Bugtraq: by date

312 messages starting Sep 02 02 and ending Sep 30 02
Date index | Thread index | Author index

Monday, 02 September

The ScrollKeeper Root Trap Spybreak
XSS in Null HTTPd Matthew Murphy
SECNAP Security Alert: Radmin Default install options vulnerability Michael Scheidell
[RHSA-2002:186-07] Updated scrollkeeper packages fix tempfile vulnerability bugzilla
Re: Trillian XML parser buffer overflow soulshock
One step easier password guessing on Windows NP-completer
Happy Labor Day from Snosoft KF
Outlook S/MIME Vulnerability Mike Benham
Windows .NET Server (RC1) and MSDE (#NISR03092002B) NGSSoftware Insight Security Research
Microsoft SQL Server Stored procedures [sp_MSSetServerPropertiesn and sp_MSsetalertinfo] (#NISR03092002A) NGSSoftware Insight Security Research
New Paper: Threat profiling Microsoft SQL Server NGSSoftware Insight Security Research
SWS Web Server v0.1.0 Exploit saman

Tuesday, 03 September

[SECURITY] [DSA 160-1] New scrollkeeper packages fix insecure temporary file creation Martin Schulze
Compaq mount patch broken Paul Szabo
Re: Outlook S/MIME Vulnerability Spyder
Re: CacheFlow CacheOS Cross-site Scripting Vulnerability Blue
Re: Security side-effects of Word fields Woody Leonhard
SecuRemote usernames can be guessed or sniffed using IKE exchange Roy Hills
MSIEv6 % encoding causes a problem again Liu Die Yu
Cisco Security Advisory: Cisco VPN 3000 Concentrator Multiple Vulnerabilities Cisco Systems Product Security Incident Response Team
Re: SUMMARY: Disabling Port 445 (SMB) Entirely Shaolin Tiger
Re: One step easier password guessing on Windows Howard Yeend
Re: Compaq mount patch broken Florian Weimer
[security bulletin] SSRT2310a HP Tru64 UNIX & HP OpenVMS Potential OpenSSL Security Vulnerability (fwd) Dave Ahmad
Re: **maillist:: Outlook S/MIME Vulnerability Thomas Seliger
[CLA-2002:522] Conectiva Linux Security Announcement - mailman secure
Cross-Site Scripting in Aestiva's HTML/OS eax

Wednesday, 04 September

GLSA: scrollkeeper Daniel Ahlberg
Cacti security issues Knights of the Routing Table
AFD 1.2.14 multiple local root compromises Bert Vanmanshoven
Re: MSIEv6 % encoding causes a problem again Dave Ahmad
[SECURITY] [DSA 161-1] New Mantis package fixes privilege escalation Martin Schulze
Bypassing the Finjan SurfinGate URL filter Marc Ruef
SPIKE 2.6 Released... Dave Aitel
Re: **maillist:: Outlook S/MIME Vulnerability Timothy J . Miller
Re: **maillist:: Outlook S/MIME Vulnerability Torbjörn Hovmark
TRU64 formal disclosure from Snosoft. KF
Re: MSIEv6 % encoding causes a problem again jelmer
Re: MSIEv6 % encoding causes a problem again Dave Ahmad
Re: Compaq mount patch broken Paul Szabo

Thursday, 05 September

SuSE Security Announcement: glibc (SuSE-SA:2002:031) Roman Drahtmueller
GLSA: amavis Daniel Ahlberg
Cisco Security Advisory: Cisco VPN Client Multiple Vulnerabilities - Second Set Cisco Systems Product Security Incident Response Team
RE: SecuRemote usernames can be guessed or sniffed using IKE exchange Scott Walker Register
RE: Bypassing the Finjan SurfinGate URL filter Menashe Eliezer
advisory UkR security team™
RE: (Fwd) MSIEv6 % encoding causes a problem again Thor Larholm
Re: SWS Web Server v0.1.0 Exploit 3APA3A

