denial of service ("azurIt" <azurit@...ox.sk>)
[Aria-Security Team] social-networkin SQL Injection (Advisory@...a-security.net)
XSIO - Cross Site Image Overlaying (Sven Vetsch / Disenchant <sven.vetsch@...enchant.ch>)
New Whitepaper : g00gle CrewBots (matteo@...y-world.net)
ekoparty 3rd edition CFP ("ekoparty" <no-reply@...party.com.ar>)
Re: XSIO - Cross Site Image Overlaying ("Tod Beardsley" <todb@...nb-security.net>)

September 11 (12 messages)

[SECURITY] [DSA 1370-2] New phpmyadmin packages fix several vulnerabilities (Thijs Kinkhorst <kink@...ian.org>)
rPSA-2007-0181-1 gnome-ssh-askpass openssh openssh-client openssh-server (rPath Update Announcements <announce-noreply@...th.com>)
[SECURITY] Winbind's rfc2307 & SFU nss_info plugin in Samba 3.0.25[a-c] assigns users a primary gid of 0 by default ("Gerald (Jerry) Carter" <jerry@...ba.org>)
RealPlayer/HelixPlayer .au Divide-By-Zero Denial of Service Vulnerability ("OS2A BTO" <os2a.bto@...il.com>)
PHP 5.2.4 <= various mysql functions safemode & open_basedir bypass (laurent.gaffie@...il.com)
NuclearBB Alpha 2 Remote File Inclusion (b14ck1c3@...mail.com)
Assurent VR - Microsoft Agent Crafted URL Stack Buffer Overflow (VR-Subscription-noreply@...urent.com)
[SECURITY] [DSA 1372-1] New ktorrent packages fix directory traversal (Steve Kemp <skx@...ian.org>)
[SECURITY] [DSA 1371-1] New phpwiki packages fix several vulnerabilities (Thijs Kinkhorst <thijs@...ian.org>)
[SECURITY] [DSA 1374-1] New jffnms packages fix several vulnerabilities (Steve Kemp <skx@...ian.org>)
iDefense Security Advisory 09.11.07: Microsoft Windows 2000 Agent URL Canonicalizing Stack Based Buffer Overflow Vulner… (iDefense Labs <labs-no-reply@...fense.c…)
[ GLSA 200709-01 ] MIT Kerberos 5: Multiple vulnerabilities (Matthias Geerdsen <vorlon@...too.org>)

September 12 (17 messages)

RE: ScanAlert Security Advisory ("Nick Merritt" <nick.merritt@...kersafe.com>)
[ MDKSA-2007:178 ] - Updated x11-server packages fix vulnerability (security@...driva.com)
[ MDKSA-2007:179 ] - Updated fetchmail packages fix DoS vulnerability (security@...driva.com)
Boinc Forum Cross Site Scripting Vulrnability (DoZ@...kersCenter.com)
RSA EnVision Reflected XSS Hole ("Stelios Tigkas" <stigkas@...il.com>)
S21SEC-036-EN Ekiga <= 2.0.5 Denial of service (S21sec Labs <labs@...sec.com>)
0DAY: QuickTime pwns Firefox ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Oracle Jinitiator 1.1.8 Vulnerabilities CVE-2007-4467 - Additional Information ("Integrigy Alerts" <alerts@...egrigy.com>)
Re: PHP 5.2.4 <= various mysql functions safemode & open_basedir bypass (Ronald Chmara <ron@...s1.COM>)
Re: PHP 5.2.4 <= various mysql functions safemode & open_basedir bypass (Ben Wheeler <b.wheeler@...c.ac.uk>)
Re Re: PHP 5.2.4 <= various mysql functions safemode & open_basedir bypass (laurent.gaffie@...il.com)
CS Guestbook Admin Name & Md5 Security Vuln (crazy_king@...7.org)
SYMSA-2007-008: Autodesk Backburner 3.0.2 System Backdoor (research@...antec.com)
AIM Arbitrary HTML Display in Notification Window (shell@...shell.net)
CAL-20070912-1 Multiple vendor produce handling AVI file vulnerabilities (Code Audit Labs <vulnhunt@...il.com>)
Apache2 Undefined Charset UTF-7 XSS Vulnerability (cxib@...urityreason.com)
ZDI-07-052: Multiple Kerberos Implementations Authentication Context Stack Overflow Vulnerability (zdi-disclosures@...m.com)

