full-disclosure - Re: 0-day PDF exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20071016183158.135B8DA827@mailserver7.hushmail.com>
Date: Tue, 16 Oct 2007 14:31:57 -0400
From: <full-disclosure@...hmail.com>
To: <full-disclosure@...ts.grok.org.uk>, <phioust@...il.com>,
	<biz4rre@...il.com>
Subject: Re: 0-day PDF exploit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

with all the conditions that need to be met, and the fact that it
is still going to be "user assisted" wouldn't it be easier to just
get the targeted user to run the executable directly?????

i suppose with this xss/xsrf/b4b0 tactic you can bypass the
firewalls at least and militarily grade brute force the login for
the win.

whatever pays the bills bro.

On Tue, 16 Oct 2007 14:25:52 -0400 biz4rre@...il.com wrote:
>no, it's my PoC exploit and product of my researching based on
>public
>information that pdp given in his blog
>
>regards,
>cyanid-E
>
>2007/10/16, phioust <phioust@...il.com>:
>>
>> is pdp architect releasing more 0day into the wild without his
>companies
>> knowledge? I think this breaks the contract from any serious
>security
>> company.  I believe a message from him explaining his positions
>on such
>> things is appropriate or maybe a message from his employeer
>about their
>> disclosure policies?
>>
>> On 10/16/07, biz4rre@...il.com < biz4rre@...il.com> wrote:
>> >
>> > Zero day PDF exploit for Adobe Acrobat
>> >
>> > Workaround:
>> >
>> > Currently unavailable.
>> >
>> > Thanks to:
>> >
>> > pdp (at) gnucitizen.org for his investigation
>> >
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Charset: UTF8
Version: Hush 2.5

wpwEAQECAAYFAkcVA50ACgkQ+dWaEhErNvSG/wP+KcpZEhZuS5fp8uZd4zEUVgskRCy9
oM9otn0DmulfIY27rkpsdX6fsqPkSc8rgUweWcplkjgCyIsrlco/DPI/oxOgQZZAB3HF
E83WVJ62tQBHSaDfWwSJyNCy1t7xfNI7SNWQJs8EZY2AiizO+pYkkidMZRFfkvRjXRVa
aiH3ltg=
=bWnt
-----END PGP SIGNATURE-----


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/