SecLists.Org Security Mailing List Archive

Any hacker will tell you that the latest news and exploits are not found on any web site—not even Insecure.Org. No, the cutting edge in security research is and will continue to be the full disclosure mailing lists such as Bugtraq. Here we provide web archives and RSS feeds (now including message extracts), updated in real-time, for many of our favorite lists. Browse the individual lists below, or search them all:

Insecure.Org Lists

Nmap Development — Unmoderated technical development forum for debating ideas, patches, and suggestions regarding proposed changes to Nmap and related projects. Subscribe here.

New VA Modules: MSF: 1, Nessus: 7 New VA Module Alert Service (May 19)
This report describes any new scripts/modules/exploits added to Nmap,
OpenVAS, Metasploit, and Nessus since yesterday.

== Metasploit modules (1) ==

r15300
http://metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/multi/http/activecollab_chat.rb
Active Collab "chat module" <= 2.3.8 Remote PHP Code Injection Exploit

== Nessus plugins (7) ==

59195 pidgin_otr_3_2_1.nasl...

Re: Bug - NMAP 5.51 GUI Interface David Fifield (May 18)
Thanks for making this report. Does the latest development release
(5.61TEST5) also have this problem? I cannot reproduce it, so it may
have been fixed already.

David Fifield

Re: NSE: Credential disclosure in modems Huawei HG510, HG520x, HG530 and possibly others David Fifield (May 18)
I'm fine with committing this with Spanish strings, and adding other
languages as we are able.

If the script is in "version" category, it should call
nmap.set_port_version.

David Fifield

Re: Nmap-service-probe supported languages Brandon Enright (May 18)
Perhaps I'm not understanding you but if you mean specifically for -sV
scans with the probe and match lines, many matches will be very hard to
localize because strings from the service are sometimes used in output.

Is this what you mean?

Regards,

Brandon

Re: Nmap-service-probe supported languages Daniel Miller (May 18)
CPE standard [1] references ISO-639-1 [2], so we should probably use
those codes.

Dan

[1]
http://csrc.nist.gov/publications/nistir/ir7695/NISTIR-7695-CPE-Naming.pdf
[2] https://en.wikipedia.org/wiki/ISO_639-1

Re: [NSE] http-traceroute Hani Benhabiles (May 18)
Hi Henri,

Thanks.

Added.

Done. Removed "results" too.

I added a verbosity script argument defaulting to 0. I prefer your first
suggestion and I think it is better to default to a low output size and
let people decide if they want a more detailed output rather than
automatically choosing for them through a scoring mechanism.

the problem with a name like http-reverse-proxy-detect is that in the
future we may write scripts which...

New VA Modules: OpenVAS: 29, MSF: 1, Nessus: 71 New VA Module Alert Service (May 18)
This report describes any new scripts/modules/exploits added to Nmap,
OpenVAS, Metasploit, and Nessus since yesterday.

== OpenVAS plugins (29) ==

r13470 103489 gb_symantec_web_gateway_53444.nasl
http://wald.intevation.org/scm/viewvc.php/trunk/openvas-plugins/scripts/gb_symantec_web_gateway_53444.nasl?root=openvas&view=markup
Symantec Web Gateway Multiple Vulnerabilities

r13470 103490 gb_fishey_53603.nasl...

Nmap-service-probe supported languages sean rivera (May 18)
Hey all,

Is there a list of all the supported languages for Nmap-service-probe? I
cannot seem to find anything on the website about it.

Re: NSE: Credential disclosure in modems Huawei HG510, HG520x, HG530 and possibly others Paulino Calderon (May 18)
Yes, I forgot to mention that. This version of the script has hardcoded
strings in spanish. The URI /Listadeparametros.html is in spanish too.
¿What model do you have? Maybe we can find the equivalent and create a
version for other languages. Can you access /rom-0 ? You can download
the configuration file remotely with that URI here.

Cheers.

Re: [NSE] http-traceroute Henri Doreau (May 18)
Hi Hani,

the script works well and your code is neat and tidy, good job!

A couple comments:
- I think script description should mention that this implementation
is based on the work of Nicolas Gregoire (nicolas.gregoire () agarri fr)
and Julien Cayssol (tools () aqwz com).
- I noticed a couple unnecessary variable declarations (line 171,
"i" doesn't have to be declared, "response" is re-declared line 175).
There...

Re: NSE: Credential disclosure in modems Huawei HG510, HG520x, HG530 and possibly others Aleksandar Nikolic (May 17)
I've just mentioned routerpwn on irc the other day, fun stuff.
Those modems are "popular" here too (Serbia) as most ISPs give them out.

One thing tho, is that "/Listadeparametros.html" specific to Spanish language ?

Cheers,
Aleksandar

Re: NSE: Credential disclosure in modems Huawei HG510, HG520x, HG530 and possibly others Paulino Calderon (May 17)
Here is the fixed version. UTF-8 characters got replaced somehow.

Cheers.

NSE: Credential disclosure in modems Huawei HG510, HG520x, HG530 and possibly others Paulino Calderon (May 17)
Hi list,

Here is my NSE script for detecting and extracting information from
vulnerable Huawei modems. I know that these modems are popular in México
(Over 2 million devices here), Spain, Italy, Ecuador and other countries
in south america but let me know if you know other ISPs using them. I
also know Colombia have a lot of them but they have patched versions
over there. This vulnerability was reported a long time ago but ISPs
don't...

[NSE] http-traceroute Hani Benhabiles (May 17)
Hi list,

description = [[
Exploits the Max-Forwards HTTP header to detect the presence of reverse
proxies.

The script works by sending HTTP requests with values of the
Max-Forwards HTTP header varying
from 0 to 2 and checking for any anomalies in certain response values
such as the status code,
Server, Content-Type and Content-Length HTTP headers and body values
such as the html title.

For more information, see:
*...

New VA Modules: MSF: 1, Nessus: 20 New VA Module Alert Service (May 17)
This report describes any new scripts/modules/exploits added to Nmap,
OpenVAS, Metasploit, and Nessus since yesterday.

== Metasploit modules (1) ==

r15290 http://metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/multi/misc/batik_svg_java.rb
Squiggle 1.7 SVG Browser Java Code Execution

== Nessus plugins (20) ==

59117 google_chrome_19_0_1084_46.nasl
http://nessus.org/plugins/index.php?view=single&id=59117
Google...

Nmap Hackers — Moderated list for the most important new releases and announcements regarding the Nmap Security Scanner and related projects. We recommend that all Nmap users subscribe.

Last Chance to Apply for the Nmap/Google Summer of Code! Fyodor (Apr 04)
Hi Folks. I'm happy to announce that the Nmap Project has again been
accepted into the Google Summer of Code program. This innovative and
extraordinarily generous program provides $5,000 stipends to college
and graduate students who want to spend the summer improving Nmap!
They gain valuable experience, get paid, strengthen their résumé, and
write code for millions of users.

Previous SoC students helped create the Nmap Scripting Engine,...

Nmap 5.61TEST5 released with 43 new scripts, improved OS & version detection, and more! Fyodor (Mar 09)
Hi folks! We've been working hard for the last 2 months since
5.61TEST4, and I'm pleased to announce the results: Nmap 5.61TEST5.
This release has 43 new scripts, including new brute forcers for http
proxies, SOCKS proxies, Asterisk IAX2, Membase, MongoDB, Nessus
XMLRPC, Redis, the WinPcap remote capture daemon, the VMWare auth
daemon, and old-school rsync. Better check that your passwords are
strong! Some other fun scripts are...

Updates on Download.Com caught adding malware to Nmap installer Fyodor (Dec 06)
Hi Folks. A lot has happened since yesterday's email about
Download.com's antics (http://seclists.org/nmap-hackers/2011/5) and I
wanted to send a quick update.

First of all, several people complained about my angry tone and my
telling Download.com to "F*ck" themselves. I appologize to anyone
offended. But if you ever spend more than 14 years creating free
software as a gift to the community, only to have it used as bait by...

C|Net Download.Com is now bundling Nmap with malware! Fyodor (Dec 05)
Hi Folks. I've just discovered that C|Net's Download.Com site has
started wrapping their Nmap downloads (as well as other free software
like VLC) in a trojan installer which does things like installing a
sketchy "StartNow" toolbar, changing the user's default search engine
to Microsoft Bing, and changing their home page to Microsoft's MSN.

The way it works is that C|Net's download page (screenshot attached)...

SecTools.Org relaunched based on your survey responses! Fyodor (Nov 04)
Hi folks! Remember the latest Nmap survey that almost 3,000 of you
filled out? Well, it took a while, but I'm happy to report that we've
tabulated the results and launched a new version of the SecTools.Org
top security tools list! In addition to updating the data, we've
dramatically improved the site. It now includes user ratings and
reviews, tracks release dates, offers searching and sorting, and even
lets you nominate your...

Nmap 5.59BETA1 Released! Fyodor (Jun 30)
Hi Folks. Other than the recent informal IPv6 commemorative edition,
we haven't had a real Nmap release in more than four months since
5.51. That is in part because we've been so busy with seven (!)
full-time Google Summer of Code students cranking out tons of
excellent code! But I think we've pulled this together into a release
we can be proud of, and I'm happy to announce Nmap 5.59BETA1!

This version includes:
o 40 new...

Happy World IPv6 Day From the Nmap Project! Fyodor (Jun 08)
Hi Folks. You have probably heard that today is World IPv6 Day, with
sites like Google, Facebook, and Yahoo publishing IPv6 records for
their main web sites. I'm happy to report that the Nmap Project is
celebrating in several ways:

==Scanme Updated to IPv6==

You probably know that we run the machine scanme.nmap.org as a system
people are allowed to use as a target for test scans and the like.
That system now has native IPv6 support. So...

Nmap 5.51 and SoC Opportunity Fyodor (Apr 05)
Hi Folks! I'm happy to report that the Nmap 5.50 release was a big
success, with nearly 300,000 downloads in the first two weeks. That
much attention inevitably uncovers some bugs, so we released Nmap 5.51
in February to address them. You can find the release notes at
(http://seclists.org/nmap-dev/2011/q1/518) and the downloads at
http://nmap.org/download.html.

I also wanted to let you know about a serious potential competitive
threat to...

Nmap 5.50: Now with Gopher protocol support! Fyodor (Jan 28)
Hi folks! It has been a year since the last Nmap stable release
(5.21) and six months since development version 5.35DC1, so I'm
pleased to release Nmap 5.50! I'm sure you'll find that it was worth
the wait!

A primary focus of this release is the Nmap Scripting Engine, which
has allowed Nmap to expand up the protocol stack and take network
discovery to the next level. Nmap can now query all sorts of
application protocols,...

Other Excellent Security Lists

Bugtraq — The premier general security mailing list. Vulnerabilities are often announced here first, so check frequently!

New Open Source Web Application Vulnerability Scanner Available webvulscan (May 18)
Hi All,

There is a new web application vulnerability scanner available. It is called WebVulScan and it is open source. Here is
the link for it if you want to check it out: http://code.google.com/p/webvulscan/

Regards,

Dermot Blair

SEC Consult SA-20120518 :: Memory overwrite vulnerability in libwpd (OpenOffice.org) - CVE-2012-2149 SEC Consult Vulnerability Lab (May 18)
SEC Consult Vulnerability Lab Security Advisory < 20120518-0 >
=======================================================================
title: libwpd WPXContentListener::_closeTableRow() memory
overwrite
product: OpenOffice.org
vulnerable version: 3.3.0/3.4 Beta 1 and probably earlier versions
fixed version: 3.4
CVE: CVE-2012-2149
impact: high...

H2HC Brazil 9th Edition - Call for Papers Rodrigo Rubira Branco $BSDaemon$ (May 18)
CALL FOR PAPERS - Hackers 2 Hackers Conference 9th edition

The call for papers for H2HC 9th edition is now open. H2HC is a hacker
conference taking place in Sao Paulo, Brazil, from 18 to 23 October 2012.

[ - Introduction - ]

For the ninth consecutive year and past success we have been having,
the annual Hackers 2 Hackers Conference will be held again in Sao Paulo,
from 18 to 23 October 2012 and aims to get together industry,
government,...

Re: [oss-security] CVE Request: Planeshift buffer overflow Kurt Seifried (May 18)
That's a very different scenario than this one as I understand it.
TORCS actually has a realistic requirement for using TORCS files
supplied by the user (that are downloaded from remote sites/etc.).

In the case of Planeshift the chatbubbles.xml is not supplied by the
user, it comes with the program and is installed into a system
directory. This is very different from the TORCS situation. If you can
convince a user to start replacing system...

Re: [oss-security] CVE Request: Planeshift buffer overflow Kurt Seifried (May 18)
It doesn't sounds like any security boundary is being crossed.

If you can edit that file I'm guessing you can also modify the other
game files (executables, libraries, etc.), so there is no escalation
of privilege as far as I can tell. If the ifle is owned by a unique
user (e.g. it's a local config thing) again, if you can edit a users
files you already have access, so no escalation of privilege. If this
is correct then I will not...

[SECURITY] [DSA 2475-1] openssl security update Raphael Geissert (May 18)
-------------------------------------------------------------------------
Debian Security Advisory DSA-2475-1 security () debian org
http://www.debian.org/security/ Raphael Geissert
May 17, 2012 http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : openssl
Vulnerability : integer underflow
Problem type :...

[security bulletin] HPSBOV02780 SSRT100766 rev.1 - HP OpenVMS ACMELOGIN, Local Unauthorized security-alert (May 18)
Note: the current version of the following document is available here:
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c03333494

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c03333494
Version: 1

HPSBOV02780 SSRT100766 rev.1 - HP OpenVMS ACMELOGIN, Local Unauthorized
Access and Increased Privileges

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date:...

Re: [oss-security] CVE Request: Planeshift buffer overflow Kurt Seifried (May 18)
I'm not familiar with this software (it's a game?) the chat bubbles,
can they come from remote users (like some sort of internal game chat)?

[SECURITY] [DSA 2474-1] ikiwiki security update Raphael Geissert (May 17)
-------------------------------------------------------------------------
Debian Security Advisory DSA-2474-1 security () debian org
http://www.debian.org/security/ Raphael Geissert
May 16, 2012 http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : ikiwiki
Vulnerability : cross-site scripting
Problem type...

DDIVRT-2012-44 Epicor Returns Management SOAP-Based Blind SQL Injection ddivulnalert (May 17)
Title
-----
DDIVRT-2012-44 Epicor Returns Management SOAP-Based Blind SQL Injection

Severity
--------
High

Date Discovered
---------------
April 12, 2012

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: Chris Graham and r () b13$

Vulnerability Description
-------------------------
Digital Defense, Inc. (DDI) has discovered a blind SQL injection vulnerability in the Epicor Returns Management
software SOAP...