September 13 (10 messages)

[ MDKSA-2007:181 ] - Updated librpcsecgss packages fix vulnerabilities (security@...driva.com)
[ MDKSA-2007:180 ] - Updated id3lib packages fix vulnerability (security@...driva.com)
NDSS 2008 CfP Papers Due September 21 (Crispin Cowan <crispin@...ell.com>)
WinSCP < 4.04 url protocol handler flaw (Kender.Security@...il.com)
Next generation malware: Windows Vista's gadget API (Tim Brown <tmb@...35.com>)
Re: Next generation malware: Windows Vista's gadget API (Todd Manning <sflist@...italoffense.net>)
[ GLSA 200709-02 ] KVIrc: Remote arbitrary code execution (Raphael Marichez <falco@...too.org>)
[ MDKSA-2007:182 ] - Updated quagga packages fix vulnerability and bugs (security@...driva.com)
[ GLSA 200709-04 ] po4a: Insecure temporary file creation (Raphael Marichez <falco@...too.org>)
[ GLSA 200709-03 ] Streamripper: Buffer overflow (Raphael Marichez <falco@...too.org>)

September 14 (13 messages)

Boa (with Intersil Extensions) - HTTP Basic Authentication Bypass (luca.carettoni@...urenetwork.it)
[ MDKSA-2007:183 ] - Updated qt3/qt4 packages fix vulnerability (security@...driva.com)
new XSS vulnerability in php-stats -tracking.php (root@...icker.it)
[security bulletin] HPSBMA02258 SSRT071470 rev.1 - HP System Management Homepage (SMH) for Windows, Incomplete Update Installation (security-alert@...com)
AIM Local File Display in Notification Window (shell@...shell.net)
rPSA-2007-0182-1 httpd mod_ssl (rPath Update Announcements <announce-noreply@...th.com>)
[GOODFELLAS-VULN] ActiveX hpqutil!ListFiles hpqutil.dll - Remote heap overflow (GOODFELLAS SRT <goodfellas@...llcode.com.ar>)
[GOODFELLAS-VULN] FileFind class from MFC Library cause heap overflow (GOODFELLAS SRT <goodfellas@...llcode.com.ar>)
Gelato SQL Injection exploit (s0cratex@...mail.com)
rPSA-2007-0184-1 samba samba-swat (rPath Update Announcements <announce-noreply@...th.com>)
RE: Next generation malware: Windows Vista's gadget API ("Roger A. Grimes" <roger@...neretcs.com>)
[ GLSA 200709-05 ] RealPlayer: Buffer overflow (Raphael Marichez <falco@...too.org>)
[ GLSA 200709-06 ] flac123: Buffer overflow (Raphael Marichez <falco@...too.org>)

September 15 (5 messages)

rPSA-2007-0187-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs (rPath Update Announcements <announce-noreply@...th.com>)
[USN-512-1] Quagga vulnerability (Kees Cook <kees@...ntu.com>)
[ GLSA 200709-07 ] Eggdrop: Buffer overflow (Matthias Geerdsen <vorlon@...too.org>)
[ GLSA 200709-08 ] id3lib: Insecure temporary file creation (Matthias Geerdsen <vorlon@...too.org>)
Axis 207W Wireless Camera Web Interface - Multiple Vulnerabilities (Seth Fogie <seth@...scanner.com>)

September 17 (22 messages)

