jetlib.sec » Full Disclosure » February 8, 2012

Feeds

133098 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

Full Disclosure

• February 08, 2012
• 

  Re: posting xss notifications in sites vs software packages

  Posted: February 8th, 2012, 9:05pm PST

  Tags:   

  Posted by Luis Santana on Feb 08

  Typically if you are in the US, are testing a server in the US owned by a
  company headquartered in the US it is legal to find Reflective XSS so long
  as you don't crash any services. Crashing any services can be seen as a DoS
  attack and then you are screwed. Moreover if you crash a service and cost
  the company more than 5k USD then you have a risk of the FBI trying you for
  cybercrime.
  
  *I DO NOT CONDONE TESTING SITES YOU DON'T HAVE...
  
• 

  Re: posting xss notifications in sites vs software packages

  Posted: February 8th, 2012, 6:24pm PST

  Tags:   

  Posted by Valdis . Kletnieks on Feb 08

  On Wed, 08 Feb 2012 17:30:18 +0100, Info said:
  
  Yes. No. Maybe. Depends where you live, where the web server is physically
  located, and where the corporate headquarters are. In the US, the law you
  need to worry about most is 18 USC 1030:
  
  http://www.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00001030----000-.html
  
  "... having knowingly accessed a computer without authorization or exceeding
  authorized access, and by means of such...
  
• 

  Iran is doing ip-and-port filtering of SSL

  Posted: February 8th, 2012, 6:06pm PST

  Tags:   

  Posted by Sai on Feb 08

  I have pretty definitive proof that Iran is doing ip-and-port based
  filtering of SSL.
  
  Filtering is being done by 217.218.154.250 after a hop through
  217.219.96.120 / 217.219.96.132. This hop is after my source's ISP,
  and all three IPs are owned by ITC, Iran's central telco.
  
  Filtering targets all google.com IPs, some but not all torproject.org
  IPs, probably more. Haven't attempted a broad scan. It's a simple
  connection drop;...
  
• 

  Re: trixd00r v0.0.1 - Advanced and invisible TCP/IP based userland backdoor

  Posted: February 8th, 2012, 6:03pm PST

  Tags:   

  Posted by Kryton Jones on Feb 08

  Is this something like Port Knocking ??
  
  http://en.wikipedia.org/wiki/Port_knocking
  
• 

  Re: posting xss notifications in sites vs software packages

  Posted: February 8th, 2012, 6:02pm PST

  Tags:   

  Posted by Info on Feb 08

  A general question: is it legal to search for XSS vulnerabilities on
  custom websites ?
  
  Julien
  
• 

  Re: posting xss notifications in sites vs software packages

  Posted: February 8th, 2012, 5:44pm PST

  Tags:   

  Posted by Greg Knaddison on Feb 08

  I think there are at least 2 reasons:
  
  1. We have pretty good data about bugs in published software packages
  because those vendors will usually disclose the issues and we can
  track it and know what's going on. But we don't have good data for
  security bugs in completely custom code. I think it's helpful to prove
  the point that custom code has security bugs too, even if we don't see
  CVE numbers for it.
  2. If you are a customer...
  
• 

  Re: trixd00r v0.0.1 - Advanced and invisible TCP/IP based userland backdoor

  Posted: February 8th, 2012, 4:15pm PST

  Tags:   

  Posted by mezgani ali on Feb 08

  I was working on a backdoor kernel land, using netfilter =]
  
  Kind regards,
  
• 

  InfoSec Southwest 2012 Speakers and Agenda

  Posted: February 8th, 2012, 2:34pm PST

  Tags:   

  Posted by I)ruid on Feb 08

  Hello,
  
  It is my pleasure to announce InfoSec Southwest 2012's final speaker
  selections. The following lectures will be given at this year's
  conference:
  
  * Peiter "Mudge" Zatko - Keynote
  * Orlando Barrera II & Josh Sokol - A New Technique in Data Exfiltration
  and Confidentiality
  * Daniel "unicornFurnace" Crowley - Speaking with Cryptographic Oracles
  * Nick DePetrillo & Lurene "pusscat" Grenier - Le...
  
• 

  Re: trixd00r v0.0.1 - Advanced and invisible TCP/IP based userland backdoor

  Posted: February 8th, 2012, 2:25pm PST

  Tags:   

  Posted by Levent Kayan on Feb 08

  you can see that kinda as port knocking yes.
  
  cheers,
  noptrix
  
• 

  Re: trixd00r v0.0.1 - Advanced and invisible TCP/IP based userland backdoor

  Posted: February 8th, 2012, 2:24pm PST

  Tags:   

  Posted by Levent Kayan on Feb 08

  privet,
  
  thank you.
  
  no problem, as ex-CCCP guy i understand russian.
  
  yes. 0.0.2 will become "uberbeautiful" and will include all stuff listed
  in docs/TODO + bugfixes. this is only an initial release, stay tuned for
  future releases...
  
  cheers,
  noptrix
  
• 

  Re: trixd00r v0.0.1 - Advanced and invisible TCP/IP based userland backdoor

  Posted: February 8th, 2012, 2:03pm PST

  Tags:   

  Posted by Kai on Feb 08

  Hello,
  
  it's... beautiful.
  
  do you mean that your tool will include analog of this:
  https://rdot.org/forum/showpost.php?p=15855&postcount=11 ? (russian
  language)
  if yes than 0.0.2 will be uberbeautiful.
  