[security bulletin] HPSBUX02782 SSRT100844 rev.1 - HP-UX Running OpenSSL, Remote Denial of security-alert (May 17)
Note: the current version of the following document is available here:
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c03333987

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c03333987
Version: 1

HPSBUX02782 SSRT100844 rev.1 - HP-UX Running OpenSSL, Remote Denial of
Service (DoS)

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date: 2012-05-17
Last...

[security bulletin] HPSBUX02777 SSRT100854 rev.1 - HP-UX Running Java JRE and JDK, Remote Denial security-alert (May 17)
Note: the current version of the following document is available here:
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c03316985

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c03316985
Version: 1

HPSBUX02777 SSRT100854 rev.1 - HP-UX Running Java JRE and JDK, Remote Denial
of Service (DoS), Unauthorized Modification and Disclosure of Information

NOTICE: The information in this Security Bulletin should be...

[ MDVSA-2012:078 ] imagemagick security (May 17)
_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2012:078
http://www.mandriva.com/security/
_______________________________________________________________________

Package : imagemagick
Date : May 17, 2012
Affected: 2011.
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has...

[ MDVSA-2012:077 ] imagemagick security (May 17)
_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2012:077
http://www.mandriva.com/security/
_______________________________________________________________________

Package : imagemagick
Date : May 17, 2012
Affected: 2010.1, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple...

[SECURITY] [DSA 2473-1] openoffice.org security update Florian Weimer (May 17)
-------------------------------------------------------------------------
Debian Security Advisory DSA-2473-1 security () debian org
http://www.debian.org/security/ Florian Weimer
May 16, 2012 http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : openoffice.org
Vulnerability : buffer overflow
Problem...

Full Disclosure — A lightly moderated high-traffic forum for disclosure of security information. Fresh vulnerabilities sometimes hit this list many hours before they pass through the Bugtraq moderation queue. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. Unfortunately, most of the posts are worthless drivel, so finding the gems takes patience.

[SECURITY] [DSA 2476-1] pidgin-otr security update Jonathan Wiltshire (May 19)
-------------------------------------------------------------------------
Debian Security Advisory DSA-2476-1 security () debian org
http://www.debian.org/security/ Jonathan Wiltshire
May 19, 2012 http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : pidgin-otr
Vulnerability : format string vulnerability...

Re: FW: Curso online - Profesional pentesting - Promocion ( 25% de descuento ) Charles Morris (May 19)
stop flexing

FW: Curso online - Profesional pentesting - Promocion ( 25% de descuento ) Thor (Hammer of God) (May 19)
Hello Juan.

After multiple requests for you to remove me from your unsolicited (and illegal) emails, I see you have refused to do
so. This indicates and illustrates your acceptance of a "default opt-in until explicit opt-out" policy notwithstanding
the fact you do not honor the opt-out.

Though I still do not wish to receive your mails, I see you are offering penetration testing services. I find this
interesting. In order to...

Re: Google Accounts Security Vulnerability Thor (Hammer of God) (May 19)
I tried, and it didn't work (couldn't repro).

None of this matters - if you have username and password, you can check mail via POP3 or IMAP. Last time I checked,
that was "by design." If anyone is saying this is some sort of vulnerability because someone "happens across your
username and password" then they are in the wrong business.

Michael - for you to make these claims, get Google involved, and post their...

Re: Google Accounts Security Vulnerability Jeffrey Walton (May 18)
"Two-channel breached: a milestone in threat evaluation, and a floor
on monetary value,"
http://financialcryptography.com/mt/archives/001349.html.

Re: Checking out backdoor shells Kai (May 18)
Dear Mr. MustLive#2,

hello and welcome to the full-disclosure mailing list.

Faithfully yours

On Fri, 18 May 2012 15:50:04 -0500, Adam Behnke wrote:

Checking out backdoor shells Adam Behnke (May 18)
A backdoor shell can be a PHP, ASP, JSP, etc. piece of code which can be
uploaded on a site to gain or retain access and some privileges on a
website. Once uploaded, it allows the attacker to execute commands through
the shell_exec () function, upload/delete/modify/download files from the web
server, and many more. For defacers, it allows them to navigate easily to
the directory of the public_html or /var/www and modify the index of the
page....

Re: Google Accounts Security Vulnerability Dan Kaminsky (May 18)
Surely you can create a sock puppet for debugging purposes.

Re: Google Accounts Security Vulnerability coderman (May 18)
++

best thread on list all month. :)

now if only Google's two factor auth could use tamper resistant tokens.
i trust my phone even less than my browser... :(

H2HC Brazil 9th Edition - Call for Papers Rodrigo Rubira Branco (BSDaemon) (May 18)
CALL FOR PAPERS - Hackers 2 Hackers Conference 9th edition

The call for papers for H2HC 9th edition is now open. H2HC is a hacker
conference taking place in Sao Paulo, Brazil, from 18 to 23 October 2012.

[ - Introduction - ]

For the ninth consecutive year and past success we have been having,
the annual Hackers 2 Hackers Conference will be held again in Sao Paulo,
from 18 to 23 October 2012 and aims to get together industry,
government,...

SEC Consult SA-20120518 :: Memory overwrite vulnerability in libwpd (OpenOffice.org) - CVE-2012-2149 SEC Consult Vulnerability Lab (May 18)
SEC Consult Vulnerability Lab Security Advisory < 20120518-0 >
=======================================================================
title: libwpd WPXContentListener::_closeTableRow() memory
overwrite
product: OpenOffice.org
vulnerable version: 3.3.0/3.4 Beta 1 and probably earlier versions
fixed version: 3.4
CVE: CVE-2012-2149
impact: high...

Re: LinkedIn CSRF: Login Brute Force Mario Vilas (May 18)
It's a capcha bypass, not a CSRF as claimed. I'm also not quite sure
if the capcha has really been bypassed at all as the blog post in
spanish says you have to enter it manually from time to time...

"Si linkedin nos pone problemas con el captcha, lo que debemos hacer
es ingresar via web con una cuenta valida, capturar nuevamente el
Token e intentarlo nuevamente con ese token."

This line is quite funny: "Nota: LinkedIn...

Re: Google Accounts Security Vulnerability Michael Gray (May 18)
I'm not interested in providing that information. You can reproduce it
without knowing my user name.

Re: LinkedIn CSRF: Login Brute Force Julius Kivimäki (May 18)
Where's the csrf? All I see here is an useless bruteforce attack.

2012/5/17 Fernando A. Lagos B. <fernando () zerial org>

Vulnerabilities on Cryptographp Lu33Y (May 18)
During a security assessment, I’ve found that my target was using Cryptographp which is a PHP script used for generate
« captchas ».

It was easily noticeable when I’ve found the following URL:

http://WWWW/cryptographp.inc.php?cfg=XX&sn=YYYY&ZZZZ

So I've decided to take a look at the source code and I’ve found 2 vulnerabilities.

The first one has already been disclosed but hasn’t been corrected. This vulnerability...

Security Basics — A high-volume list which permits people to ask "stupid questions" without being derided as "n00bs". I recommend this list to network security newbies, but be sure to read Bugtraq and other lists as well.

Re: Tool to find rouge wireless access points? Vic Vandal (May 18)
Jon,

If you have Cisco APs strategically deployed around your building the Cisco Wireless Access Controller can use its DB
of authorized access points to detect rogue APs and triangulate their location. That triangulation ensures that you're
not picking up APs or other wireless devices that are outside of your building.

You can also buy wireless jammers that DoS unknown APs on the network.

-Vic

----- Original Message -----
From:...

Re: Enterprise Password & Session Management Tool kartik . netsec (May 18)
Cyberark is a very good tool which can solve your purpose. As far a Xceedium is concerned, we have had a very bad
experience with this product. We have a list of cases logged in at Xceedium support and they are still pending
resolution since last 4-5 months.I am bashing the product but I feel it is still maturing and needs time till it
becomes stable.

Thanks,
Kartik, CISSP, CISM...

Re: Tool to find rouge wireless access points? Marcus Adams (May 18)
Hi Jon,

Wired detection of rogue APs has two possible downsides. The first is
that you are simply relying on the MAC address in use to be authentic.
This can be easily modified by most home routers. The second is that
even when you do detect a rogue AP via MAC address, you may not know
where the device actually exists (depends on your network).

Doing an actual wireless war walk is the only sure way to root out any
rogue access points. The best...

RE: Enterprise Password & Session Management Tool Nick Duda (May 17)
+1.

We are a Secret Server (Thycotic) customer (as well as their other product Password Reset Server) and love the
solution. We have it implemented globally across 17 sites and leverage it beyond our IT staff. I believe it is the top
solution for enterprise password and credential management but doesn’t address remote sessions for vendors as good as
other products (like Xceedium). Secret Server has some good built in functionality for...

Re: Enterprise Password & Session Management Tool Shane Markley (May 17)
I was just @ Interop in Las Vegas last week and checked out a company
called Thycotic on the Expo floor that looked like they had a pretty
decent solution for this.

Check them out @ www.thycotic.com

SM

RE: Enterprise Password & Session Management Tool Nick Duda (May 17)
www.Xceedium.com , X-Suite.

- Nick

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of indiandiamonds () gmail com
Sent: Thursday, May 17, 2012 12:25 PM
To: security-basics () securityfocus com
Subject: Enterprise Password & Session Management Tool

Could you suggest a tool that can be used for Enterprise password management, for all network devices, as well as
proovide...

Risk Tracking Software Peter Milleson (May 17)
Hi all,

Anyone know of a good risk/vulnerability tracking software preferably
open source? Most of the security related tracking software is geared
more towards incident handling like RTIR, AIRT, etc. I'm looking for a
way to track vulnerabilities/exploits as they are announced sort of
like Mitre/CVE or NVD but less geared towards tracking every
vulnerability and more towards specific ones I'm interested in.

Here's basically the...

Re: Enterprise Password & Session Management Tool Mlungwana, Buyani (May 17)
Check out cyberark its pretty good

----- Original Message -----
From: indiandiamonds () gmail com [mailto:indiandiamonds () gmail com]
Sent: Thursday, May 17, 2012 06:25 PM
To: security-basics () securityfocus com <security-basics () securityfocus com>
Subject: Enterprise Password & Session Management Tool

Could you suggest a tool that can be used for Enterprise password management, for all network devices, as well as
proovide...

Enterprise Password & Session Management Tool indiandiamonds (May 17)
Could you suggest a tool that can be used for Enterprise password management, for all network devices, as well as
proovide Remote sessions to vendors into company network.

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how
it benefits your company...

Re: Open Source Web Security & Content Filtering Francois Yang (May 17)
Anwar,
could you tell us what it is that you're looking to accomplish?
what do you want this Open Source Web Security & Content Filtering to do?
URL filtering, reverse proxy, application firewall, etc...?
let us know so that we can better answer your question.

Frank

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance...

Open Source Web Security & Content Filtering Anwar Khan (May 17)
Dear All,

Can anyone suggest "Open Source Web Security & Content Filtering"
Software which is free to use except "Squid"

I know Squid can help, but i want to know if any other good one is
available, otherwise last option will be Squid only :(

Regards,
Anwar

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the...

[Free article] Reuse your skills: Penetration testing for auditing maciej . kozuszek (May 17)
Hello list,

I'd like to share with you a free article written by Jeremy Faircloth, author of 'Penetration Tester's Open Source
Toolkid 3rd Ed'.

Access to the article requires no free account or download. You can read it here:

http://pentestlab.org/reuse-your-skills-penetration-testing-for-auditing/

Enjoy the content!

Warm regards,
Maciej

------------------------------------------------------------------------
Securing...

RE: Tool to find rouge wireless access points? David Gillett (May 16)
An AP typically has two interfaces -- the radio, and the Ethernet
connection. A few of the largest "enterprise" manufacturers will configure
them to use consecutive MAC addresses within the prefix allocated to the
manufacturer. But a lot of consumer/SOHO gear uses a radio from one source
and an Ethernet ASIC from another, and retains the MAC addresses supplied by
those manufacturers.

So the MAC address of the radio side (ESSID,...

RE: Tool to find rouge wireless access points? Dan Lynch (May 16)
I read the opposite, like so: I have a network with no wireless access, and multiple physical locations. How do I
detect if a user somewhere has connected a wireless access point to a network jack? I could visit each location and use
a wifi detector, but then how would I know if an AP I detected is connected to my network, and not the doctor's office
next door? Is there a way to scan the *wired* network for connected APs?

The netdisco...

Re: website monitoring Don Thomas (May 16)
http://www.site24x7.com/

Regards,
Don Thomas

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase,
install and use a thawte...

Penetration Testing — While this list is intended for "professionals", participants frequenly disclose techniques and strategies that would be useful to anyone with a practical interest in security and network auditing.

Securing Citrix Adrián Puente Z. (May 16)
Hi everyone!

I am looking for a good reference to secure a Citrix server to avoid a user to gain acces to the operating system. So
far I have some ideas like restricting the execution of the cmd.exe and (maybe) explorer.exe from with a group policy
in the domain.

If you know about any document I can look at or have any experience about this that want to share I will be very
thankful. Thanks in advance.

Regards,

---
Adrián Puente Z....

Re: Question of Likelihood Pete Herzog (May 16)
Hi,

Have you looked into the OSSTMM ravs- attack surface classification
and metrics? It would help you categorize the order in the way you
want here- by what they do and not some guessed weighting or priority
system. Basically it would let you prioritize by 5 vulnerability
classifications and that way if something provides access in any way
it's classified as a higher priority than something that just gives an
exposure.

Sincerely,...

sslcaudit 1.0 released Alexandre Bezroutchko (May 15)
Hello,

I would like to announce the release of sslcaudit 1.0.

The goal of sslcaudit project is to develop a utility to automate
testing SSL/TLS clients for
resistance against MITM attacks. It is useful for testing thick clients,
mobile applications,
appliances, pretty much anything communicating over SSL/TLS over TCP.

PDF user-guide is available here:
http://www.gremwell.com/sslcaudit_files/doc/sslcaudit-user-guide-1.0.pdf
Download and...

Re: Question of Likelihood Justin Rogosky (May 14)
Hi,

Carnal 0wnage is doing a blog series about this very subject.
http://carnal0wnage.attackresearch.com/2012/04/from-low-to-pwned-0-intro.html

My opinion is that if you are doing a report, it would be of more
value to list the vulnerabilities separately with the reformatted tool
output (or other methodology you are applying to list them as "low").
But add a separate section that shows how the various "enabling"...