Friday, 06 September

MSIEv6 % encoding - Konqueror 3.0.3 also vulnerable Piotr Pawłow
zero-width gif: exploit PoC for NS6.2.3 (fixed in 7.0) [Was: GIFs Good, Flash Executable Bad] zen-parse
Foundstone Labs Advisory - Remotely Exploitable Buffer Overflow in PGP Foundstone Labs
Rapid 7 Advisory R7-0005: ZMerge Insecure Default ACLs Rapid 7 Security Advisories
Veritas Backup Exec opens networks for NetBIOS based attacks? Geoff Craig
Re: Security side-effects of Word fields B . Goodman
UPDATE: (Was Veritas Backup Exec opens networks for NetBIOS based attacks?) Geoff Craig
RE: Veritas Backup Exec opens networks for NetBIOS based attacks? Gino Genari
Re: MSIEv6 % encoding - Konqueror 3.0.3 also vulnerable Dirk Mueller
[SECURITY] [DSA 162-1] New ethereal packages fix buffer overflow Martin Schulze
MDKSA-2002:054-1 - gaim update Mandrake Linux Security Team
All versions of windows infected? Iamhatingit
Next-hop scanning for open firewall ports David G. Andersen
KSTAT (and maybe others) bypass Dark Angel

Saturday, 07 September

Re: All versions of windows infected? Walter Hop
NetGear FM114P URL filter bypassing vulnerability Marc Ruef
Re: Next-hop scanning for open firewall ports Chris Brenton
Re: Next-hop scanning for open firewall ports Darren Reed
Re: All versions of windows infected? Axel Pettinger
PHP header() CRLF Injection Matthew Murphy

Monday, 09 September

Vulnerabilities in Microsoft's Java implementation Jouko Pynnonen
phpGB: cross site scripting bug ppp-design
Guardent Client Advisory: Multiple wordtrans-web Vulnerabilities Allen . Wilson
GLSA: glibc Daniel Ahlberg
sql injection vulnerability in WBB 2.0 RC1 and below Cano2
[SECURITY] [DSA 159-2] New Python packages fix problem introduced by security fix Martin Schulze
[RHSA-2002:188-08] New wordtrans packages fix remote vulnerabilities bugzilla
Who framed Internet Explorer (GM#010-IE) GreyMagic Software
Unmask 1.0 Release Party at My House! Dave Aitel
phpGB: DoS and executing_arbitrary_commands ppp-design
Trillian weakly encrypts saved passwords Evan Nemerson
RE: Trillian weakly encrypts saved passwords Brenna Primrose
[SECURITY] [DSA 163-1] New mhonarc packages fix cross site scripting problems Martin Schulze
Re: Trillian weakly encrypts saved passwords Mike Benham
Small bug crashes OE Raistlin
Small correction... Raistlin
phpGB: mysql injection bug ppp-design
RE: PHP header() CRLF Injection Eric Stevens
PHP fopen() CRLF Injection Ulf Harnhammar

Tuesday, 10 September

Strange Attractors and TCP/IP Sequence Number Analysis - One Year Later Michal Zalewski
MDKSA-2002:058 - kdelibs update Mandrake Linux Security Team
[SECURITY] [DSA 164-1] New cacti package fixes arbitrary code execution Martin Schulze
IE6 SP1 Notes Thor Larholm
MDKSA-2002:057 - krb5 update Mandrake Linux Security Team
Re: Trillian weakly encrypts saved passwords jelmer
[RHSA-2002:189-08] Updated gaim client fixes URL vulnerability bugzilla
Re: Small bug crashes OE Kilian CAVALOTTI
RE: Who framed Internet Explorer and IE6 SP1 GreyMagic Software
Password Security Policy Question L. Adrian Griffis
Re: Password Security Policy Question Roman Drahtmueller
Re: Password Security Policy Question bugtraq
Apple QuickTime ActiveX v5.0.2 Buffer Overrun (a091002-1) @stake Advisories
Foundstone Labs Advisory - Buffer Overflow in Savant Web Server Foundstone Labs