WinImage 8.10 vulnerabilities (j00ru.vx@...il.com)
IE (Internet Explorer) pwns SecondLife ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
[ GLSA 200709-09 ] GNU Tar: Directory traversal vulnerability (Raphael Marichez <falco@...too.org>)
Media Player Classic Denial of Service (yeikos@...il.com)
Alcatel-Lucent OmniPCX Remote Command Execution (RedTeam Pentesting GmbH <release@...team-pentesting.de>)
[SECURITY] [DSA 1375-1] New OpenOffice.org packages fix arbitrary code execution (joey@...odrom.org (Martin Schulze))
TSLSA-2007-0026 - multi (Trustix Security Advisor <tsl@...stix.org>)
RE: Next generation malware: Windows Vista's gadget API ("avivra" <avivra@...il.com>)
RE: Next generation malware: Windows Vista's gadget API (pgut001@...auckland.ac.nz (Peter Gutmann))
Re: Next generation malware: Windows Vista's gadget API (Tim Brown <tmb@...35.com>)
Re: [Full-disclosure] Next generation malware: Windows Vista's gadget API (Tim Brown <tmb@...35.com>)
Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API (Thierry Zoller <Thierry@...ler.lu>)
RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API ("Roger A. Grimes" <roger@...neretcs.com>)
Re: [Full-disclosure] Next generation malware: Windows Vista's gadget API (Tim Brown <tmb@...35.com>)
Re: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API (pgut001@...auckland.ac.nz (Peter Gutmann))
SYMSA-2007-009: RemoteDocs R-Viewer Code Execution and Sensitive Information Disclosure (research@...antec.com)
Coppermine <= 1.4.12 Cross Site Scripting and Local File Inclusion (L4teral <l4teral@...il.com>)
FLEA-2007-0055-1 openssh openssh-client openssh-server gnome-ssh-askpass (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightl…)
FLEA-2007-0054-1 lighttpd (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
iDefense Security Advisory 09.17.07: Multiple Vendor OpenOffice TIFF File Parsing Multiple Integer Overflow Vulnerabili… (iDefense Labs <labs-no-reply@...fense.c…)
rPSA-2007-0188-1 php5 php5-cgi php5-mysql php5-pear php5-pgsql php5-soap php5-xsl (rPath Update Announcements <announce-noreply@...th.com>)
b1gmail Cross Site Scripting (malibu.r@...mail.com)

September 18 (19 messages)

[ MDKSA-2007:184 ] - Updated cacti packages fix vulnerability (security@...driva.com)
XSS on Obedit v3.03 (fuxxx0rz@...il.com)
RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API (pgut001@...auckland.ac.nz (Peter Gutmann))
GCALDaemon Remote DoS (luca.carettoni@...urenetwork.it)
[security bulletin] HPSBUX02153 SSRT061181 rev.6 - HP-UX Running Firefox, Remote Unauthorized Access or Elevation of Privileges or Denial … (security-alert@...com)
[ MDKSA-2007:185 ] - Updated avahi packages fix vulnerability (security@...driva.com)
security notice: Backdooring Windows Media Files ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Plague in (security) software drivers & BSDOhook utility (Matousec - Transparent security Research <research@...ousec.com>)
Re: security notice: Backdooring Windows Media Files (jf <jf@...glingpointers.net>)
WifiZoo v1.1 ("Hernan Ochoa" <hernan@...il.com>)
RE: Re[2]: [Full-disclosure] Next generation malware: Windows Vista's gadget API (Ed Patterson <epatterson@...ectApps.com>)
RE: security notice: Backdooring Windows Media Files ("Memisyazici, Aras" <arasm@...edu>)
RE: security notice: Backdooring Windows Media Files ("Memisyazici, Aras" <arasm@...edu>)
Re: security notice: Backdooring Windows Media Files ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Uninformed Journal Release Announcement: Volume 8 (Uninformed Staff <sflist@...italoffense.net>)
A little advisory content correction. (j00ru.vx@...il.com)
[ GLSA 200709-11 ] GDM: Local Denial of Service (Raphael Marichez <falco@...too.org>)
[USN-513-1] Qt vulnerability (Kees Cook <kees@...ntu.com>)
[ GLSA 200709-10 ] PhpWiki: Authentication bypass (Raphael Marichez <falco@...too.org>)

September 19 (21 messages)