Question of Likelihood Pen Testar (May 14)
I'm testing an app with sensitive information that is full of holes. Reflected and persisted XSS, CRSF, various
injection attacks… you name it.

You also have a bunch of vulns that aren’t typically of high likelihood, but in the presence of the other vulns above
(I’ll call them the “enabling” vulns), some of these lows are easier to exploit. When you rank, do you rank each vuln
independently or in context of others?

I can see...

t2'12: Call for Papers 2012 (Helsinki / Finland) Tomi Tuominen (May 12)
# t2'12 - Call For Papers #
Helsinki, Finland
October 25 - 26, 2012

We are pleased to announce the annual t2'12 infosec conference, which
will take place in Helsinki, Finland, from October 25 to 26, 2012.

We are looking for original, preferably technical presentations in the
fields of information security. Presentations should last a minimum of
60 minutes and a maximum of two...

A survey on web application attacks Hannes Holm (May 11)
Hi pen-test subscribers,

I am researching the domain consensus regarding the effectiveness of different web application firewalls (WAF)s and
would be glad if you could spare a few minutes of your time to answer a survey on the topic.

By completing this survey you will:

* Help build valuable domain consensus on the topic of WAF effectiveness.
* Be able to compare your answers to the answers of others.
* Have the chance to win a 100...

Announce: Italian Hacker Game Cracca al Tesoro - Crack A Treasure Aspy (May 04)
It is the 6 th edition of the game.

It 's very much like a treasure hunt but more... hight tech!
The team need to find five hidden access point within a city, crack
them, then find the servers behind them, hack them to find clues to
the next target ...

Next date: Genoa, Italy, May 12
Joining is free.

Web Site
http://www.wardriving.it

nullcon Delhi 2012 Call for Paper/Call for Event nullcon (May 01)
Hi All,

For the very first time nullcon now comes to Delhi - to showcase cutting
edge security technologies and discuss new attack vectors and security
threats among the Corporate world and the Government sector. The event
brings together thought leaders,Corporates, Government and security
professionals all under one roof.

Prototype:
-------------
We are introducing a new sub-event - Prototype at nullcon Delhi 2012. The
event provides...

xSQL Scanner 1.6 - Released Rodrigo Matuck (May 01)
Hi

Everyone

New version of xSQL Scanner is available with following features:

- PostgreSQL support added;
- SQL PortScan updated;
- Exceptions fixed;
- Progressbar bug fixed;
- MSSQL 7 DoS module added.
- MSSQL Empty password exploit module added.
- Session support added
- Visual modified
- Minor Bugs fixed
- Auto-detect feature fixed

Also i uploaded the xTSCrack with bugs fixed.

http://www.4shared.com/zip/4YrGt7hG/xsqlscanner-16.html...

[Tool update] VoIP Hopper 2.04 released Jason Ostrom (Apr 29)
VoIP Hopper 2.04 security tool is released:

http://voiphopper.sourceforge.net

New Avaya, Alcatel-Lucent, and LLDP-MED spoofing support. Thanks to Nicolas Roux of France for his Alcatel source
contribution and debugging help. The Alcatel support has only been partially tested on a production network - I'm
requesting the help from anyone who has access to Alcatel-Lucent to test the three new modes of VoIP Hopper, and please
let me know....

Anti-fingerprinting techniques cr0hn (Apr 25)
Hello everybody!

I just released the slides of a course about anti-fingerprinting
techniques. The course talking about:
– A brief introduction of FreeBSD.
– How fingerprinting works.
– How defeat the fingerprinting test.
– Practical examples for evade the test for some services:
+ Web server.
+ FTP server.
+ SSH server.
- A long section dedicated for WordPress.
+ Fingerprinting methods.
+ Tools to test it.
+ Protection techniques.

I...

[HITB-Announce] HITB Magazine Issue 008 (now with print edition!) Hafez Kamal (Apr 23)
The 8th issue of the HITB Quarterly Magazine is now available for download!

http://magazine.hitb.org/

This edition is a little bit 'lighter' than previous issues as the
editorial team is busy working on an extra special release for our 10th
year anniversary conference in October, HITBSecConf2012 - Malaysia.

http://conference.hitb.org/hitbsecconf2012kul/

For the first time ever though, we're making print editions of the
magazine...

[New tool] - Exploit Pack - Web Security noreply () exploitpack com (Apr 23)
Exploit Pack - Web Security Edition

This tool allows you to take control of remote browsers, steal social
network credentials, obtain persistence on it, DDoS and more.
Demo: http://www.youtube.com/watch?v=B_AYyRFNokI

Main features:
- Hacking of Gmail, Yahoo, Facebook, Live, Linkedin
- Session persistence
- 0day exploits included
- Remote browser control
- DDoS by creating botnets
- Launch remote exploits
- Steal credentials

Questions? support...

Ruxcon 2012 Call For Papers cfp (Apr 19)
Ruxcon 2012 Call For Papers

The Ruxcon team is pleased to announce the call for papers for the 2012 annual Ruxcon conference.

This year the conference will take place over the weekend of 20th and 21st of October at the CQ Function Centre,
Melbourne, Australia.

The deadline for submissions is the 15th of July.

* What is Ruxcon?

Ruxcon is the premier technical computer security conference in the Australia. The conference aims to bring...

Info Security News — Carries news items (generally from mainstream sources) that relate to security.

Web App Security — Provides insights on the unique challenges which make web applications notoriously hard to secure, as well as attack methods including SQL injection, cross-site scripting (XSS), cross-site request forgery, and more.

t2'12: Call for Papers 2012 (Helsinki / Finland) Tomi Tuominen (May 14)
# t2'12 - Call For Papers #
Helsinki, Finland
October 25 - 26, 2012

We are pleased to announce the annual t2'12 infosec conference, which
will take place in Helsinki, Finland, from October 25 to 26, 2012.

We are looking for original, preferably technical presentations in the
fields of information security. Presentations should last a minimum of
60 minutes and a maximum of two...

A survey on web application attacks Hannes Holm (May 14)
Hi webappsec subscribers,

I am researching the domain consensus regarding the effectiveness of different web application firewalls (WAF)s and
would be glad if you could spare a few minutes of your time to answer a survey on the topic.

By completing this survey you will:

* Help build valuable domain consensus on the topic of WAF effectiveness.
* Be able to compare your answers to the answers of others.
* Have the chance to win a 100 USD...

Abusing Password Managers with XSS mastah yeti (Apr 25)
New post on abusing password managers through xss.
http://labs.neohapsis.com/2012/04/25/abusing-password-managers-with-xss/

[HITB-Announce] HITB Magazine Issue 008 (now with print edition!) Hafez Kamal (Apr 23)
The 8th issue of the HITB Quarterly Magazine is now available for download!

http://magazine.hitb.org/

This edition is a little bit 'lighter' than previous issues as the
editorial team is busy working on an extra special release for our 10th
year anniversary conference in October, HITBSecConf2012 - Malaysia.

http://conference.hitb.org/hitbsecconf2012kul/

For the first time ever though, we're making print editions of the
magazine...

Ruxcon 2012 Call For Papers cfp (Apr 20)
Ruxcon 2012 Call For Papers

The Ruxcon team is pleased to announce the call for papers for the 2012 annual Ruxcon conference.

This year the conference will take place over the weekend of 20th and 21st of October at the CQ Function Centre,
Melbourne, Australia.

The deadline for submissions is the 15th of July.

* What is Ruxcon?

Ruxcon is the premier technical computer security conference in the Australia. The conference aims to bring...

Passwords^12 : Call for Presentations Per Thorsheim (Apr 18)
For the third time I am happy to announce a Call for Presentations for
Passwords^12.

Passwords^12 will be held at the University of Oslo (Norway) on December
3-4, 2012. The 2-day conference will be free and open for anyone to
attend. Please do note that our primary audience will be academics and
security professionals with deep technical knowledge. This is a
conference with international speakers and participants, presenting
fresh ideas and...

winAUTOPWN v3.0 Released QUAKER DOOMER (Apr 18)
Dear all,

This is to announce release of winAUTOPWN version 3.0

The improved GUI extension - WINAUTOPWN ACTIVE SYSTEMS TRANSGRESSOR GUI [ C4 - WAST ] is a
Systems and Network Exploitation Framework built on the famous winAUTOPWN as a backend.
C4 - WAST gives users the freedom to select individual exploits and use them.

A complete list of all Exploits in winAUTOPWN is available inside MISC\CHANGELOG.TXT
A complete list of User Interface...

SEC Consult whitepaper :: The Source Is A Lie SEC Consult Vulnerability Lab (Apr 18)
SEC Consult Vulnerability Lab released a new whitepaper titled:
"The Source Is A Lie"

Abstract:
---------
Backdoors have always been a concern of the security community. In
recent years the idea of not trusting the developer has gained momentum
and manifested itself in various forms of source code review. For Java,
being one of the most popular programming languages, numerous tools and
papers have been written to help during reviews....

OWASP ZAP 1.4.0 released psiinon (Apr 08)
Hi folks,

I'm very pleased to announce that version 1.4.0 of the OWASP Zed
Attack Proxy (ZAP) has now been released.

This release adds the following main features:
* Syntax highlighting
* fuzzdb integration
* Parameter analysis
* Enhanced XSS scanner
* A port of some of the Watcher checks
* Plugable extensions

And a load of bugfixes!

For more information and to download this release please visit the ZAP
homepage:...

Re: Time based Blind SQL injection martin . mngoma (Mar 30)
Hi guys

Just off the topic, can any of you help me.

I need a vulnerability scanner that can scan WCF web services (silver light technologies )as acunetix does not support
wcf yet.

All help will be appreciated

Thanks
Martin
Sent from my BlackBerry® wireless device

-----Original Message-----
From: Yiannis Koukouras <ikoukouras () gmail com>
Sender: listbounce () securityfocus com
Date: Thu, 29 Mar 2012 21:04:00
To: Danux<danuxx ()...

Re: Time based Blind SQL injection Yiannis Koukouras (Mar 29)
So, the only difference, from other tools out there, is the support of TAB(%09)?

Am I missing something?

Thanks for sharing! :)

Cheers,
Ioannis (Yiannis) Koukouras
CISSP, CISA, CISM, OSCP
MSc in Computer Systems Security
BEng in Electronic Engineering
http://www.linkedin.com/in/ikoukouras
---

This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website...

Re: Time based Blind SQL injection Yiannis Koukouras (Mar 29)
Cool, I just wanted to be sure I didn't miss anything else...

Again thanx for sharing! :)

Ioannis (Yiannis) Koukouras
CISSP, CISA, CISM, OSCP
MSc in Computer Systems Security
BEng in Electronic Engineering
http://www.linkedin.com/in/ikoukouras

This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now!...

winAUTOPWN v2.9 - As [ C4 - WAST ] QUAKER DOOMER (Mar 21)
Dear all,

It has been more than 3 YEARS since the first version of winAUTOPWN.
This is to announce release of winAUTOPWN version 2.9

This version introduces an improved GUI extension - WINAUTOPWN ACTIVE SYSTEMS
TRANSGRESSOR GUI [ C4 - WAST ]
C4 - WAST gives the user the freedom to select individual exploits and use them.
Note that the legacy winAUTOPWN feature to fire all exploits available for open ports
discovered is still present and has...

Re: FBController - (Facebook Control Utility) version 4.0 { With 0-DAY Features } Alex (Mar 15)
You probably should purchase an ad if you're going to try to sell
something. Just some friendly guidence. Good luck!

Alex Fernandez-Gatti
"Laws control the lesser man. Right conduct controls the greater
one." - Chinese Proverb

This list is sponsored by Cenzic
--------------------------------------
Let Us Hack You. Before Hackers Do!
It's Finally Here - The Cenzic Website HealthCheck. FREE.
Request Yours Now!...

FBController - (Facebook Control Utility) version 4.0 { With 0-DAY Features } QUAKER DOOMER (Mar 15)
FBConTroller v4.0 - (Facebook Control Utility) version 4.0 - With 0-DAY Features

After an exile of almost 2 years and 3 months, FBController is back !
FBController - The Ultimate Utility to Control Facebook accounts without the Password is
now version 4.0

Let me clear this again like every time that this utility WON'T hack/crack Facebook
accounts. The utility will need biscuits/cookies instead of the password. If you have your...

Daily Dave — This technical discussion list covers vulnerability research, exploit development, and security events/gossip. It was started by ImmunitySec founder Dave Aitel and many security luminaries participate. Many posts simply advertise Immunity products, but you can't really fault Dave for being self-promotional on a list named DailyDave.

Howard Schmidt Dave Aitel (May 18)
"As for getting into the power grid, I can't see that that's realistic,"
Schmidt said. <http://www.wired.com/threatlevel/2010/03/schmidt-cyberwar/>

Likewise as that Threat Point article from the start of his time in the
White House points out:

"People have to recognize that when we close the door and go home, we
are just normal netizens like anyone else," Schmidt said. "I've been in
the internet...

Ten years. Dave Aitel (May 17)
Immunity is ten years old now - and like any ten year old, it is
interested mostly in shiny things that bleep and bloop. :>

But also like any ten year old we are growing and always hungry, and so
if you're interested in working in the new DC office or Miami Beach HQ,
please let me know. We only have one perk and that is this: We'll keep
you entirely focused on breaking into things in one way or another.

-dave

New INFILTRATE 2012 Movie is up! With surprise introduction by Halvar! Dave Aitel (May 14)
OH: "So....static analysis! Let's talk about it!" (Long pause follows.)

That's pretty much straight out of most parties I go to! Luckily, there
are a few people who can go into static analysis to great levels of
depth, and some of them give talks at INFILTRATE. :>

http://www.immunityinc.com/infiltratemovies/movies/JulienVanegue.mp4

-dave

Re: Mobile Phone Security Survey Hamid (May 14)
There were some issues regarding some optional questions that has been
marked as mandatory mistakenly. Thanks to quick feedbacks they are
fixed now.

Hamid

Mobile Phone Security Survey Hamid (May 11)
Hello DD!

Few weeks ago I had a writeup about (in)security trends in mobile phones
and now I've reached to a point that I need results of a survey to
validate and confirm some facts that are going to be covered in paper.

I would appreciate your help by participating in this survey, or be even
more awesome and spread it among your friends that are not security geeks!

Survey link:

http://goo.gl/pQO02

Thank you!
Hamid

With a real team, it's not about the numbers Dave Aitel (May 01)
I find articles like the recent one in Forbes
<http://www.forbes.com/sites/andygreenberg/2012/03/21/meet-the-hackers-who-sell-spies-the-tools-to-crack-your-pc-and-get-paid-six-figure-fees/>
quite funny in a way - and likewise talks about "rootite" and bug mining and so forth. Part of this is because
philosophically I know that teams who focus on the money tend to lose. Obviously you need a lot of money to get things
done in...

