full-disclosure - Security Hole Found In Dave's Sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <7B9BF34CFCB70946831BAC0FDA4EBE0E0749E5@imhotep.ascentek.com>
Date: Thu Sep  8 18:30:13 2005
From: tfrederick at ascentek.com (Ted Frederick)
Subject: Security Hole Found In Dave's Sock

alert toe $EXTERNAL_NET any -> $SNEAKER_NET any (msg:"EXPLOIT:
Unauthorized Sock Overflow"; flow:to_Toe,established;
content:"/sock/toe"; reference:FullDisclosure,2347;
reference:cve,2001-0144; reference:cve,2001-0572;
 classtype:FootAccess-detect; sid:1324; rev:6;)

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Swain,
Kenneth
Sent: Thursday, September 08, 2005 1:19 PM
To: John Kinsella; full-disclosure@...ts.grok.org.uk
Subject: RE: [Full-disclosure] Secuirty Hole Found In Dave's Sock

I have not seen any signatures for snort yet, but I heard that the
bleeding snort team is working on it.I have not seen any signatures for
snort yet, but I heard that the bleeding snort team is working on it.

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of John
Kinsella
Sent: Thursday, September 08, 2005 12:13 PM
To: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Secuirty Hole Found In Dave's Sock

Is anybody else seeing these attacks?  Is this the China hackers again?
I think I saw a hole last week, but my logs aren't that great so I'm
going to have to go back and double-check.

Could this be related to socks disappearing?  Anybody have signatures
for snort?

John

On Thu, Sep 08, 2005 at 01:02:09PM -0400, Dave Cawley wrote:
> 	With the work around, putting it on the left foot, the
> hole will be ABOVE the small toe and should not enlarge. This
> hasn't been verifed yet, but the computer models point to this.
> 
> ***************************************************************
> Dave D. Cawley           |
> High Speed Internet      |    The number of Unix installations
> Duryea, PA               | has grown to 10, with more expected.
> (570)451-4311 x104       |  - The Unix Programmer's Manual,1972
> dave.cawley@...lphia.com |
> ***************************************************************
>                   URL => http://www.adelphia.net 
> 
> -----Original Message-----
> From: full-disclosure-bounces@...ts.grok.org.uk
> [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Daniel
> Sent: Thursday, September 08, 2005 2:53 PM
> To: full-disclosure@...ts.grok.org.uk
> Subject: Re: [Full-disclosure] Secuirty Hole Found In Dave's Sock
> 
> 
> Hi all,
> 
> I see, that the hole getting greater if you use the socket without any
> patches!
> 
> Can anyone verify this?
> 
> kind regards
> Daniel
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/