rPSA-2007-0190-1 kdebase (rPath Update Announcements <announce-noreply@...th.com>)
FLEA-2007-0056-1 openoffice.org (Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>)
TPTI-07-15: Automated Solutions Modbus TCP Slave ActiveX Control Heap Corruption Vulnerability (TSRT@...m.com)
Re: eyeOS checksum prediction (jose@...os.org)
[security bulletin] HPSBST02260 SSRT071471 rev.1 - Storage Management Appliance (SMA), Microsoft Patch Applicability MS07-051 to MS07-054 (security-alert@...com)
[waraxe-2007-SA#052] - dBlog CMS Open Source database retrieval (come2waraxe@...oo.com)
file upload vulnerability in joomla media component (vinodsharma.mmit@...il.com)
[USN-514-1] X.org vulnerability (Kees Cook <kees@...ntu.com>)
rPSA-2007-0189-1 openoffice.org (rPath Update Announcements <announce-noreply@...th.com>)
[security bulletin] HPSBUX02259 SSRT071439 rev.1 - HP-UX Running logins(1M), Remote Unauthorized Access (security-alert@...com)
Multiple vulnerabilities in the gMotor2 engine (Luigi Auriemma <aluigi@...istici.org>)
Re: file upload vulnerability in joomla media component ("Gavin Hanover" <netmunky@...il.com>)
Re: Re: Re: Toms Gstebuch 1.00 - XSS (administrator@...s-seiten.at)
WBR3404TX Broadband Router XSS (azizov@...efence.ru)
PHPBBPLUS 1.5.3 RFI BUG (Mehrad1989@...il.com)
[USN-515-1] t1lib vulnerability (Kees Cook <kees@...ntu.com>)
rPSA-2007-0193-1 gdm (rPath Update Announcements <announce-noreply@...th.com>)
[ GLSA 200709-12 ] Poppler: Two buffer overflow vulnerabilities (Raphael Marichez <falco@...too.org>)
Update? Question on BID 19000 ("Michael Scheidell" <scheidell@...nap.net>)
RE: [Full-disclosure] Next generation malware: Windows Vista's gadget API ("Strykar" <str@...kerzlair.org>)
RE: Panda Antivirus 2008 Local Privileg Escalation (UPS they did it again) ("Panda Security Response" <secure@...dasecurity.com>)

September 20 (21 messages)

Security Advisory for Bugzilla 3.0.1 and 3.1.1 (mkanat@...zilla.org)
0day: PDF pwns Windows ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
[Mlabs] Scrutinising SIP Payloads : Traversing Attack Vectors in VOIP and IM (Aditya K Sood <zeroknock@...niche.org>)
[security bulletin] HPSBUX02251 SSRT071449 rev.2 - HP-UX Running BIND, Remote DNS Cache Poisoning (security-alert@...com)
[security bulletin] HPSBUX02249 SSRT071442 rev.2 - HP-UX Running the Ignite-UX or the DynRootDisk (DRD) get_system_info Command, Local Unq… (security-alert@...com)
SimplePHPBlog Hacking (webmaster666@...il.it)
WebBatch Applications Cross Site Scripting Vulrnability (DoZ@...kersCenter.com)
VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Worksta… (VMware Security team <security@...are.c…)
Re: 0day: PDF pwns Windows (Gadi Evron <ge@...uxbox.org>)
[SECURITY] [DSA 1364-2] New vim packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
Re: Security Advisory for Bugzilla 3.0.1 and 3.1.1 (tkevans@...vans.com)
Re: 0day: PDF pwns Windows ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
PhpBB Xs 2 profile.php Permanent Xss Vulnerability (h3llcode@...mail.it)
WebED-0.8999 Multiple Remote File Inclusion Vulnerability (h3llcode@...mail.it)
PHP-Nuke add admin ALL Versions (h3llcode@...mail.it)
Re: 0day: PDF pwns Windows (Aditya K Sood <zeroknock@...niche.org>)
Vigile CMS v1.8 Multiple Remote XSS Vulnerability (x0kster@...il.com)
[ GLSA 200709-13 ] rsync: Two buffer overflows (Raphael Marichez <falco@...too.org>)
rPSA-2007-0194-1 kdebase (rPath Update Announcements <announce-noreply@...th.com>)
[ MDKSA-2007:186 ] - Updated openoffice.org packages fix TIFF parser vulnerability (security@...driva.com)
[ GLSA 200709-14 ] ClamAV: Multiple vulnerabilities (Pierre-Yves Rofes <py@...too.org>)

September 21 (51 messages)