Wednesday, 11 September

Buffer over/underflows in ssldump prior to 0.9b3 Eric Rescorla
KDE Security Advisory: Secure Cookie Vulnerability Dirk Mueller
KDE Security Advisory: Konqueror Cross Site Scripting Vulnerability Dirk Mueller
[security bulletin] SSRT-547 HP Tru64 UNIX Potential Security Vulnerabilities TPC/IP, FTPD, ARP (fwd) Dave Ahmad
Re: Foundstone Labs Advisory - Buffer Overflow in Savant Web Server zeno
Final Speakers for HiverCon 2002 Announced Mark Anderson
RE: SecuRemote usernames can be guessed or sniffed using IKE exchange Roy Hills
MDKSA-2002:059 - php update Mandrake Linux Security Team
Privacy leak in mozilla Sven Neuhaus
Re: Vulnerabilities in Microsoft's Java implementation Damon McMahon
Some unpatched vulnerabilities fixed Auriemma Luigi
Norton AntiVirus 2001 POP3 Proxy local DoS Berend-Jan Wever
Re: Vulnerabilities in Microsoft's Java implementation Gwendal Stevanazzi
Re: Vulnerabilities in Microsoft's Java implementation Mike Duncan
Re: Small bug crashes OE Berend-Jan Wever
slashdot / slashcode disclosing passwords Michal Zalewski
Re: slashdot / slashcode disclosing passwords Craig Dickson

Thursday, 12 September

Re: Small bug crashes OE David Komanek

Friday, 13 September

[SECURITY] [DSA 166-1] New purity packages fix potential buffer overflows Martin Schulze
Re: Password Security Policy Question Greg A. Woods
Re: OpenSSL worm in the wild Eric Rescorla
Re: slashdot / slashcode disclosing passwords Michal Zalewski
[securitydigest.org]: Changes in August/September 2002 Curator at Security Digest Archives
FW: Bypassing SMTP Content Protection with a Flick of a Button Menashe Eliezer

Monday, 16 September

Re: bugtraq.c httpd apache ssl attack Fernando Nunes
Re: Race condition in BRU Workstation 17.0 prophecy
Re: OpenSSL worm in the wild Eric Rescorla

Tuesday, 17 September

nidump on OS X Dale Harris
Re: Bypassing SMTP Content Protection with a Flick of a Button Steven M. Bellovin
Planet Web Software Buffer Overflow UkR security team™
NSSI-2002-sygatepfw5: Sygate Personal Firewall IP Spoofing Vulnerability Abraham Lincoln
Bug in Opera and Konqueror Zeux
RE: bugtraq.c httpd apache ssl attack Sandu Mihai Eduard
NetBSD Security Advisory 2002-012: buffer overrun in setlocale NetBSD Security Officer
NetBSD Security Advisory 2002-011: Sun RPC XDR decoder contains buffer overflow NetBSD Security Officer
Remote detection of vulnerable OpenSSL versions Florian Weimer
NetBSD Security Advisory 2002-017: shutdown(s, SHUT_RD) on TCP socket does not work as intended NetBSD Security Officer
NetBSD Security Advisory 2002-014: fd_set overrun in mbone tools and pppd NetBSD Security Officer
Multiple NetBSD Security Advisories Released/Updated NetBSD Security Officer
NetBSD Security Advisory 2002-010: symlink race in pppd NetBSD Security Officer
Re: bugtraq.c httpd apache ssl attack Ben Laurie
Re: Password Security Policy Question Nate Lawson
NetBSD Security Advisory 2002-007: Repeated TIOCSCTTY ioctl can corrupt session hold counts NetBSD Security Officer
[SECURITY] [DSA-136-3] Multiple OpenSSL problems (update) Michael Stone
NetBSD Security Advisory 2002-006: buffer overrun in libc/libresolv DNS resolver NetBSD Security Officer
iDEFENSE Security Advisory 09.16.2002: FreeBSD Ports libkvm Security Vulnerabilities David Endler
[SECURITY] [DSA-136-2] Multiple OpenSSL problems (update) Michael Stone
NetMeeting 3.01 Local RDS Session Hijacking Paul A Roberts
Analysis of Modap worm Mario van Velzen
[SECURITY] [DSA 167-1] New kdelibs fix cross site scripting bug Martin Schulze
FreeBSD Security Advisory FreeBSD-SA-02:39.libkvm FreeBSD Security Advisories
NetBSD Security Advisory 2002-009: NetBSD Security Officer
Microsoft Windows XP Remote Desktop denial of service vulnerability Ben Cohen
NetBSD Security Advisory 2002-013: Bug in NFS server code allows remote denial of service NetBSD Security Officer
Re: Bug in Opera and Konqueror Dirk Mueller
Microsoft Windows Remote Desktop Protocol checksum and keystroke vulnerabilities Ben Cohen
NetBSD Security Advisory 2002-018: Multiple security isses with kfd daemon NetBSD Security Officer
Advisory: File disclosure in DB4Web Stefan . Bagdohn
Lycos HTMLGear Guestbook Script Injection Vulnerability Matthew Murphy