72 hours Shari Bermudez (Apr 26)
Just a reminder that there are only 72 business hours remaining before
registration closes for the WebHacking and Master training classes.
Sign up today. Call 786-220-0600 or email training () immunityinc com
The 20% discount offer for re-tweeting still stands.

http://immunityinc.com/education-currentschedule.shtml

Spooked at RSA 2012 Dave Aitel (Apr 26)
So we put my RSA 2012 talk up, along with the comments from the viewers that RSA collected.

I 100% agree with every comment in the feedback form, which include such bon mots such as "You reek of pride". Frankly,
I am quite proud of what the offensive community has been able to do over the last ten years. And I was a bit hurried
during the actual talk (the one below is from my 6am-dry-run-in-hotel-room since they didn't record...

What's happening at SyScan'12 Singapore Thomas Lim (Apr 25)
Dear Dailydave readers

Do you know what's going to happen at SyScan'12 Singapore next week?

BEER, BEER, BEER, BEER, BEER, BEER, BEER, BEER....

13 AWESOME SPEAKERS:
a. Stefan Esser (i0n1c)
b. Chris Valasek (nudeaberdasher)
c. Tarjei Mandt (kernelpool)
d. Alex Ionescu
e. Edgar Barbosa (0pC0de)
f. Jon Oberheide
g. Brett Moore (antic0de)
h. James Burton (Jayji)
i. Seung Jin Lee (Beist)
j. Ryan MacArthur (Backpacker)
k. Loukas (snare)
l....

Save yourself 20% by tweeting Shari Bermudez (Apr 23)
Want to come to our June Master or WebHacking class but do not want to
pay full price? You can save yourself 20% in ~5 minutes by following
these simple steps:

(1) If you are not already doing so, follow us on Twitter @immunityinc
and/or @infiltratecon.

(2) ReTweet this tweet from today: "RT and receive 20% off June
training classes when you sign up before 4/27! ow.ly/asvSG e-mail
admin () immunityinc for info!"

(3) Email training...

TIME IS RUNNING OUT Shari Bermudez (Apr 20)
Time is running out to sign up for our June WebHacking and Master
Training Classes. If you are thinking about reserving your seat but
have not done so, the time to sign up is now.

_June 4-6, 2012 - WebHacking Class: _
Immunity's WebHacking course focuses on understanding common web
hacking techniques by having students exploit vulnerable systems.
Security professionals with some hands on web hacking experience will
get the most out of...

RIT! Dave Aitel (Apr 18)
Chris and Miguel are heading up to RIT today and will be around tomorrow
recruiting for Immunity. If you're at or near RIT and you want to hear
about the fun stuff they're working (which you can help work on!) then
send admin () immunityinc com <mailto:admin () immunityinc com> a quick email
and they'll vector you in! I hear there will be real wings served the
way only upstate NY knows how. I miss those wings, I have to say....

Re: CISPA == MAPP Richard Bejtlich (Apr 18)
Hi Allison,

I have a different view -- I'll try not to step on too many toes. :)

The problem is people are approaching this as a technical problem.
It's a trust problem.

The incentive is to not share. There is no incentive for a company to
tell anyone that they've been breached.

The bill in question doesn't say the government is entitled to your
information. They're trying to improve the incentives for companies
to...

Hack Cup 2012 Nicolas Waisman (Apr 18)
Immunity is excited to announce our third annual Hack Cup this year in
Las Vegas! As always, it will be held on the first day of DefCon (July,
27th).

Anyone interested in playing indoor soccer is welcome to join! The
dynamic will be the same as previous years:

o The tournament will go from 9:00-13:00.

o We will have 12 teams of five players each, playing 15-minute matches
in four different groups. We recommend that you have at least 2-5...

DC Saturday night drinks! Dave Aitel (Apr 17)
So Justine and I will be bar hopping somewhere near Dupont Circle
Saturday night (possibly for only one hop :>). If you want to hang out
and discuss the intricate details of Buffy the Vampire Slayer, then
catch me on Twitter (@daveaitel) and I'll vector you in.

*Oz*: We should figure out what kinda deal this is. I mean, is it
a-a gathering, a shindig or a hootenanny?
*Cordelia*: What's the difference?
*Oz*: Well, a...

PaulDotCom — General discussion of security news, research, vulnerabilities, and the PaulDotCom Security Weekly podcast.

Re: [GPWN-list] Breaking In, the data and my interpretation John Hoyt (May 17)
Thank Robin for putting this together, and writing up the results. I'm
going to keep this bookmarked as the go to reference when I get asked about
how to get into infosec.

-John

Re: Breaking In, the data and my interpretation Robin Wood (May 17)
Here is part two of my conclusions, enjoy:

http://www.digininja.org/projects/breaking_in_part_2.php

Robin

Video tutorial: Stack-Based Buffer Overflow No Reply (May 15)
I've made a video tutorial about buffer overflows take a look and share it
if you like it!

Video tutorial: http://www.youtube.com/watch?v=yPKCSXK8ZYo

Enjoy!

Re: VMware Player and promiscuous mode? Pat Moloney (May 15)
Esx has a flag in the configuration also to deny promisc. Check the
txt configuration for in the vm.

Note: promisc will not work on a wireless interface on a windows host.
I tried that and remember it failing.

Re: VMware Player and promiscuous mode? Steve Passino (May 14)
Not sure if this applies to vmplayer - but check your network settings
to make sure the VM is granted access to run the network card in promisc
mode.

With virtualbox, I know there is a setting to allow/disallow the virtual
network interface the ability to go into promisc - making a bit of a
guess here that vmplayer has the same set of controls......

Re: VMware Player and promiscuous mode? Todd Haverkos (May 14)
Timothy Ouellette <touellette83 () gmail com> writes:

Hi Timothy,

I'm not sure if what you're attempting is possible (and I'd argue
that's a feature as, when using virtual machines defensively, or for
malware analysis, I surely wouldn't want a compromised guest OS having
access to host machine network traffic). On the other hand, I'm not
sure what that noPromisc setting really intends to do.

When I want...

Re: WiFi Pineapple Mark IV Sherwyn (May 11)
For that price point its not bad. I had one years ago when it was just the
La Fonera with Jasager might be time to get the new hardware.

As for Mubix I believe he still does a few segment on Hak5 here and there.

Re: WiFi Pineapple Mark IV Hevnsnt (May 11)
I have a couple of them (from Darren) and so far the hardware is pretty sweet. The software is in active dev and their
forums are pretty active. I think there is a good chance that this project will end well.

-bill (@hevnsnt)

WiFi Pineapple Mark IV xgermx (May 11)
http://hakshop.myshopify.com/products/markiv-first-dibs

Has anyone gotten their hands on one of these?
I remember Darren from the early days of Hak5; it's good to see that
he's doing well.
Mubix, are you still in contact with Darren?

Re: Security of CORS, Would you trust it? subzer0girl (May 10)
Thank you !

Breakpoint 2012 Call For Papers cfp (May 10)
. ______________________________________
._\\. Breakpoint 2012 (___.
: Intercontinental Rialto :
: Melbourne, Australia :
: October 17th-18th :
:__ . ___:
)____________________________________\\...

Re: Security of CORS, Would you trust it? Pat (May 09)
Hi Sub,

I have yet to see it in use by a developer. Its has to be a
very specific scenario to actually use it. Most developers are still facing
the older browser issues and any project I have been involved in has always
been trying to degrade functionality gracefully for older browsers.

So from a protocol standpoint it looks very well thought out around
permissions and sending cookies and credentials. Unfortunately without
seeing some real...

Security of CORS, Would you trust it? subzer0girl (May 09)
Anyone have an opinion on the Security of CORS ? Would you trust it as
your only security mechanism ?

Sub

"Quest One Identity Manager" based on MS .Net on Linux? Alex Kornilov (May 08)
Hi

Does anybody run "Quest One Identity Manager" on Linux (production
environment)? We have huge troubles getting it running :(
Product is based on Microsoft .Net framework :(

Alex

Re: Auto Searching Nessus Plugins Ben Jackson (May 03)
You can use Perl :) -- Script attached

bbj () roscoe:~$ perl nessussearch.pl 55532
Microsoft System Center Configuration Manager Client Installed
bbj () roscoe:~$

I would recommend Paul's approach and have something cached locally
though, no sense in hammering Nessus' servers.

Shouts to byte_bucket post posting his simple command line solution in
the IRC channel to start me down this path.

Honeypots — Discussions about tracking attackers by setting up decoy honeypots or entire honeynet networks.

[HITB-Announce] HITB Magazine Issue 008 (now with print edition!) Hafez Kamal (Apr 23)
The 8th issue of the HITB Quarterly Magazine is now available for download!

http://magazine.hitb.org/

This edition is a little bit 'lighter' than previous issues as the
editorial team is busy working on an extra special release for our 10th
year anniversary conference in October, HITBSecConf2012 - Malaysia.

http://conference.hitb.org/hitbsecconf2012kul/

For the first time ever though, we're making print editions of the
magazine...

[HITB-Announce] HITB2012AMS SIGINT - Call for Submissions Hafez Kamal (Mar 08)
This is a call for submissions for the HITB SIGINT sessions at
HITB2012AMS - The third annual HITB conference in Amsterdam taking place
at the Okura from the 21st - 25th of May.

The HITB SIGINT (Signal Intelligence/Interrupt) sessions are designed to
provide a quick 15 - 30 minute overview for material and research that's
up and coming - stuff that isn't quite ready for the mainstream tracks
of the conference but deserve a mention...

2012 Honeynet Project Security Workshop Guillaume Arcas (Feb 02)
Hi.

The Honeynet Project holds its second Public Event on March 19 - 20,
2012 at Facebook HQ, SF Bay Area, Ca (USA).

Public event consists on a one-day technical presentations and a one-day
hands-on tutorial trainings.

All details available here:
https://honeynet.org/SecurityWorkshops/2012_SF_Bay_Area

Regards,

Guillaume Arcas
-------------------------
PR - The Honeynet Project

[HONEYPOTS] Cyber Warfare / Network Defense Simulation Teóphilo Athos Brauns (Jan 24)
Hi,

I would like to ask if you guys have any suggestions (including
articles, references, books, sites, ideas, anything) on how to build a
"Poor man's Cyber Warfare / Network Defense Simulation" for:

1 - study
2 - forensic analysis
3 - vulnerabilities replication
4 - worm/virus spreading
5 - DLP (data leak/loss prevention) study

For my first attempts I used a dual-quad xeon server with 32GB ram and
managed to create a whole...

Cyber Warfare / Network Defense Simulation Teóphilo Athos Brauns (Jan 24)
Hi,

I would like to ask if you guys have any suggestions (including
articles, references, books, sites, ideas, anything) on how to build a
"Poor man's Cyber Warfare / Network Defense Simulation" for:

1 - study
2 - forensic analysis
3 - vulnerabilities replication
4 - worm/virus spreading
5 - DLP (data leak/loss prevention) study
6 - ???

For my first attempts I used a dual-quad xeon server with 32GB ram and
managed to create a...

Microsoft Sec Notification — Beware that MS often uses these security bulletins as marketing propaganda to downplay serious vulnerabilities in their products—note how most have a prominent and often-misleading "mitigating factors" section.

Microsoft Security Bulletin Minor Revisions Microsoft (May 16)
********************************************************************
Title: Microsoft Security Bulletin Minor Revisions
Issued: May 16, 2012
********************************************************************

Summary
=======
The following bulletins have undergone a minor revision increment.
Please see the appropriate bulletin for more details.

* MS12-034 - Critical

Bulletin Information:
=====================

* MS12-034 - Critical

-...

Microsoft Security Bulletin Re-Releases Microsoft (May 11)
********************************************************************
Title: Microsoft Security Bulletin Re-Releases
Issued: May 11, 2012
********************************************************************

Summary
=======
The following bulletins have undergone a major revision increment.
Please see the appropriate bulletin for more details.

* MS12-035 - Critical
* MS12-MAY

Bulletin Information:
=====================

* MS12-035 - Critical...

Microsoft Security Bulletin Minor Revisions Microsoft (May 11)
********************************************************************
Title: Microsoft Security Bulletin Minor Revisions
Issued: May 11, 2012
********************************************************************

Summary
=======
The following bulletins have undergone a minor revision increment.
Please see the appropriate bulletin for more details.

* MS11-100 - Critical

Bulletin Information:
=====================

* MS11-100 - Critical

-...

Microsoft Security Bulletin Minor Revisions Microsoft (May 09)
********************************************************************
Title: Microsoft Security Bulletin Minor Revisions
Issued: May 09, 2012
********************************************************************

Summary
=======
The following bulletins have undergone a minor revision increment.
Please see the appropriate bulletin for more details.

* MS12-029 - Critical
* MS12-030 - Important
* MS12-032 - Important
* MS12-MAY

Bulletin...

Microsoft Security Bulletin Summary for May 2012 Microsoft (May 08)
********************************************************************
Microsoft Security Bulletin Summary for May 2012
Issued: May 8, 2012
********************************************************************

This bulletin summary lists security bulletins released for
May 2012.

The full version of the Microsoft Security Bulletin Summary for
May 2012 can be found at
http://technet.microsoft.com/security/bulletin/ms12-may.

With the release of the...

Microsoft Security Bulletin Advance Notification for May 2012 Microsoft (May 03)
********************************************************************
Microsoft Security Bulletin Advance Notification for May 2012
Issued: May 3, 2012
********************************************************************

This is an advance notification of security bulletins that
Microsoft is intending to release on May 8, 2012.

The full version of the Microsoft Security Bulletin Advance
Notification for May 2012 can be found at...

Microsoft Security Bulletin Re-Releases Microsoft (Apr 26)
********************************************************************
Title: Microsoft Security Bulletin Re-Releases
Issued: April 26, 2012
********************************************************************

Summary
=======
The following bulletins have undergone a major revision increment.
Please see the appropriate bulletin for more details.

* MS12-027 - Critical
* MS12-APR

Bulletin Information:
=====================

* MS12-027 -...

Microsoft Security Bulletin Minor Revisions Microsoft (Apr 25)
********************************************************************
Title: Microsoft Security Bulletin Minor Revisions
Issued: April 25, 2012
********************************************************************

Summary
=======
The following bulletin has undergone a minor revision increment.
Please see the appropriate bulletin for more details.

* MS12-028 - Important

Bulletin Information:
=====================

* MS12-028 - Important

-...