Re: [Full-disclosure] 0day: PDF pwns Windows ("Joey Mengele" <joey.mengele@...hmail.com>)
[USN-516-1] xfsdump vulnerability (Kees Cook <kees@...ntu.com>)
Re: [irc-security] Multiple vulnerabilities in ircu (Colin Alston <karnaugh@...naugh.za.net>)
ToorCon Final Lineup Announcement ("David Hulton" <h1kari@...rcon.org>)
List all the comment + entry belong to the Yahoo 360 public blog and more... (vnn95@...oo.com)
Re: [Full-disclosure] 0day: PDF pwns Windows (Rohit Srivastwa <rsrivastwa@...oo.com>)
Re: [Full-disclosure] 0day: PDF pwns Windows ("Steven Adair" <steven@...urityzone.org>)
Re: [Full-disclosure] 0day: PDF pwns Windows ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: [Full-disclosure] 0day: PDF pwns Windows (Gadi Evron <ge@...uxbox.org>)
Re: 0day: PDF pwns Windows ("pdp (architect)" <pdp.gnucitizen@...glemail.com>)
Re: [Full-disclosure] 0day: PDF pwns Windows (Chad Perrin <perrin@...theon.com>)
Re: [irc-security] Multiple vulnerabilities in ircu (Tom Laermans <tom.laermans@...ersource.cx>)
Re: 0day: PDF pwns Windows (Crispin Cowan <crispin@...ell.com>)
[SECURITY] [DSA 1376-1] New kdebase packages fix authentication bypass (Steve Kemp <skx@...ian.org>)
Re: [Full-disclosure] 0day: PDF pwns Windows (coderman <coderman@...il.com>)
[SECURITY] [DSA 1377-1] New fetchmail packages fix denial of service (Steve Kemp <skx@...ian.org>)
Re: [USN-515-1] t1lib vulnerability (3APA3A <3APA3A@...URITY.NNOV.RU>)
Neuron News 1.0 Local file inclusion (index.php) (h3llcode@...mail.it)
[Mlabs] Dissecting Internals of Windows XP Svchost : Reverse Engineering Stature (Aditya K Sood <zeroknock@...niche.org>)
TSLSA-2007-0028 - multi (Trustix Security Advisor <tsl@...stix.org>)
[ISR] - Barracuda Spam Firewall. Cross-Site Scripting ("ISR-noreply" <noreply@...obyte.com.ar>)
Re: [Full-disclosure] [USN-515-1] t1lib vulnerability (Ismail Dönmez <ismail@...dus.org.tr>)
DDIVRT-2007-04 NetSupport Manager Authentication Bypass (VulnerabilityResearch@...italDefense.net)
Re: [Mlabs] Dissecting Internals of Windows XP Svchost : Reverse Engineering Stature ("J. Oquendo" <sil@...iltrated.net>)
Re: [USN-515-1] t1lib vulnerability (Kees Cook <kees@...ntu.com>)
Re: [Full-disclosure] 0day: PDF pwns Windows (Chad Perrin <perrin@...theon.com>)
RE: [Full-disclosure] 0day: PDF pwns Windows ("Michael Bitow" <michaelb@...f.org>)
Re: [Full-disclosure] 0day: PDF pwns Windows ("Wayne D. Hoxsie Jr." <wayne@...net.com>)
[SECURITY] [DSA 1377-2] New fetchmail packages fix denial of service (Steve Kemp <skx@...ian.org>)
Re: 0day: PDF pwns Windows (Casper.Dik@....COM)
ZDI-07-053: Microsoft ISA Server SOCKS4 Proxy Connection Leakage (zdi-disclosures@...m.com)
RE: [Full-disclosure] 0day: PDF pwns Windows ("Jeff Wells (jmwells)" <jmwells@...co.com>)
[CAID 35673, 35674, 35675, 35676, 35677]: CA ARCserve Backup for Laptops and Desktops Multiple Server Vulnerabilities ("Williams, James K" <James.Williams@...co…)
Re: PHP-Nuke add admin ALL Versions (n0de@...h0t.com)
Re: CAL-20070912-1 Multiple vendor produce handling AVI file vulnerabilities (Florian Weimer <fw@...eb.enyo.de>)
Re: Re: 0day: PDF pwns Windows (rmk115@...landnews.com)
Re: 0day: PDF pwns Windows ("J. Oquendo" <sil@...iltrated.net>)
Re: [Full-disclosure] 0day: PDF pwns Windows (Thierry Zoller <Thierry@...ler.lu>)
iDefense Security Advisory 09.19.07: Multiple Vendor ImageMagick Multiple Integer Overflow Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 09.19.07: Multiple Vendor ImageMagick Off-By-One Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
Re: [Full-disclosure] 0day: PDF pwns Windows (bugtraq@...security.net)
iDefense Security Advisory 09.19.07: Multiple Vendor ImageMagick Multiple Denial of Service Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
iDefense Security Advisory 09.19.07: Multiple Vendor ImageMagick Sign Extension Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
greensql firewall permanent xss (laurent.gaffie@...il.com)
DEFCON London DC4420 meet - Monday 24th September (Major Malfunction <majormal@...ate-radio.org>)
EEYE: Multiple Vulnerabilities in CA ARCserve for Laptops & Desktops ("eEye Advisories" <eEyeAdvisories@...e.com>)
iDefense Security Advisory 09.20.07: CA ARCserve Backup for Laptops and Desktops Authentication Bypass Vulnerability (iDefense Labs <labs-no-reply@...fense.com…)
Re: SimplePHPBlog Hacking (luca.carettoni@...isoft.com)
Re: [Full-disclosure] 0day: PDF pwns Windows ("Kevin Finisterre (lists)" <kf_lists@...italmunition.com>)
Re: [Full-disclosure] 0day: PDF pwns Windows (Aaron Collins <collinsa@...waii.gov>)
Re: Re: PHP-Nuke add admin ALL Versions (h3llcode@...mail.it)