Wednesday, 18 September

joe editor backup problem Ondrej Suchy
Re: Linux Slapper Worm code KF
OpenSSH 3.4p1 Privsep Andrew Danforth
Re: bugtraq.c httpd apache ssl attack Ben Kittridge
Advisory: TCP-Connection risk in DB4Web Stefan . Bagdohn
Re: nidump on OS X Jason A. Fager
Microsoft Windows Terminal Services vulnerabilities Ben Cohen
Re: Password Security Policy Question Crispin Cowan
Re: nidump on OS X Bryan Blackburn
Trillian .74 and below, ident flaw. Lance Fitz-Herbert
Cisco Security Advisory: Cisco VPN 5000 Client Multiple Vulnerabilities Cisco Systems Product Security Incident Response Team
SuSE Security Announcement: xf86 (SuSE-SA:2002:032) Sebastian Krahmer
Re: nidump on OS X Martin
IRIX default root umask and coredumps SGI Security Coordinator
Execution Rights Not Checked Correctly For 16-bit Applications Torbjörn Hovmark
Re: OpenSSH 3.4p1 Privsep eric
Cisco Security Advisory: Microsoft Windows SMB Denial of Service Vulnerabilities in Cisco Products - MS02-045 Cisco Systems Product Security Incident Response Team
Cisco VPN 5000 client buffer overflow vulnerabilities. Niels Heinen
[SECURITY] [DSA 168-1] New PHP packages fix several vulnerabilities Martin Schulze
Re: Remote detection of vulnerable OpenSSL versions Eric Rescorla
Re: Trillian .74 and below, ident flaw. Jason Barbour
Re: OpenSSH 3.4p1 Privsep Artem Chuprina
iDEFENSE Security Advisory 09.18.2002: Security Vulnerabilities in OSF1/Tru64 3. David Endler
Firewall-1 �HTTP Security Server - Proxy vulnerability Mark van Gelder
Re: nidump on OS X John C. Welch
Foundstone Research Labs Advisory - Remotely Exploitable Buffer Overflow in ISS Scanner Marshall Beddoe
RE: Execution Rights Not Checked Correctly For 16-bit Application s Vigneau, Steve
trillian DoS: trillian 1.0 pro also vulnerable Jose Nazario
Web browser certificate Validation flaw: Netscape, Mozilla, MSIE vulnerable - still? Pidgorny, Slav
Re: Bug in Opera and Konqueror Andy Spiers
Re: Linux Slapper Worm Ajai Khattri
Mozilla vulnerabilities, an update Thor Larholm
Fw: [ut2003bugs] remote denial of service in ut2003 demo Arne Schwerdtfegger
The Art of Unspoofing eric.prince
Re: OpenSSH 3.4p1 Privsep Just Marc
Re: slashdot / slashcode disclosing passwords Jamie McCarthy

Thursday, 19 September

Re: Bug in Opera and Konqueror Michael McCallum
Re: OpenSSH 3.4p1 Privsep Peter J. Holzer
KPMG-2002035: IBM Websphere Large Header DoS Peter Gründl
The Trivial Cisco IP Phones Compromise Ofir Arkin
Re: Web browser certificate Validation flaw: Netscape, Mozilla, MSIE vulnerable - still? nestler
Trillian .73 & .74 "PRIVMSG" Overflow. Lance Fitz-Herbert
Re: The Art of Unspoofing Euan
http://online.securityfocus.com/archive/1/291358/2002-09-08/2002-09-14/0, Subj: Norton AintiVirus 2001 POPROXY DoS Sym Security
Re: Execution Rights Not Checked Correctly For 16-bit Applications Torbjörn Hovmark
Re: Linux Slapper Worm Miroslaw Jaworski
Re: The Art of Unspoofing Darren Reed
Re: nidump on OS X Blake Watters
Re: [Full-Disclosure] iDEFENSE Security Advisory 09.18.2002: Security Vulnerabilities in OSF1/Tru64 3. Steven M. Christey
Re: Linux Slapper Worm Charles Stevenson
Squirrel Mail 1.2.7 XSS Exploit DarC KonQuesT
[CLA-2002:524] Conectiva Linux Security Announcement - postgresql secure
Re: Squirrel Mail 1.2.7 XSS Exploit Jason Munro
iDEFENSE OSF1/Tru64 3.x vuln clarification KF