Microsoft Security Bulletin Minor Revisions Microsoft (Apr 18)
********************************************************************
Title: Microsoft Security Bulletin Minor Revisions
Issued: April 18, 2012
********************************************************************

Summary
=======
The following bulletins have undergone a minor revision increment.
Please see the appropriate bulletin for more details.

* MS12-017 - Important
* MS12-026 - Important

Bulletin Information:
=====================

*...

Microsoft Security Bulletin Minor Revisions Microsoft (Apr 13)
********************************************************************
Title: Microsoft Security Bulletin Minor Revisions
Issued: March 13, 2012
********************************************************************

Summary
=======
The following bulletins have undergone a minor revision increment.
Please see the appropriate bulletin for more details.

* MS11-030 - Critical
* MS11-025 - Important
* MS11-067 - Important

Bulletin Information:...

Microsoft Security Bulletin Advance Notification for April 2012 Microsoft (Apr 05)
********************************************************************
Microsoft Security Bulletin Advance Notification for April 2012
Issued: April 5, 2012
********************************************************************

This is an advance notification of security bulletins that
Microsoft is intending to release on April 10, 2012.

The full version of the Microsoft Security Bulletin Advance
Notification for April 2012 can be found at...

Microsoft Security Bulletin Minor Revisions Microsoft (Mar 14)
********************************************************************
Title: Microsoft Security Bulletin Minor Revisions
Issued: March 14, 2012
********************************************************************

Summary
=======
The following bulletins have undergone a minor revision increment.
Please see the appropriate bulletin for more details.

* MS12-022 - Important

Bulletin Information:
=====================

* MS12-022 - Important

-...

Microsoft Security Bulletin Summary for March 2012 Microsoft (Mar 13)
********************************************************************
Microsoft Security Bulletin Summary for March 2012
Issued: March 13, 2012
********************************************************************

This bulletin summary lists security bulletins released for
March 2012.

The full version of the Microsoft Security Bulletin Summary for
March 2012 can be found at
http://technet.microsoft.com/security/bulletin/ms12-mar.

With the...

Microsoft Security Bulletin Re-Releases Microsoft (Mar 13)
********************************************************************
Title: Microsoft Security Bulletin Re-Releases
Issued: March 13, 2012
********************************************************************

Summary
=======
The following bulletins have undergone a major revision increment.
Please see the appropriate bulletin for more details.

* MS10-058 - Important

Bulletin Information:
=====================

* MS10-058 - Important

-...

Microsoft Security Bulletin Minor Revisions Microsoft (Mar 13)
********************************************************************
Title: Microsoft Security Bulletin Minor Revisions
Issued: March 13, 2012
********************************************************************

Summary
=======
The following bulletins have undergone a minor revision increment.
Please see the appropriate bulletin for more details.

* MS11-030 - Critical
* MS11-025 - Important
* MS11-067 - Important

Bulletin Information:...

Funsec — While most security lists ban off-topic discussion, Funsec is a haven for free community discussion and enjoyment of the lighter, more humorous side of the security community

(Redundant) Backup is good Rob, grandpa of Ryan, Trevor, Devon & Hannah (May 15)
An example:
http://www.youtube.com/watch?v=EL_g0tyaIeE

====================== (quote inserted randomly by Pegasus Mailer)
rslade () vcn bc ca slade () victoria tc ca rslade () computercrime org
The client interface is the boundary of trustworthiness.
- Tony Buckland, UBC
victoria.tc.ca/techrev/rms.htm http://www.infosecbc.org/links...

Nigerian funds transfer safe Rob, grandpa of Ryan, Trevor, Devon & Hannah (May 15)
I've always been a bit worried that those offers I've gotten from Nigerian
individuals and banks might be "too good to be true." So it's really nice that the
FBI has taken time from it's busy schedule to assure me, even before I asked, that
the sca... I mean, deal, is safe.

(Now all I have to worry about is that the FBI is eeking to wiretap the whole
Internet. Must be an expensive proposition. Maybe they are...

Error in Finnish e-prescription software randomly added characters when Return was used Juha-Matti Laurio (May 13)
Finnish Medical Journal (in Finnish):
http://www.laakarilehti.fi/uutinen.html?opcode=show/news_id=12029/type=1

Google translation:
http://translate.google.com/translate?hl=en?sl=fi&tl=en&u=http%3A//www.laakarilehti.fi/uutinen.html%3Fopcode%3Dshow/news_id%3D12029/type%3D1

It is reported that using Return key in Effica e-prescription software randomly caused the program to add or destroy
characters typed by the doctor.
According to the...

Re: .secure TLD valdis . kletnieks (May 12)
On Fri, 11 May 2012 21:23:01 -0400, Ben April said:

Read between the lines. The guy scored $9M in startup funding, and
only has to pay ICANN $185K for the .secure TLD. And then he gets to
collect *more* money from anybody silly enough to buy into the TLD.

Step 3: Profit!

PCI DSS and BEAST Drsolly (May 12)
I just spent two effortful days getting my Secure Server to pass the PCI
DSS. The big problem is the BEAST vulnerability. And it's a corker. What
you have to do to get your certification, is disable most of the strong
crypto that you accept, and only accept some of the weaker ones (a bit of
research on the web will give you that info).

Having done that, and gotten my certification renewed, my QA told me that
some of the big banks...

Re: .secure TLD Bruce Ediger (May 12)
What happened to "The map is not the territory"?

After that, I want to know what happened to "The tap is not
meritorious".

Re: .secure TLD Nick FitzGerald (May 11)
Ben April wrote:

Well, the whole idea is somewhere between hilarious and blatantly
ignorant on its face, so that's funny (as in "funny sad" -- these folk
do seem to think they're doing something useful that will make a
difference) right off the bat...

If they really want to "assure security" they won't let any of their
registered domains install any currently-popular web-apps, PHP or,
realistically, even...

.secure TLD Ben April (May 11)
http://www.darkreading.com/authentication/167901072/security/security-management/240000187/new-i-secure-i-internet-domain-on-tap.html

If they really wanted to be secure they would require the
implementation of RFC 3514

Terrorist toddlers (Toddler terrorists?) Robert Slade (May 11)
http://www.vancouversun.com/travel/toddler+JetBlue+employees+pull+month+from+flight+over+list/6606185/story.html

Re: As you were ... Paul Ferguson (May 10)
I knew it! :-)

- ferg

- Sent from my Android device.

As you were ... Rob, grandpa of Ryan, Trevor, Devon & Hannah (May 10)
Apparently the Mayan's were as bad as anyone else changing their minds on the
date of the end of the world ...

http://www.sciencedaily.com/releases/2012/05/120510141905.htm

====================== (quote inserted randomly by Pegasus Mailer)
rslade () vcn bc ca slade () victoria tc ca rslade () computercrime org
The evening news is where they begin with 'Good evening,' and
then proceed to tell you why it isn't....

7 Ways Oracle Puts Database Customers At Risk Juha-Matti Laurio (May 10)
A very good coverage:

http://www.darkreading.com/database-security/167901020/security/news/232901381/7-ways-oracle-puts-database-customers-at-risk.html

Juha-Matti

Re: Seriously? Nick FitzGerald (May 05)
Mike B wrote:

But of course -- everyone knows that Android is based on Linux and
_everyone_ knows Linux, _like all other Unix-y OSes, BSDs and thus
Apple-OSes_, are inherently virus-immune.

Fred Cohen sure made those early PC users look stupid...

http://all.net/books/Dissertation.pdf

Oh, wait, I was misremembering that, wasn't I???

...

Android, like Apple-OSes, shows the fallacy of all that historic BS.
Make a "Unix...

Re: Seriously? Nick FitzGerald (May 05)
Dan Kaminsky wrote:

The numbing incoherence in the use of language?

Absolutely!

Let's allow a bunch of semi-quasi-literate, recent, CompSci or SW Eng
graduates write the technical bits of a press release about some
"exciting" new [or not] malware development _then_ have the marketing
wonks "tidy it up" for release.

What could _possibly_ go wrong with that?

Regards,

Nick FitzGerald

Re: Seriously? michael.blanchard (May 05)
I was actually referring to the type of article that claims "XYZ is a new threat".... I remember recently along with
this "drive by is new" that there was a "memory viruses are the new threat"....

There are too many "security professionals" that get their recent news from C-net or information week :-(

Mike B

From: Blanchard, Michael (InfoSec)
Sent: Saturday, May 05, 2012 11:55 PM
To: 'dan ()...

CERT Advisories — The Computer Emergency Response Team has been responding to security incidents and sharing vulnerability information since the Morris Worm hit in 1986. This archive combines their technical security alerts, tips, and current activity lists.

Current Activity - Apple Releases QuickTime 7.7.2 Current Activity (May 16)
US-CERT Current Activity

Apple Releases QuickTime 7.7.2

Original release date: Wednesday, May 16, 2012 at 10:23 am
Last revised: Wednesday, May 16, 2012 at 10:23 am

Apple has released QuickTime 7.7.2 to address multiple vulnerabilities.
These vulnerabilities may allow an attacker to execute arbitrary code or
cause a denial-of-service condition.

US-CERT encourages users and administrators to review Apple Support
Article HT5261 and apply any...

Current Activity - Google Releases Google Chrome 19 Current Activity (May 15)
US-CERT Current Activity

Google Releases Google Chrome 19

Original release date: Tuesday, May 15, 2012 at 2:13 pm
Last revised: Tuesday, May 15, 2012 at 2:13 pm

Google has released Google Chrome 19 for Linux, Mac, Windows, and Chrome
Frame to address multiple vulnerabilities. These vulnerabilities may
allow an attacker to execute arbitrary code or cause a denial-of-service
condition.

US-CERT encourages users and administrators to review the...

Current Activity - Apple Releases Multiple Security Updates Current Activity (May 10)
US-CERT Current Activity

Apple Releases Multiple Security Updates

Original release date: Thursday, May 10, 2012 at 2:30 pm
Last revised: Thursday, May 10, 2012 at 2:30 pm

Apple has released security updates for Apple OS X and Safari to address
multiple vulnerabilities for the following products:

* Safari 5.1.7 for Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion
Server v10.7.4, OS X Lion v10.7.4, Windows 7, Vista, XP SP2 or later
* OS X...

Alert TA12-129A -- Microsoft Updates for Multiple Vulnerabilities US-CERT Alerts (May 08)
National Cyber Alert System

Technical Cyber Security Alert TA12-129A

Microsoft Updates for Multiple Vulnerabilities

Original release date: May 08, 2012
Last revised: --
Source: US-CERT

Systems Affected

* Microsoft Windows
* Microsoft .NET Framework
* Microsoft Office
* Microsoft Silverlight

Overview

Select Microsoft software products contain multiple
vulnerabilities....

Current Activity - Microsoft Releases May Security Bulletin Current Activity (May 08)
US-CERT Current Activity

Microsoft Releases May Security Bulletin

Original release date: Tuesday, May 8, 2012 at 03:38 pm
Last revised: Tuesday, May 8, 2012 at 03:38 pm

Microsoft has released updates to address vulnerabilities in Microsoft
Windows, Office, .NET Framework, and Silverlight as part of the
Microsoft Security Bulletin Summary for May 2012. These vulnerabilities
may allow an attacker to execute arbitrary code or operate with...

Current Activity - Adobe Releases Security Advisory for Adobe Flash Player Current Activity (May 04)
US-CERT Current Activity

Adobe Releases Security Advisory for Adobe Flash Player

Original release date: Friday, May 4, 2012 at 11:06 am
Last revised: Friday, May 4, 2012 at 11:06 am

Adobe has released a Security Advisory for Adobe Flash Player to address
a vulnerability affecting the following software versions:

* Adobe Flash Player 11.2.202.233 and earlier versions for Windows,
Macintosh, and Linux operating systems * Adobe Flash Player...

Current Activity - Microsoft Releases Advance Notification for May Security Bulletin Current Activity (May 03)
US-CERT Current Activity

Microsoft Releases Advance Notification for May Security Bulletin

Original release date: Thursday, May 3, 2012 at 03:49 pm
Last revised: Thursday, May 3, 2012 at 03:49 pm

Microsoft has issued a Security Bulletin Advance Notification indicating
that its May release will contain seven bulletins. These bulletins will
have the severity ratings of critical and important and will be for
Microsoft Windows, Office, .NET...

Current Activity - Google Releases Chrome 18.0.1025.168 Current Activity (May 01)
US-CERT Current Activity

Google Releases Chrome 18.0.1025.168

Original release date: Tuesday, May 1, 2012 at 09:58 am
Last revised: Tuesday, May 1, 2012 at 09:58 am

Google has released Chrome 18.0.1025.168 for Linux, Macintosh, Windows,
and Google Chrome Frame to address multiple vulnerabilities. These
vulnerabilities may allow an attacker to execute arbitrary code or cause
a denial-of-service condition.

US-CERT encourages users and...

Current Activity - RuggedCom Rugged Operating System Vulnerability Current Activity (Apr 24)
US-CERT Current Activity

RuggedCom Rugged Operating System Vulnerability

Original release date: Tuesday, April 24, 2012 at 4:14 pm
Last revised: Tuesday, April 24, 2012 at 4:14 pm

RuggedCom Rugged Operating System (ROS), used in RuggedCom network
infrastructure devices, contains a hard-coded user account with a
predictable password.

This user account cannot be manually disabled. An attacker who
successfully guesses the password may be able to...

Current Activity - DNSChanger Malware Current Activity (Apr 24)
US-CERT Current Activity

DNSChanger Malware

Original release date: Tuesday, April 24, 2012 at 2:20 pm
Last revised: Tuesday, April 24, 2012 at 2:20 pm

US-CERT encourages users and administrators to ensure their systems are
not infected with the DNSChanger malware by utilizing tools and
resources available at the DNS Changer Working Group (DCWG) website.
Computers testing positive for infection of DNSChanger malware will need
to be cleaned of...

Current Activity - Oracle Releases Critical Patch Update for April 2012 Current Activity (Apr 18)
US-CERT Current Activity

Oracle Releases Critical Patch Update for April 2012

Original release date: Wednesday, April 18, 2012 at 9:55 am
Last revised: Wednesday, April 18, 2012 at 9:55 am

Oracle has released its Critical Patch Update for April 2012 to address
88 vulnerabilities across multiple products. This updates contains the
following security fixes:

* 6 for Oracle Database Server * 11 for Oracle Fusion Middleware * 6
for Oracle...

Current Activity - Apple Releases Flashback Malware Security Updates Current Activity (Apr 16)
US-CERT Current Activity

Apple Releases Flashback Malware Security Updates

Original release date: Monday, April 16, 2012 at 3:11 pm
Last revised: Monday, April 16, 2012 at 3:11 pm

Apple has released security updates to address Flashback malware in the
following products:

* OS X Lion v10.7.3 * OS X Lion Server v10.7.3 * Mac OS X v10.6.8 * Mac
OS X Server v10.6.8

Apple has released a malware removal tool for the most common variant of
the...