September 22 (6 messages)

iDefense Security Advisory 09.20.07: CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow Vulnerabiliti… (iDefense Labs <labs-no-reply@...fense.c…)
2 vanilla XSS on Wordpress ‘wp-register.php’ ("Adrian P" <unknown.pentester@...il.com>)
Re: PHP-Nuke add admin ALL Versions (Blaine Elzey <lz@...arine.net>)
[ MDKSA-2007:187 ] - Updated PHP packages fix numerous vulnerabilities (security@...driva.com)
xcms all version arbitrary code execution (x0kster@...il.com)
HITBSecConf2007 - Malaysia Materials & Photos are up ! (Praburaajan <prabu@...kinthebox.org>)

September 24 (25 messages)

Oracle 11g Password algorithm revealed (pete@...efinnigan.com)
Re: 0day: PDF pwns Windows (Crispin Cowan <crispin@...ell.com>)
Re: Re: 0day: PDF pwns Windows (johanfunsale@...oo.com)
Nuke Mobile Entartainment Local File Inclusion (h3llcode@...mail.it)
[ GLSA 200709-15 ] BEA JRockit: Multiple vulnerabilities (Raphael Marichez <falco@...too.org>)
RE: Re[2]: [Full-disclosure] Panda Antivirus 2008 Local Privileg Escalation (UPS they did it again) ("Panda Security Response" <secure@...dasecurity.com>)
Re: Oracle 11g Password algorithm revealed (Thierry Zoller <Thierry@...ler.lu>)
COSEINC Linux Advisory #2: IA32 System Call Emulation Vulnerability (Wojciech Purczynski <cliph@...c.pl>)
Service Pack 3 for Microsoft Sharepoint Services broken (jimbob1@...ck.fr)
Re: Oracle 11g Password algorithm revealed (ak@...-database-security.com)
[security bulletin] HPSBOV02261 SSRT071449 rev.1 - HP OpenVMS running BIND, Remote DNS Cache Poisoning (security-alert@...com)
Re: Re: Oracle 11g Password algorithm revealed (pete@...efinnigan.com)
Re: New Zeroday published ("Joey Mengele" <joey.mengele@...hmail.com>)
New bypass shell for linux (ernealizm@...oo.com)
Arbitrary Command Inclusion (darkbunny91@...il.com)
Google Urchin password theft madness (pagvac <unknown.pentester@...il.com>)
Re: New bypass shell for linux (none@...e.com)
Re: Re: 0day: PDF pwns Windows (Lamont Granquist <lamont@...iptkiddie.org>)
rPSA-2007-0198-1 kernel (rPath Update Announcements <announce-noreply@...th.com>)
[USN-517-1] kdm vulnerability (Kees Cook <kees@...ntu.com>)
Re: 0day: PDF pwns Windows (Chad Perrin <perrin@...theon.com>)
Re: 0day: PDF pwns Windows (Crispin Cowan <crispin@...ell.com>)
Auditing clients program in Oracle (fryxar fryxar <fryxar@...oo.com.ar>)
sk.log v0.5.3 Remote File Inclusion (h3llcode@...mail.it)
ZDI-07-054: IBM Tivoli Storage Manager Express CAD Service Buffer Overflow Vulnerability (zdi-disclosures@...m.com)

September 25 (39 messages)