Friday, 20 September

More vulnerabilities (Re: Security side-effects of Word fields) Alex Gantman
CanSecWest/core03 Dragos Ruiu
Re: The Trivial Cisco IP Phones Compromise Jim Duncan
[CLA-2002:525] Conectiva Linux Security Announcement - kdelibs secure
ANNOUNCE: RATS 2.0 RATS Team
Re: Trillian .74 and below, ident flaw. netmask {enZo}
ANNOUNCE: Egads 0.9.5 EGADS Team
Re: Microsoft Windows Terminal Services vulnerabilities Ben Cohen
Yet Another. Trillian 'JOIN' Overflow. Lance Fitz-Herbert
ShadowCon 2002 Sharla Warren
Re: NetMeeting 3.01 Local RDS Session Hijacking proberts
Re: The Trivial Cisco IP Phones Compromise Peter Peters
SuSE Security Announcement: Slapper worm (SuSE-SA:2002:033) Olaf Kirch
Re: The Art of Unspoofing Sean Trifero
RE: The Trivial Cisco IP Phones Compromise Ofir Arkin

Saturday, 21 September

Re: [UPDATED] Advisory: Multiple 602Pro LAN SUITE 2002 Denial of Service Attacks Brandon Sturgeon
And Again. Trillian 'raw 221' Overflow. Lance Fitz-Herbert

Monday, 23 September

*sigh* Trillian multiple DoS's flaws. Lance Fitz-Herbert
remote exploitable heap overflow in Null HTTPd 0.5.0 Bert Vanmanshoven
ToorCon 2002 This Weekend h1kari
JAWmail XSS Ulf Harnhammar
Technical information about the vulnerabilities fixed by MS-02-52 Jouko Pynnonen
IE6 SSL Certificate Chain Verification Zoltán Nochta
RE: NetMeeting 3.01 Local RDS Session Hijacking Adcock, Matt
PHP source injection in phpWebSite Tim Vandermeersch
NetBSD Security Advisory 2002-009: Multiple vulnerabilities in OpenSSL code (updated 2002/9/22) NetBSD Security Officer
[security bulletin] SSRT2362 WEBES Service Tools (HP Tru64 UNIX, HP OpenVMS, Windows) Potential File Access Vulnerability (fwd) Dave Ahmad
iDEFENSE Security Advisory 09.23.2002: Directory Traversal in Dino's Webserver David Endler
[CLA-2002:526] Conectiva Linux Security Announcement - xchat secure
Wireless Networking Frailty gregh
Now Online: OWASP Guide to Building Secure Web Applications v1.1 David Endler
Trillian Remote DoS Attack - AIM Spikeman
Kondara MNU/Linux Kurt Seifried

Tuesday, 24 September

HP Procurve 4000M Stacked Switch HTTP Reset Vulnerability Brook Powers
Xoops RC3 script injection vulnerability das
Slapper worm redux; Ron DuFresne
JSP source code exposure in Tomcat 4.x Rossen Raykov
Re: JSP source code exposure in Tomcat 4.x DominusQ
Apache 2.0.(39|40) DOS (PHP!) shaddup
Re: IE6 SSL Certificate Chain Verification Jason
RE: Trillian Remote DoS Attack - AIM Joshua Wright
PHPNUKE 6 XSS Vulnerabilities Mark Grimes
RE: Trillian Remote DoS Attack - AIM Eric Stevens
Re: JSP source code exposure in Tomcat 4.x Marcin Jackowski
Information Disclosure with Invision Board installation (fwd) Gossi The Dog
Re: PHP source injection in phpWebSite Matthias Bauer