Current Activity - HP ProCurve 5400 zl Switches Security Bulletin Current Activity (Apr 12)
US-CERT Current Activity

HP ProCurve 5400 zl Switches Security Bulletin

Original release date: Thursday, April 12, 2012 at 2:51 pm
Last revised: Thursday, April 12, 2012 at 2:51 pm

Hewlett-Packard (HP) has released a security bulletin to address a
security vulnerability affecting HP 5400 zl series switches purchased
after April 30, 2011. These switches contain a compact flash card that
may be infected with malware.

US-CERT encourages users...

Current Activity - Samba Releases Updates for 3.0.x - 3.6.3 Current Activity (Apr 11)
US-CERT Current Activity

Samba Releases Updates for 3.0.x - 3.6.3

Original release date: Wednesday, April 11, 2012 at 11:00 am
Last revised: Wednesday, April 11, 2012 at 11:00 am

Samba has released an update to address a vulnerability in Samba
versions 3.6.3 and all previous versions. Exploitation of this
vulnerability may allow a remote attacker to use anonymous connections
to execute arbitrary code with root privileges.

US-CERT encourages...

Alert TA12-101B -- Adobe Reader and Acrobat Security Updates and Architectural Improvements US-CERT Alerts (Apr 11)
National Cyber Awareness System

Technical Cyber Security Alert TA12-101B

Adobe Reader and Acrobat Security Updates and Architectural Improvements

Original release date: April 10, 2012
Last revised: --
Source: US-CERT

Systems Affected

* Adobe Reader X (10.1.2) and earlier 10.x versions for Windows and Macintosh
* Adobe Reader 9.5 and earlier 9.x versions for Windows, Macintosh, and UNIX
* Adobe...

Open Source Security — Discussion of security flaws, concepts, and practices in the Open Source community

Secure Coding — The Secure Coding list (SC-L) is an open forum for the discussion on developing secure applications. It is moderated by the authors of Secure Coding: Principles and Practices.

MetriSec 2012 submission date is May 30th James Walden (May 14)
MetriSec 2012
8th International Workshop on
SECURITY MEASUREMENTS AND METRICS

Affiliated with the International Symposium on
Empirical Software Engineering and Measurement (ESEM)

September 21, 2012
Lund, Sweden

WORKSHOP OVERVIEW

Quantitative assessment is a major stumbling block for software and
system security. Although some security metrics exist, they are rarely
adequate. The engineering importance of metrics is intuitive: you
cannot...

Re: Re (badware vs. "goodware"): SearchSecurity: Badware versus malware Goertzel, Karen [USA] (May 14)
Agent software is all well and good.

But if you secretly implant the agents, and design them to be undetectable, and do not inform the intended user of the
system that they are there, they are spyware - and at best, unethical. And, by my definition at least, unethical = bad.

===
Karen Mercedes Goertzel, CISSP
Lead Associate
Booz Allen Hamilton
703.698.7454
goertzel_karen () bah com

"I love deadlines. I like the whooshing sound they...

Containing bad code Ben Laurie (May 13)
Given the recent discussion, I thought the list might be interested in:
http://www.links.org/?p=1242. I'm currently working on transparently
wrapping libtiff (that is, wrapping it such that the calling application is
unaware it is wrapped).

Using Capsicum For Sandboxing <http://www.links.org/?p=1242>

FreeBSD 9.0 <http://www.freebsd.org/releases/9.0R/announce.html>, released
in January 2012, has experimental
Capsicum<...

Re: SearchSecurity: Badware versus malware Tom Brennan (May 13)
OWASP Has started month awareness proble/solution see updated:
http://www.owasp.com

Point you ask...... As a united community we raise visibility for the problem that results in a ecosystem - lets make
noise about it together, monthly and globally from the builder / breaker & defender perspectives

Re: SearchSecurity: Badware versus malware Ben Laurie (May 12)
Well, it certainly does _suggest_ it: "All of the things that we do to
improve software security are aimed explicitly at the badware
problem."

It doesn't say it, though, I agree.

Re: SearchSecurity: Badware versus malware Gary McGraw (May 12)
The article does not suggest otherwise.

gem

Re: SearchSecurity: Badware versus malware Ben Laurie (May 11)
Fixing badware universally would plug one hole - and it's certainly a
hole worth plugging. But it won't eliminate malware - it seems it is
not hard to persuade users to install it for you, for example.

MoST 2012 (SPW) registration Larry Koved (May 11)
On behalf of the workshop co-chairs and program chair, we would like to
invite you participate in the Mobile Security Technologies (MoST)
Workshop.

The workshop will be held at the The Westin St. Francis Hotel, San
Francisco.

Workshop registration site:
http://www.regonline.com/Register/Checkin.aspx?EventID=1072068

MoST is part of the Security and Privacy Workshops (SPW)
event (http://www.ieee-security.org/TC/SPW2012/),
co-located with...

Re: SearchSecurity: Badware versus malware Goertzel, Karen [USA] (May 11)
In other words, flaws and defects caused through developer error, ignorance, negligence etc. can be exploited to cause
harm. So even if one could prevent actual intentional malicious inclusions in software, one hasn't eliminated the
problem of exploitable flawed logic.

The megachallenge, of course, is looking for what one doesn't actually know is there. Which is why software security
testing is so hard.

===
Karen Mercedes Goertzel,...

Re: SearchSecurity: Badware versus malware Peter G. Neumann (May 10)
The differences are marginal.

My book has a pervasive theme:
Many things that could happen accidentally could be triggered
intentionally.
Many things that happen intentionally could be triggered accidentally.

Trying to reduce one without the other may be foolhardy in most realistic
threat models.

Breakpoint 2012 Call For Papers cfp (May 10)
. ______________________________________
._\\. Breakpoint 2012 (___.
: Intercontinental Rialto :
: Melbourne, Australia :
: October 17th-18th :
:__ . ___:
)____________________________________\\...

SearchSecurity: Badware versus malware Gary McGraw (May 08)
hi sc-l,

What’s worse, bad software or malicious software? In fact, what’s the difference?

My second column for SearchSecurity is all about that. Read it today. And pass it on.
http://searchsecurity.techtarget.com/opinion/Gary-McGraw-Eliminating-badware-addresses-malware-problem

Bottom line: Talking about malware may be more fun and entertaining than talking about endless security bugs, but if
we’re going to combat malware we have to...

c0c0n 2012 CFP - Extended Deadline: May 15, 2012 c0c0n International Information Security Conference (May 08)
c0c0n 2012 CFP - Extended Deadline: May 15, 2012

Thanks to everyone for all the paper submissions. The CFP Review Committee
will be evaluating the same for selection. Based on the requests received,
we are extending the CFP deadline to May 15, 2012 in the hope of receiving
few more paper submissions.

####################################################
c0c0n 2012 - Call For Papers and Call For Workshops...

Silver Bullet 73: Robert Vamosi Gary McGraw (May 04)
hi sc-l,

This morning we released episode 73 of Silver Bullet. The new show is an interview with Robert Vamosi. Robert is a
well-known security reporter, having worked for a bunch of esteemed publications including Forbes, c!net, and
threatpost. Robert also wrote a book called "When Gadgets Betray Us" which many of you will find interesting. Have a
listen:
http://www.cigital.com/silver-bullet/show-073/

As always, thanks to...

nullcon Delhi 2012 Call for Paper/Call for Event nullcon (May 04)
Hi All,

For the very first time nullcon now comes to Delhi - to showcase cutting
edge security technologies and discuss new attack vectors and security
threats among the Corporate world and the Government sector. The event
brings together thought leaders,Corporates, Government and security
professionals all under one roof.

Prototype:
-------------
We are introducing a new sub-event - Prototype at nullcon Delhi 2012. The
event provides...

Educause Security Discussion — Securing networks and computers in an academic environment.

Re: Malware (antivirus) software for Macintosh Everett, Alex D (May 18)
Well put, Louis.
There must be a good reason why you had fewer- maybe more systems with AV (it was a wake up call for many here) or more
secure web surfing habits for your users.

Sincerely,

Alex Everett, CISSP, CCNA
University of North Carolina

Alex

You are correct Apple knew about this we all know that a response was slow incoming. I am not sure why Flashback was a
non-event for us, since I have a very small population on McAfee...

Re: Malware (antivirus) software for Macintosh Louis APONTE (May 18)
Alex

You are correct Apple knew about this we all know that a response was
slow incoming. I am not sure why Flashback was a non-event for us, since
I have a very small population on McAfee anti-malware 1.x or
(9.1.0.4478) I spot checked critical systems at the start of this, what
I found was tons of needed updates queued up. I guess what I said badly
was you need an AV solution in place (McAfee does rather well on snow
leopard and Mt lion ),...

Re: Malware (antivirus) software for Macintosh Cal Frye (May 17)
We use Intego VirusBarrier here. Didn't find the first cases, but is
fairly good at cleaning them up afterward. It can be a bit too
aggressive by default, but doesn't seem to impair performance much at all.

Re: Malware (antivirus) software for Macintosh Justin Azoff (May 17)
The majority of flashback infected machines were personal laptops that
were already infected while on an off campus location. Almost all were
student owned machines, but a few were faculty/staff.

We would see IDS alerts < 10 seconds after the WPA login.

We focused on detection+suspension, we had ~200 infections total.

Re: Malware (antivirus) software for Macintosh John Ladwig (May 17)
Which "network security mitigation techniques," didn't work out for Flashback at your site?

-jml

From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Everett,
Alex D
Sent: Thursday, May 17, 2012 3:51 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Malware (antivirus) software for Macintosh

Louis:

Maybe I am misreading this, but Apple Updates did not...

Re: Malware (antivirus) software for Macintosh Everett, Alex D (May 17)
Louis:

Maybe I am misreading this, but Apple Updates did not offer protection in time, though patching is of course sound
advice.
A Java vulnerability was not patched until after exploitation took place.
We did have good experience with anti-malware software if the user had it already installed.
We had poor experience with network security mitigation technologies.

References:...

Re: Malware (antivirus) software for Macintosh Gallese, Brady T. (May 17)
Also using Symantec Endpoint Protection 12.1 here. We saw some issues with version 11 as John mention, but things have
been very good with 12.1. I like that the macs are centrally managed for reporting, just like our PC clients - pricing
is also the same as our PC clients. There haven't been many mac–only viruses show up, but it's been great for stopping
the PC viruses that the macs had been carriers for.

Regards,
Brady Gallese...

Assistant Director of Network & Enterprise Services Mohamed Elhindi (May 17)
*Job Opportunity*

*Assistant Director of Network & Enterprise Services*

The University of Wisconsin-La Crosse is looking for a dynamic leader in
Information Technologies for the position of Assistant Director of Network
& Enterprise Services to lead, manage and innovate.

This position will provide you the opportunity to manage the Network and
Enterprise unit within ITS which comprises *network and telecommunication,
server...

Re: Malware (antivirus) software for Macintosh John Ladwig (May 17)
Symantec Endpoint Protection 12 here, on a few Macs.

SEP 11 used to eat most of the CPU and drive the fans to takeoff thrust once a week or shortly after a restart. 12 is
some better, but I still periodically end up with two navx processes running, and that drags things to a crawl. It's
no third to kill the logged-in-user copy off, though.

Never seen it fire on anything, false or not, but our Macs have historically only been driven by...

Re: Malware (antivirus) software for Macintosh Louis APONTE (May 17)
Hi

McAfee antimalware here, I have to say keeping your Mac software
updates current was primary protection vector we saw for Flashback. As
Apple released the two or three OS patches we installed asap. I am
saying its best to do both in tandem for best results set OS updates to
daily and install automatically as a service for your Mac users, and
have AV of one kind or another. Very few of our users disagree with this
approach....

Re: Malware (antivirus) software for Macintosh Jason C. Belford (May 17)
We provide McAfee VirusScan for Mac to our campus. A co-worker of mine prefers Sophos. He ran some (unscientific)
tests by installing various clients and copying files around. He timed each copy.. He shared his findings with me
(see below).

I am only presenting the facts and this email should not be interrupted me as endorsing any product.

--Jason

Re: Malware (antivirus) software for Macintosh Jeff Giacobbe (May 17)
Sophos here as well. Older versions (a couple years back) were a bit
resource-intensive but revs since then have been fine. Very stable and
capable product.

Re: Malware (antivirus) software for Macintosh Cappalli, Tim G @ LSC-OIT (May 17)
We are using McAfee on the Macs with no noticeable performance issues. We just moved our Windows machines to FEP.

Tim Cappalli, ACMP CCNA | (802) 626-6456
Office of Information Technology (OIT) | Lyndon

[cid:image001.png@01CD3444.0BB69CF0]<http://facebook.com/LyndonOIT>[cid:image002.png@01CD3444.0BB69CF0]<http://twitter.com/#!/LyndonOIT>[cid:image003.png@01CD3444.0BB69CF0]<http://gplus.to/LyndonOIT>

From: The EDUCAUSE...

Re: Malware (antivirus) software for Macintosh Jesse Safran (May 17)
Another +1 for Sophos. We are very happy with it!

Re: Malware (antivirus) software for Macintosh Roger A Safian (May 17)
Perhaps this might be of interest?

http://arstechnica.com/apple/2012/05/hands-on-with-five-antivirus-apps-for-the-mac/

From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Dean
Williams
Sent: Thursday, May 17, 2012 2:18 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Malware (antivirus) software for Macintosh

A rash of Flashback infections has us thinking about malware...

Internet Issues and Infrastructure

NANOG — The North American Network Operators' Group discusses fundamental Internet infrastructure issues such as routing, IP address allocation, and containing malicious activity.

Re: Peer1/Server Beach support for BGP on dedicated servers Bill Woodcock (May 19)
Any recommendations of such?

-Bill

Re: Peer1/Server Beach support for BGP on dedicated servers Seth Mattinen (May 19)
There are places that can do such requests easily and quickly, but
they're typically smaller outfits that don't have thousands of customers
doing cookie-cutter packages.

~Seth

Re: Peer1/Server Beach support for BGP on dedicated servers Alain Hebert (May 19)
Hi,

Knowing Peer1, they *may be* accommodating enough to provide you with
something.

Are you talking only to server beach support?

PS: Yes, your need are a bit different from their usual customers =D

( I wont make a shameless plug ... )

Re: Peer1/Server Beach support for BGP on dedicated servers Jonathan Lassoff (May 19)
Generally, most dedicated hosting (renting/leasing the exclusive use
of a computer in their facility) outfits aren't setup to speak BGP to
individual servers/customers. Such a request is usually infrequent
enough that it doesn't warrant setting up the added hardware.