Re: 0day: PDF pwns Windows (Lamont Granquist <lamont@...iptkiddie.org>)
JSPWiki Multiple Vulnerabilities ("Jason Kratzer" <kratzer.jason@...il.com>)
Re: LFI On SMF 1.1.3 (alex.tracer@...il.com)
RE: 0day: PDF pwns Windows (<Glenn.Everhart@...se.com>)
rPSA-2007-0199-1 openssl openssl-scripts (rPath Update Announcements <announce-noreply@...th.com>)
Simple PHP Blog Multiple Vulnerabilities (luca.carettoni@...urenetwork.it)
[waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11 (come2waraxe@...oo.com)
Re: [Full-disclosure] 0day: PDF pwns Windows ("J. Oquendo" <sil@...iltrated.net>)
[waraxe-2007-SA#054] - Local File Inclusion in Dance Music module for phpNuke (come2waraxe@...oo.com)
n.runs AG puts §202 law to the test - Tools back online (Thierry Zoller <Thierry.Zoller@...ns.com>)
New Shell For Linux & Windows (crazy_king@...7.org)
iDefense Security Advisory 09.25.07: Linux Kernel ALSA snd_mem_proc_read Information Disclosure Vulnerability (iDefense Labs <labs-no-reply@...fense.com>)
SimpGB version 1.46.02 Information Disclosure Vulnerability (securityresearch@...vigilance.com)
Re: Multiple vulnerabilities in rFactor 1.250 (superfreak@...estart.hu)
Re: 0day: PDF pwns Windows (Iggy E <iggy_e@...oo.com>)
SimpNews version 2.41.03 Multiple Path Disclosure Vulnerabilities (securityresearch@...vigilance.com)
SimpGB version 1.46.02 Multiple Path Disclosure Vulnerabilities (securityresearch@...vigilance.com)
SimpGB version 1.46.02 Multiple XSS Attack Vulnerabilities (securityresearch@...vigilance.com)
SimpGB version 1.46.02 File Content Disclosure Vulnerability (securityresearch@...vigilance.com)
SimpNews version 2.41.03 Multiple XSS Attack Vulnerabilities (securityresearch@...vigilance.com)
CORE-2007-0817: Remote Command execution, HTML and JavaScript injection vulnerabilities in AOL's Instant Messaging soft… (Core Security Technologies Advisories <…)
SimpNews version 2.41.03 File Content Disclosure Vulnerability (securityresearch@...vigilance.com)
[ MDKSA-2007:188 ] - Updated postgresql packages prevent access abuse using dblink (security@...driva.com)
Possible Windows Explorer bad PNG file preview integer overflow handling (rocheml@...rack.com)
Re: 0day: PDF pwns Windows (Roland Kuhn <rkuhn@....physik.tu-muenchen.de>)
RE: 0day: PDF pwns Windows ("Thor (Hammer of God)" <thor@...merofgod.com>)
defining 0day (Gadi Evron <ge@...uxbox.org>)
Re: defining 0day ("Brian Loe" <knobdy@...il.com>)
Re: defining 0day ("Brian Loe" <knobdy@...il.com>)
Re: defining 0day ("Adrian Griffis" <adriang63@...il.com>)
Re: defining 0day (Gadi Evron <ge@...uxbox.org>)
Re: defining 0day ("Brian Loe" <knobdy@...il.com>)
Re: defining 0day ("Andrew Weaver" <aweaver@...net>)
Re: defining 0day (Gadi Evron <ge@...uxbox.org>)
RE: defining 0day ("David Gillett" <gillettdavid@...a.edu>)
Re: 0day: PDF pwns Windows (Steve Shockley <steve.shockley@...ckley.net>)
Re: defining 0day (Charles Miller <cmiller@...tiche.org>)
[USN-519-1] elinks vulnerability (Kees Cook <kees@...ntu.com>)
RE: CORE-2007-0817: Remote Command execution, HTML and JavaScript injection vulnerabilities in AOL's Instant Messaging software ("avivra" <avivra@...il.com>)

September 26 (8 messages)

Re: New Shell For Linux & Windows (Vladimir Vitkov <v.vitkov@...ys.bg>)
Re: COSEINC Linux Advisory #2: IA32 System Call Emulation Vulnerability (Robert Swiecki <jagger@...ecki.net>)
Re: Confirmed: Windows Explorer bad PNG file preview integer overflow handling (rocheml@...rack.com)
ERNW Tool Release: CVSS Calculator (mozilla@...-guide.de)
[USN-520-1] fetchmail vulnerabilities (Kees Cook <kees@...ntu.com>)
Joomla multiple vulerabilities (1.0.X >= ) (security@...or.net)
[SECURITY] [DSA 1343-2] New file packages fix arbitrary code execution (Florian Weimer <fw@...ian.org>)
Re: Joomla multiple vulerabilities (1.0.X >= ) ("Gavin Hanover" <netmunky@...il.com>)