Wednesday, 25 September

IIL Advisory: Reverse traversal vulnerability in Monkey (0.1.4) HTTP server DownBload
[RHSA-2002:060-17] Updated Zope packages are available bugzilla
RE: JSP source code exposure in Tomcat 4.x Martin Robson
Shana Informed 3.05 information disclosure sullo
Re: Information Disclosure with Invision Board installation (fwd) Gossi The Dog
IIL Advisory: Format String bug in Null Webmail (0.6.3) DownBload
IIL Advisory: Vulnerabilities in acWEB HTTP server DownBload
OpenVMS POP server local vulnerability Mike Riley
GLSA: tomcat Daniel Ahlberg
ECHU Alert #2: IMG Attack in the news : 6 CMS vulnerables das
Not a bug: IIL Advisory: Format String bug in Null Webmail (0.6.3) Andrew Church
PHP-Nuke x.x SQL Injection Pedro Inacio
Fwd: QuickTime for Windows ActiveX security advisory Marc Bejarano
Re: Information Disclosure with Invision Board installation (fwd) Ka
Borland Interbase local root exploit grazer

Thursday, 26 September

Microsoft PPTP Server and Client remote vulnerability sh
iDEFENSE Security Advisory 09.26.2002: Exploitable Buffer Overflow in gv David Endler
Re: Xoops RC3 script injection vulnerability fixed Sergio
Errata: iDEFENSE Security Advisory 09.26.2002: Exploitable Buffer Overflow in gv David Endler
Re: iDEFENSE Security Advisory 09.26.2002: Exploitable Buffer Overflow in gv Boris Veytsman
Postnuke XSS issues Mark Grimes
RE: iDEFENSE Security Advisory 09.26.2002: Exploitable Buffer Overflow in gv David Endler
[SECURITY] [DSA 149-2] New glibc packages fix Martin Schulze
PHP-Nuke x.x AND PostNuke SQL Injection Pedro Inacio
Postnuke XSS issues [correction] Mark Grimes
remote SYSTEM compromise in WASD OpenVMS http server Jean-loup Gailly

Friday, 27 September

Another possible RFC 2046 vulnerability. Jose Marcio Martins da Cruz
Watchguard firewall appliances security issues Joao Gouveia
GLSA: dietlibc Daniel Ahlberg
Re: IIL Advisory: Reverse traversal vulnerability in Monkey (0.1.4) HTTP server Daniel R. Ome
GLSA: glibc (update) Daniel Ahlberg
Re: Hacking Citrix Faq (fwd) Dave Ahmad
Allot Netenforcer problems, GNU TAR flaw Bencsath Boldizsar
Yet another XSS vulnerability in PHP NUKE ersatz
Re: Information Disclosure with Invision Board installation (fwd) Bonemach
Re: Xoops RC3 script injection vulnerability Sergio
Software Update Available for Legacy RapidStream Appliances and W atchGuard Firebox Vclass appliances Steve Fallin

Saturday, 28 September

Re: Yet another XSS vulnerability in PHP NUKE Muhammad Faisal Rauf Danka
Re: Xoops RC3 script injection vulnerability RuIezz
Jetty jsp/servlet engine xss / uname disclosure vuln skinnay
SafeTP coughs up internal server IP addresses Jonathan G. Lampe

Monday, 30 September

iDEFENSE Security Advisory 09.30.2002: Buffer Overflow in WN Server David Endler
[LoWNOISE] "Get Knowledge" SunONE Starter Kit - Sun Microsystems/Astaware ET LoWNOISE
[RHSA-2002:096-24] Updated unzip and tar packages fix vulnerabilities bugzilla
Advisory 03/2002: Fetchmail remote vulnerabilities Stefan Esser
XSS bug in Monkey (0.5.0) HTTP server DownBload
SuSE Security Announcement: heimdal (SuSE-SA:2002:034) Sebastian Krahmer
IIL Advisory: Winamp 3 (1.0.0.488) XML parser buffer overflow vulnerability annihilator
MyNewsGroups :) XSS patch Ulf Harnhammar
QT Assistant leaves port unfiltered Rohit Sharma
Re: Another possible RFC 2046 vulnerability. Daniel Pittman
local exploitable overflow in rogue/FreeBSD stanojr

Previous period

Next period