While you could have your provider announce your space for you, you'll
loose the fine-grained control over how that route gets announced once
the routing is out of...

Peer1/Server Beach support for BGP on dedicated servers Anurag Bhatia (May 19)
Hello everyone

Was wondering if there's anyone from Server Beach/Peer1 here. We have a
dedicated server with them which we primarily use for DNS. I am adding
support for anycasting on that one but seems like Peer1 is not supporting
BGP at all. NOC support told me that they can announce our block
and statically pass us but cannot hear BGP announcement from our router.
Was wondering if someone else had similar issue?

This is important and if...

Re: need help about bgd and ospf Mukom Akong T. (May 19)
Hi Deric,

Just an addition to what the others have already said. Redistributing
BGP into OSPF is rarely an effective thing to do. Am not sure OSPF can
handle that number of routes well.

I'd think so, as each of the 8 routers will generate type 5 LSAs for
their 400k routes from BGP.

More important question is why do u want OSPF to know that
information? Is it the right protocol to do that?

Re: NANOG 55 DNS Track Mehmet Akcin (May 18)
Hello again,

I wanted to follow up and let NANOG community know the detailed plans for DNS Track.

Session will take place on Tuesday, June 5, 2012 from 5:00 PM to 6:30 PM in Salon A-C

NANOG DNS BoF 90mins

5 Mins Introductions - Mehmet
15 Mins Steve Crocker - Chair, FCC CSRIC Working Group 5, DNSSEC Implementation Practices for ISPs
10 Mins PCH Update - Robert Martin-Legène
10 Mins Verisign Update - Duane Wessels
10 Mins ICANN Update -...

The Cidr Report cidr-report (May 18)
This report has been generated at Fri May 18 21:12:46 2012 AEST.
The report analyses the BGP Routing Table of AS2.0 router
and generates a report on aggregation potential within the table.

Check http://www.cidr-report.org for a current version of this report.

Recent Table History
Date Prefixes CIDR Agg
11-05-12 410225 240868
12-05-12 410475 240522
13-05-12 410127 241239...

BGP Update Report cidr-report (May 18)
BGP Update Report
Interval: 10-May-12 -to- 17-May-12 (7 days)
Observation Point: BGP Peering with AS131072

TOP 20 Unstable Origin AS
Rank ASN Upds % Upds/Pfx AS-Name
1 - AS9829 75456 3.6% 62.7 -- BSNL-NIB National Internet Backbone
2 - AS8402 68093 3.2% 34.6 -- CORBINA-AS OJSC "Vimpelcom"
3 - AS7029 29621 1.4% 13.3 -- WINDSTREAM - Windstream Communications Inc...

Re: Level3 Issues Steven Saner (May 18)
No BGP issues via Kansas City, but looks like somewhat less than normal
amount of traffic.

Steve

Re: Level3 Issues Bill Blackford (May 18)
I see a few drops in ATLN

-b

Level3 Issues Scott Wolfe (May 18)
Anyone having BGP issues in and out of Level3 in the past 30 minutes?

--ScottW

Weekly Routing Table Report Routing Analysis Role Account (May 18)
This is an automated weekly mailing describing the state of the Internet
Routing Table as seen from APNIC's router in Japan.

The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, LacNOG,
TRNOG, CaribNOG and the RIPE Routing Working Group.

Daily listings are sent to bgp-stats () lists apnic net

For historical data, please see http://thyme.rand.apnic.net.

If you have any comments please contact Philip Smith <pfsinoz ()...

Re: need help about bgd and ospf Barry Greene (May 18)
Hi Deric,

I would strongly suggest that you watch a couple of the NANOG tutorials on routing. The would help you answer these and
other questions.

Go to this page - http://www.nanog.org/meetings/archive/ - pick a meeting and find the BGP tutorial. There are a few
taught each year.

Barry

Sent from my iPad

Re: need help about bgd and ospf Jeff Tantsura (May 18)
Nope, run iBGP, have only next-hops in OSPF.

Regards,
Jeff

The RISKS Forum — Peter G. Neumann moderates this regular digest of current events which demonstrate risks to the public in computers and related systems. Security risks are often discussed.

Risks Digest 26.84 RISKS List Owner (May 16)
RISKS-LIST: Risks-Forum Digest Wednesday 16 May 2012 Volume 26 : Issue 84

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.84.html>
The current issue can be...

Risks Digest 26.83 RISKS List Owner (May 12)
RISKS-LIST: Risks-Forum Digest Saturday 12 May 2012 Volume 26 : Issue 83

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.83.html>
The current issue can be...

Risks Digest 26.82 RISKS List Owner (May 09)
RISKS-LIST: Risks-Forum Digest Wednesday 9 May 2012 Volume 26 : Issue 82

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.82.html>
The current issue can be...

Risks Digest 26.81 RISKS List Owner (May 04)
RISKS-LIST: Risks-Forum Digest Friday 4 May 2012 Volume 26 : Issue 81

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.81.html>
The current issue can be found...

Risks Digest 26.80 RISKS List Owner (Apr 25)
RISKS-LIST: Risks-Forum Digest Wednesday 25 April 2012 Volume 26 : Issue 80

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.80.html>
The current issue can be...

Risks Digest 26.79 RISKS List Owner (Apr 17)
RISKS-LIST: Risks-Forum Digest Tuesday 17 April 2012 Volume 26 : Issue 79

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.79.html>
The current issue can be...

Risks Digest 26.78 RISKS List Owner (Apr 10)
RISKS-LIST: Risks-Forum Digest Tuesday 10 April 2012 Volume 26 : Issue 78

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.78.html>
The current issue can be...

Risks Digest 26.77 RISKS List Owner (Apr 04)
RISKS-LIST: Risks-Forum Digest Wednesday 4 April 2012 Volume 26 : Issue 77

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.77.html>
The current issue can be...

Risks Digest 26.76 RISKS List Owner (Mar 31)
RISKS-LIST: Risks-Forum Digest Sunday 1 April 2012 Volume 26 : Issue 76

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.76.html>
The current issue can be...

Risks Digest 26.75 RISKS List Owner (Mar 18)
RISKS-LIST: Risks-Forum Digest Sunday 18 March 2012 Volume 26 : Issue 75

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.75.html>
The current issue can be...

Risks Digest 26.74 RISKS List Owner (Feb 24)
RISKS-LIST: Risks-Forum Digest Friday 24 February 2012 Volume 26 : Issue 74

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.74.html>
The current issue can be...

Risks Digest 26.73, WITH TWO ADDED COMMENTS! PLEASE READ THIS ONE. RISKS List Owner (Feb 24)
RISKS-LIST: Risks-Forum Digest Friday 24 February 2012 Volume 26 : Issue 73

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.73.html>
The current issue can be...

Risks Digest 26.73 RISKS List Owner (Feb 24)
RISKS-LIST: Risks-Forum Digest Friday 24 February 2012 Volume 26 : Issue 73

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.73.html>
The current issue can be...

Risks Digest 26.72 RISKS List Owner (Feb 12)
RISKS-LIST: Risks-Forum Digest Sunday 12 February 2012 Volume 26 : Issue 72

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.72.html>
The current issue can be...

Risks Digest 26.70 RISKS List Owner (Jan 02)
RISKS-LIST: Risks-Forum Digest Monday 2 January 2012 Volume 26 : Issue 70

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/26.70.html>
The current issue can be...

Data Loss — Data Loss covers large-scale personal data loss and theft incidents. This archive combines the main list (news releases) and the discussion list.

Open Source Tool Development

Metasploit — Development discussion for Metasploit, the premier open source remote exploitation tool

linux x86 meterpreter portfwd bug Anestis Bechtsoudis (May 19)
Hello list,

while messing around with linux meterpreter's network features, I
spotted that portfwd poses some malfunctions. If the dev team is
familiar with this bug excuse me for this double report (a quick search
doesn't reveal any relevant tracked issue).

After applying the port forward rule, only data from the first TCP
connection attempt reach the end service. Continuing with tcpdump
debugging I discovered that the FIN packets...

Re: msf pro vpn issue. HD Moore (May 18)
Hi Ivan,

We filed this as a bug and will have it fixed in next week's update. Thank
you for the report.

-HD

From: framework-bounces () spool metasploit com
[mailto:framework-bounces () spool metasploit com] On Behalf Of Ivan Leoni
Sent: Sunday, May 13, 2012 5:41 PM
To: framework () spool metasploit com
Subject: [framework] msf pro vpn issue.

MSF Pro (las update) vpn creation, is ignoring the dhcp checkbox and always
try to get the ip...

Re: Meterpreter reverse_tcp pivot + socks4a proxy dies HD Moore (May 18)
The Linux meterpreter is not quite production ready at this point, thanks
for the bug report, we will look into it. You might try using the java
meterpreter instead for the time being.

-HD

From: framework-bounces () spool metasploit com
[mailto:framework-bounces () spool metasploit com] On Behalf Of Lukas Kuzmiak
Sent: Monday, May 14, 2012 12:05 PM
To: framework () spool metasploit com
Subject: [framework] Meterpreter reverse_tcp pivot +...

H2HC Brazil 9th Edition - Call for Papers Rodrigo Rubira Branco (BSDaemon) (May 18)
CALL FOR PAPERS - Hackers 2 Hackers Conference 9th edition

The call for papers for H2HC 9th edition is now open. H2HC is a hacker
conference taking place in Sao Paulo, Brazil, from 18 to 23 October 2012.

[ - Introduction - ]

For the ninth consecutive year and past success we have been having,
the annual Hackers 2 Hackers Conference will be held again in Sao Paulo,
from 18 to 23 October 2012 and aims to get together industry,
government,...

Re: Discovery scan through proxies? Sean Carolan (May 16)
Absolutely, this is awesome.

Re: Discovery scan through proxies? Jonathan Cran (May 15)
Sean -- yes, definitely. this is probably something best implemented with
some scripting / rpc, or at a lower layer with specific routes / network -
are you using pro or the framework? Assuming pro (but the same principles
apply for the framework), you could also use an RC file to set the PROXIES:

<discover_all.rc>
# run first scan without a proxy
pro_discover 10.0.0.0/24
set PROXIES socks4:localhost:1080
# run second scan through a pivot...

Discovery scan through proxies? Sean Carolan (May 15)
Hello all:

Is it possible to set up a discovery scan with some logic built in to
use proxies where appropriate? Or alternatively, create separate
scans for different networks that use proxy machines to reach inside
each remote network?

thanks

Sean

Meterpreter reverse_tcp pivot + socks4a proxy dies Lukas Kuzmiak (May 14)
Hey there,

I'm using linux/x86/meterpreter/reverse_tcp payload in an exploit on a
remote host, once the meterpreter session is established, I set up a route
using autoroute command to pivot through this host.

As I want to play with a web application through this pivot I'm using this
socks4a proxy in Firefox. However the meterpreter session dies _very_
often, both servers are in datacenters on 100mbps with latency of ~20ms and...

msf pro vpn issue. Ivan Leoni (May 13)
MSF Pro (las update) vpn creation, is ignoring the dhcp checkbox and always
try to get the ip from the dhcp server.

some logs:

*framework.log*
[05/13/2012 14:09:28] [d(0)] core: Reloading module pro/tunnel...
[05/13/2012 14:09:28] [w(0)] core: The module pro/tunnel is ambiguous with
pro/tunnel.
[05/13/2012 14:09:41] [w(0)] core: Exception caught in
DHCP::Client.acquire: execution expired
[05/13/2012 14:09:41] [w(0)] core:...

Breakpoint 2012 Call For Papers cfp (May 10)
. ______________________________________
._\\. Breakpoint 2012 (___.
: Intercontinental Rialto :
: Melbourne, Australia :
: October 17th-18th :
:__ . ___:
)____________________________________\\...

Using custom java meterpreter payloads pasknel ribeiro (May 02)
How can I use custom meterpreter payloads to java exploits (example:
java_atomicreferencearray)?

I created a jar file with msfvenom using java/meterpreter/reverse_tcp as
the payload and used SmokeScreen to perform Code Obfuscation in the jar
file.

The jar file works fine but how can i use this with a java exploit?

I tried using the 'generic/custom' payload and setting the PAYLOADFILE
attribute to the jar file but it did not work :(...

Fwd: nullcon Delhi 2012 Call for Paper/Call for Event nullcon (Apr 29)
Hi All,

For the very first time nullcon now comes to Delhi - to showcase cutting
edge security technologies and discuss new attack vectors and security
threats among the Corporate world and the Government sector. The event
brings together thought leaders,Corporates, Government and security
professionals all under one roof.

Prototype:
-------------
We are introducing a new sub-event - Prototype at nullcon Delhi 2012. The
event provides...

Re: asm to hex, with a random string David3 Gonnella (Apr 27)
Thanks, you answered to my confusing question by saying that "all
operations end up as bytecode". That is just enough to understand
that i was wrong, and I should have study that book properly,
since it is here..

Re: asm to hex, with a random string AK (Apr 27)
Hi David3,
I do not fully understand your email (English is a second language for
me at best). My questions are inline:

Documented on "Shellcoder's handbook". I do not understand your last
sentence, ALL operations end up as bytecode, not just the complex ones.

I will send in your personal email a blog post that I have written for
asm <-> shellcode (note the <->). I can also send it to the list,
although this has been...

Re: asm to hex, with a random string David3 Gonnella (Apr 27)
Sorry for my typo error, the last sentence
"you can do that on the assembly" should be replaced with
"you CAN'T do that on the assembly" :)....thanks

Wireshark — Discussion of the free and open source Wireshark network sniffer. No other sniffer (commercial or otherwise) comes close. This archive combines the Wireshark announcement, users, and developers mailing lists.

Re: including GPLv3 autoconf macro in Wireshark Jakub Zawadzki (May 19)
AFAIK Z_BLOCK is only needed for "faster" seeking in gzipped files.
If user don't have it, we can fallback to Z_NO_FLUSH

Commited fix in r42714.

New contributor Koosha Khajeh Moogahi (May 18)
Hi developers,

I would like to contribute code to wireshark. I would appreciate your help
if there are somethings that I should consider. Are there any trivial bug
fixings for new comers?

I'm currently a contributor of Bugzilla project.

Thanks.

Re: including GPLv3 autoconf macro in Wireshark Guy Harris (May 18)
You could use AC_TRY_COMPILE() with a test program such as

#ifndef Z_BLOCK
#error "Z_BLOCK isn't available"
#endif

and with zlib.h being one of its includes.