September 27 (24 messages)

Re: Joomla multiple vulerabilities (1.0.X >= ) (packet@...ketstormsecurity.org)
[waraxe-2007-SA#056] - Another Sql Injection in NukeSentinel 2.5.11 (come2waraxe@...oo.com)
Re: Re: Confirmed: Windows Explorer bad PNG file preview integer overflow handling (rocheml@...rack.com)
[CAID 35690, 35691, 35692]: CA BrightStor Hierarchical Storage Manager CsAgent Multiple Vulnerabilities ("Williams, James K" <James.Williams@...com>)
[waraxe-2007-SA#055] - Sql Injection in SiteX CMS 0.7.3 Beta (come2waraxe@...oo.com)
Re: Re: Re: Confirmed: Windows Explorer bad PNG file preview integer overflow handling (none@...e.com)
[waraxe-2007-SA#057] - Unauthorized File Upload in SiteX CMS (come2waraxe@...oo.com)
Re: Re: Re: Re: Confirmed: Windows Explorer bad PNG file preview integer overflow handling (rocheml@...rack.com)
Re: Re: Re: Re: Confirmed: Windows Explorer bad PNG file preview integer overflow handling ("Rob Thompson" <my.security.lists@...il.com>)
Re: defining 0day ("Zow" Terry Brugger <zow@...l.gov>)
Re: [waraxe-2007-SA#056] - Another Sql Injection in NukeSentinel 2.5.11 (Bugsman <bugsman@...ero.it>)
[waraxe-2007-SA#058] - Critical Sql Injection in NukeSentinel 2.5.12 (come2waraxe@...oo.com)
Re: Possible Windows Explorer bad PNG file preview integer overflow handling (none@...e.com)
OpenSSL SSL_get_shared_ciphers() off-by-one buffer overflow (Moritz Jodeit <moritz@...eit.org>)
iDefense Security Advisory 09.27.07: Computer Associates BrightStor HSM r11.5 Multiple Vulnerabilities (iDefense Labs <labs-no-reply@...fense.com>)
Re: Service Pack 3 for Microsoft Sharepoint Services broken (bobbyh@...nsonpace.com)
[ GLSA 200709-16 ] Lighttpd: Buffer overflow (Pierre-Yves Rofes <py@...too.org>)
Re: defining 0day (Chad Perrin <perrin@...theon.com>)
[ MDKSA-2007:189 ] - Updated t1lib packages fix vulnerability (security@...driva.com)
[SECURITY] [DSA 1378-1] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
[ GLSA 200709-17 ] teTeX: Multiple buffer overflows (Raphael Marichez <falco@...too.org>)
rPSA-2007-0202-1 kernel (rPath Update Announcements <announce-noreply@...th.com>)
Promise NAS NS4300N GUI bug (Tor Houghton <torh@...us.net>)
Re: Multiple vulnerabilities in rFactor 1.250 (babutski@...il.com)

September 28 (10 messages)

Ruby Net::HTTPS library does not validate server certificate CN (Chris Clark <cclark@...cpartners.com>)
[USN-521-1] libmodplug vulnerability (Kees Cook <kees@...ntu.com>)
RE: defining 0day ("Marvin Simkin" <Marvin.Simkin@....edu>)
[ MDKSA-2007:190 ] - Updated kdebase packages fix KDM vulnerability (security@...driva.com)
Re: [waraxe-2007-SA#053] - Critical Sql Injection in NukeSentinel 2.5.11 (gmdarkfig@...il.com)
Owning Big Brother: How to Crack into Axis IP cameras (research@...checkup.com)
feedreader3 has XSS vulnerability ("Guy Mizrahi" <guy@...king.org.il>)
Re: 0trace - traceroute on established connections (tyter9@...il.com)
Re: defining 0day (Chad Perrin <perrin@...theon.com>)
Re: 0trace - traceroute on established connections (Tony Rall <trall@...aden.ibm.com>)

September 29 (3 messages)

[SECURITY] [DSA 1378-2] New Linux 2.6.18 packages fix several vulnerabilities (dann frazier <dannf@...ian.org>)
[USN-522-1] OpenSSL vulnerabilities (Kees Cook <kees@...ntu.com>)
Public Media Manager <= 1.3 Remote File Inclusion Vulnerability (0in.email@...il.com)

407 messages

Powered by blists - more mailing lists