Re: including GPLv3 autoconf macro in Wireshark Jeff Morriss (May 18)
Jakub Zawadzki wrote:

That would obviously be great--but is it reasonably possible? I assumed
this was needed for our fancy new zipped-file processing.

Re: including GPLv3 autoconf macro in Wireshark Jakub Zawadzki (May 18)
Hi,

I propose another solution:

#ifdef Z_BLOCK
/* when preset */
#else
/* when no */
#endif

including GPLv3 autoconf macro in Wireshark Jeff Morriss (May 18)
Hi folks,

I found out recently that Wireshark needs the Z_BLOCK macro which is
only in zlib 1.2.0.5 and later. Rather than checking explicitly for the
version (which seemed like it would be a pain) I thought I'd check for
the macro.

A quick search for AC_CHECK_DEFINE found me something in the Autoconf
Archive[1] but (just before I checked it in, I discovered that) the
current version[2] is GPLv3.

[1]...

Re: privilege separation Gerald Combs (May 18)
I think it's referring to running the dissection code with as few
privileges as possible. The PrivilegeSeparation page on the wiki as a
little more information.

privilege separation Ed Beroset (May 18)
On the Wireshark wish list is "Add privilege separation for POSIX environments (in progress)." What's left to do on
that one? Apply the privilege during a "make install"?

Ed

Re: TNS data dissector Maynard, Chris (May 18)
Currently the TNS dissector simply passes off dissection of the data to the generic "data" dissector. That's the
reason why it's dissected that way.

If it's desirable for the data is to be dissected in some other way, then I believe FAQ 1.11[1] applies here.
- Chris
[1]: http://www.wireshark.org/faq.html#q1.11

-----Original Message-----
From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces ()...

Re: TNS data dissector Jeff Morriss (May 18)
Andrej van der Zee wrote:

A quick read about TNS:

https://en.wikipedia.org/wiki/Transparent_Network_Substrate

seems to indicate that it's basically a tunneling protocol. So to
decode the payload Wireshark would need to know what the contents are.
Does the protocol have some indication of its payload? If not, maybe a
TNS preference or maybe heuristics could be used to determine the
payload. (If the payload is usually the same that...

Re: TNS data dissector Andrej van der Zee (May 18)
So i guess it is impossible to look inside the data in a TNS packet and we cannot see the actual SQL queries inside the
data? Is there a specific reason why it doesnt dissect the data?

Thank you,
Andrej

RTP stats explaination Arif Hossain (May 18)
Hi all,
We are getting very poor quality of voice during testing of a new
filtering application of us.

The application receives packets from kernel using netfilter_queue
library. Then insert the packets into a new user managed queue and
does some transformations on it, like concatenation of udp payload.

The network is healthy. Its inside our lab. And it does not drop
packets or anything .

In our app we do not forward packet immediately. After...

Wireshark multiview feature demo Mikael Wikström (May 17)
Hi,

first of all I thank you all for a great piece of software.

I'd like to suggest a feature that would make wireshark even more
useful, so I thought I would describe it and see if any one else would
find it interesting.

The basic concept is to be able to view a pcap file in multiple
windows and have them track each other. Or more accurately have one
track the second one. If I then used display filters in window1 and
select a packet,...

Re: Stop criteria using capture or display filters Christopher Maynard (May 16)
Senthil Kumar S <senthilkumar.s () > writes:

certain condition.

rrespect to duration, files, file size and multiple files mode.

tshark stops capturing.

tshark stops capturing.

This functionality is not yet available, although it has been requested and is
being tracked in https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2039. You
might want to add yourself to the "CC List" for the bug, and then you will be
automatically...

Crash in airpcap_ui_dlg.c Gisle Vanem (May 16)
When I did this:

1. Open menu 'Capture | Interfaces' and select 'Options | Manage Interfaces'.
2. Click 'Local Interfaces' with the intention to hide the interface
'MS Tunnel interface driver', I got a crash at airpcap_channel_offset_changed_cb().

I'm not sure how the right way (TM) of hiding an interface is supposed to work. But
this is the offending snippet:

void...

Snort — Everyone's favorite open source IDS, Snort. This archive combines the snort-announce, snort-devel, snort-users, and snort-sigs lists.

Re: New to writing Snort Rules. Help writing a rule? evejou (May 19)
Hi Tyler,

I think what you're looking for is how to whitelist IPs:
http://manual.snort.org/node17.html#SECTION003219000000000000000

According to this entry here, you really don't want to use signatures to
white/blacklist stuff:
http://vrt-blog.snort.org/2012/04/snort-performance-and-ip-only-rules.html

-evejou

Alert management hamid alaei (May 19)
Dear all,
I wonder if someone can advise me some alert correlation software for
Snort alerts to give me better protection. I recently heard of ACARM-ng,
but I am not sure about using it and I don't know how it wort with Snort.
Thanks
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has...

Re: New to writing Snort Rules. Help writing a rule? Balasubramaniam Natarajan (May 18)
Hi Tyler,

Could you please give us a small network diagram of how your setup looks
like ? I cannot get the full picture with your explanation below.

Re: Problem writing a sig to capture vbscript unescape sequence Balasubramaniam Natarajan (May 18)
Hi Bob,

See if this works

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"Possible ActiveX
overflow via VB Script"; flow:established,from_server; content:"|65 69 70
20 3d 20 75 6e 65 73 63 61 70 65 28 22 25 36 37 25 34 31 25 34 31 25 37 65
22 29|"; sid:10000111; rev:1;)

Getting alerts from Snort to a SQL Server 2008 Michael Steele (May 18)
Has anyone found a solution of getting alerts from Snort to a Microsoft SQL
Server 2008, other than using the output database option?

Mes-

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security...

Problem writing a sig to capture vbscript unescape sequence Nathan Benson (May 18)
Hi Bob,

I was able to successfully detect the content you were looking for using
2.9.2.1, 2.9.2.2, and 2.9.2.3 all with the default snort.conf using the
rules below.

I hope this is of some help.

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ActiveX
KEYHELPLib overflow attempt"; flow:to_client,established; file_data;
content:"B7ECFD41-BE62-11D2-B9A8-00104B138C8C"; fast_pattern:only;...

New to writing Snort Rules. Help writing a rule? Tyler MacPherson (May 18)
Hi,

I recently put Snort on a system for my work. I'm trying to configure it
by writing certain rules, but since I'm brand new to Snort, I'm having
some trouble figuring out how to write these rules. Basically, the
system I'm deploying Snort on should only be receiving traffic through
two avenues: a MySQL database and Oracle database that are linked to it.
Everything else should be picked up Snort as potentially being...

Re: Snort 2.9.3 Beta Now Available Joel Esler (May 18)
I'll post some excerpts from the doc, then I'll explain a bit about how we designed this:

set
---
This keyword sets bits to group for a particular flow. When no group specified,
set the default group. This keyword always returns true.

Syntax:
flowbits:set,bats[,group]
Usage:
flowbits:set,bit1,doc;
flowbits:set,bit2&bit3,doc;
First rule sets bit1 in doc group, second rule sets bit2 and bit3 in doc group.
So...

Re: Snort-users Digest, Vol 72, Issue 37 Dennis Circolone (May 18)
Thanks for the information but it didn't really address the error I was
getting. I added screen shots with the errors to my original email , were
you able to see the error or are you telling me not to use base because
there is no fix?

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has...

Re: Snort 2.9.3 Beta Now Available Joshua Kinard (May 18)
This will be interesting to play with. I take it this was designed to
combine multiple uses of the keyword when checking the state of several
flowbits?

I take it this also fixes the handling of ignore_data with respect to the
fast-pattern matcher?

Looking at the changed code, I think this will also fix the same issue when
logging with tcpdump output. I hacked right around that for loop in
snort_stream5_tcp.c and was able to fully log all...

Re: php, base issue Greg Williams (May 18)
Thanks Doug. I'll probably try it again after you guys rebuild it with
12.04. I could have also been my hard drives. They died about a month
after I tested Security Onion. I would like to test further at some point.
Thanks for the link though. I'll remember it when I go through testing
again.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will...

Re: php, base issue Doug Burks (May 18)
Hi Greg,

We'd be glad to help you troubleshoot any performance issues you're having
with Security Onion over on our mailing list:
http://groups.google.com/group/security-onion

Thanks,
Doug

Re: php, base issue Greg Williams (May 18)
I tried it and was a little disappointed in how slow it was running for me.
I only gave it about 15 minutes, but I was definitely losing more packets
than my custom install. Maybe it's better now. ~400-500 MBps sustained.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how...

Re: php, base issue Rick Chisholm (May 18)
FWIW - you can always take a look at Security Onion - it has a bunch of
Snort front-ends you can play with.

First we had ACID and it went ker-splat, then BASE, which is dying on the
vine. Not sure what the next move is, all I know is that I need a
functional front-end and for right now that's Snorby.

Problem writing a sig to capture vbscript unescape sequence Bob Huber (May 18)
I'm trying to write a sig for this ActiveX overflow:

<html>
<body>
<object classid='clsid:B7ECFD41-BE62-11D2-B9A8-00104B138C8C' id='KEYHELPLib' />
</object>
<script language='vbscript'>
//executing calc
scode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
...SNIP...
...

OpenVAS — Development and announcements regarding OpenVAS, a free network security scanner which forked from Nessus. This is a combination of the English openvas-announce, openvas-devel, openvas-discuss, and openvas-plugins lists.

Openvas 4 or 5 Juan José Pavlik Salles (May 19)
Hi, i am not sure what to do, wheter to keep my Openvas4 installation or go
for a new Openvas5 one. Besides, i have some things already working, in my
actual desployment, but i want more. What are the main differences between
both of them?

Re: Proposal on GSA-improvements Matthew Mundell (May 19)
This is probably the feature/change that is asked for most.

If we record the config's "last modification date" in reports then we can
tell if two scans used the same version of the config.

We've improved the Targets interface for GSA. This includes timestamps and
cloning. I'm pretty sure Configs will get the same improvements.

Re: Proposal on GSA-improvements Christian Kuersteiner (May 19)
Hi all,

Completely agree with you. As an auditor I have to create and modify a
lot of different scan configs which is very time consuming in the given way.

Maybe just make an option to lock the configuration. And as you
mentioned mark it in the report.
For me I still would like the ability to diff the reports even if the
config is not locked but it should be clearly stated that this might
have some impact on the diff.

Another proposal:
How...

Proposal on GSA-improvements Stefan Schwarz (May 19)
Hi,

as some of you may have already noticed I'm a fan of good old
openvas-client. This is mostly caused by 2 major
features/implementations which are totally missed or completely
different implemented within gsa.

1) NVT filtering
Currently there are almost 25.000 NVTs available, categorized by
families. There is no chance to easily find and set NVTs relevant to
specific problems.
For example: Currently there are 310 NVTs within 28...

(no subject) Fdfdfd Fdfddd (May 19)
<p>Now Your All Dreams Will Going To Become Reality<br><a
href="http://hochzeit.hammertechtest.de/newsjournal/68JohnBaker/";>http://hochzeit.hammertechtest.de/newsjournal/68JohnBaker/</a></p>

OpenVAS-5 Demo VM ready Jan-Oliver Wagner (May 18)
Hello,

we've prepared a Demo VM for OpenVAS as an .ova image
that should run without problems at least with VirtualBox > 4
and ESXi4/5.

Its about 3.7G in size.

What need now is:

* a place where we can put the image for public downloads.
* 1 or 2 early testers before we announce it to the public.

Any help / assistance is highly appreciated!

Best

Jan

openvas for webservice testing bhargava (May 18)
Hi

I`m new to OpenVAS and wanted to know if I can use the tool to perform
security testing on web services.
Please let me know.

Thanks and Regards
Venky

Re: slave connection failed, slave connection failed, Tim Webster (May 17)
Failed to gnutls_bye: Error in the push function.
means cannot connect

to answer my own question, check login auth and firewall

Re: gsad - libmicrohttpd problems Tom Powers (May 17)
Sound Solutions, Inc.
8400 Highland Dr.
Wausau, WI 54401
Tel: 715-842-7665
Fax: 715-842-7620
Mine did the same thing on 10.10 , and I tried to get the libmicrohttpd
915 fix to work...but it kept barking about SSL and would only work in
http mode...so I figured I should try again.

When I did my intall this time...here's what I did from the start and it
seems to work great (note...all done as root):

apt-get -y install...

slave connection failed, slave connection failed, Tim Webster (May 17)
I am having some problems performing slave scans.

Thank your for your help.

This is what I am seeing in openvasmd.log with log level=255

--------------------------------------
Resent, because my account alias was blocked by the list,
Tim

lib serv: DEBUG:2012-05-17 17h00.58 utc:3608: Shook hands with peer.
event auth:MESSAGE:2012-05-17 17h00.58 utc:3608: Authentication success
for user admin (6b806cf2-4bc3-4de2-9b9b-2f6a98d30db8)
lib...

gsd segfault on startup Andrew Simmons (May 17)
Hi,

gsd v1.2.2, on Fedora 16, segfaults for me:

$ gsd
loaded the Generic plugin
Segmentation fault

Strace gives:

[...]
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=118, ...}) = 0
close(10) = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x80000009} ---
+++ killed by SIGSEGV +++
Segmentation fault

I'm baffled. Any suggestions?

thanks
Andrew

Re: gsad - libmicrohttpd problems Juan José Pavlik Salles (May 16)
Miguel, you should check this
http://lists.wald.intevation.org/pipermail/openvas-discuss/2011-November/003613.html

2012/3/23 Miguel Lucero <miguel.lucero () gmail com>

Re: 64 bits packages missing in Ubuntu 10.04, 10.10 and 11.04 Stephan Kleine (May 16)
They don't compile. See

https://build.opensuse.org/project/monitor?project=security%3AOpenVAS%3AUNSTABLE%3Av5

for details.

regards,
Stephan

Open-VAS scanner issue sankar . mindtree (May 16)
Hi,

I have installed openvas from atomic repo, when I execute the
openvas-cehck-status It is giving the below error message.

openvas-check-setup 2.1.3
Test completeness and readiness of OpenVAS-4

Please report us any non-detected problems and
help us to improve this check routine:
http://lists.wald.intevation.org/mailman/listinfo/openvas-discuss

Send us the log-file (/tmp/openvas-check-setup.log) to help analyze the
problem....

Re: Plugin to check for SSL Weak Ciphers Stefan Schwarz (May 16)
Am 16.05.2012 13:53, schrieb Matthew Mundell:

Should be worth for more detailed investigation.
I definitely did --update, so OTP worked fine.
But only --rebuild also got OMP to work.

Stefan

More Lists

Related Resources

We're always looking for great network security related lists to archive. To suggest one, mail Fyodor.