• 

  trixd00r v0.0.1 - Advanced and invisible TCP/IP based userland backdoor

  Posted: February 8th, 2012, 1:37pm PST

  Tags:   

  Posted by Levent Kayan on Feb 08

  Hi there,
  
  description
  ===========
  trixd00r is an advanced and invisible userland backdoor based on TCP/IP
  for UNIX systems. It consists of a server and a client. The server sits
  and waits for magic packets using a sniffer. If a magic packet arrives,
  it will bind a shell over TCP or UDP on the given port or connecting
  back to the client again over TCP or UDP. The client is used to send
  magic packets to trigger the server and get a shell.
  
  file...
  
• 

  ZDI-12-031 : Novell iPrint Server attributes-natural-language Remote Code Execution Vulnerability

  Posted: February 8th, 2012, 9:46am PST

  Tags:   

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-031 : Novell iPrint Server attributes-natural-language Remote
  Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-031
  February 8, 2012
  
  -- CVE ID:
  CVE-2011-4194
  
  -- CVSS:
  9, AV:N/AC:L/Au:N/C:P/I:P/A:C
  
  -- Affected Vendors:
  
  Novell
  
  -- Affected Products:
  
  Novell iPrint
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital Vaccine...
  
• 

  ZDI-12-030 : IBM Rational Rhapsody BBFlashBack.Recorder.1 TestCompatibilityRecordMode Remote Code Execution Vulnerability

  Posted: February 8th, 2012, 9:45am PST

  Tags:   

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-030 : IBM Rational Rhapsody BBFlashBack.Recorder.1
  TestCompatibilityRecordMode Remote Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-030
  February 8, 2012
  
  -- CVE ID:
  CVE-2011-1388
  
  -- CVSS:
  9, AV:N/AC:L/Au:N/C:P/I:P/A:C
  
  -- Affected Vendors:
  
  IBM
  
  -- Affected Products:
  
  IBM Rational Rhapsody
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this...
  
• 

  ZDI-12-029 : IBM Rational Rhapsody BBFlashBack.Recorder.1 InsertMarker Remote Code Execution Vulnerability

  Posted: February 8th, 2012, 9:44am PST

  Tags:   

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-029 : IBM Rational Rhapsody BBFlashBack.Recorder.1 InsertMarker
  Remote Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-029
  February 8, 2012
  
  -- CVE ID:
  CVE-2011-1391
  
  -- CVSS:
  9, AV:N/AC:L/Au:N/C:P/I:P/A:C
  
  -- Affected Vendors:
  
  IBM
  
  -- Affected Products:
  
  IBM Rational Rhapsody
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital...
  
• 

  ZDI-12-028 : IBM Rational Rhapsody BBFlashBack.FBRecorder.1 Control Multiple Remote Code Execution Vulnerabilities

  Posted: February 8th, 2012, 9:42am PST

  Tags:   

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-028 : IBM Rational Rhapsody BBFlashBack.FBRecorder.1 Control
  Multiple Remote Code Execution Vulnerabilities
  http://www.zerodayinitiative.com/advisories/ZDI-12-028
  February 8, 2012
  
  -- CVE ID:
  CVE-2011-1392
  
  -- CVSS:
  9, AV:N/AC:L/Au:N/C:P/I:P/A:C
  
  -- Affected Vendors:
  
  IBM
  
  -- Affected Products:
  
  IBM Rational Rhapsody
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by...
  
• 

  ZDI-12-027 : IBM SPSS VsVIEW6.ocx ActiveX Control SaveDoc Method Remote Code Execution Vulnerability

  Posted: February 8th, 2012, 9:40am PST

  Tags:   

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-027 : IBM SPSS VsVIEW6.ocx ActiveX Control SaveDoc Method
  Remote Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-027
  February 8, 2012
  
  -- CVE ID:
  CVE-2012-0189
  
  -- CVSS:
  7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
  
  -- Affected Vendors:
  
  IBM
  
  -- Affected Products:
  
  IBM SPSS
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital Vaccine...
  
• 

  ZDI-12-026 : IBM SPSS ExportHTML.dll ActiveX Control Render Method Remote Code Execution Vulnerability

  Posted: February 8th, 2012, 9:38am PST

  Tags:   

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-026 : IBM SPSS ExportHTML.dll ActiveX Control Render Method
  Remote Code Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-026
  February 8, 2012
  
  -- CVE ID:
  CVE-2012-0190
  
  -- CVSS:
  7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
  
  -- Affected Vendors:
  
  IBM
  
  -- Affected Products:
  
  IBM SPSS
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital Vaccine...
  
• 

  ZDI-12-025 : EMC Networker indexd.exe Opcode 0x01 Parsing Remote Code Execution

  Posted: February 8th, 2012, 9:37am PST

  Tags:   

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-025 : EMC Networker indexd.exe Opcode 0x01 Parsing Remote Code
  Execution
  http://www.zerodayinitiative.com/advisories/ZDI-12-025
  February 8, 2012
  
  -- CVE ID:
  CVE-2012-0395
  
  -- CVSS:
  10, AV:N/AC:L/Au:N/C:C/I:C/A:C
  
  -- Affected Vendors:
  
  EMC
  
  -- Affected Products:
  
  EMC NetWorker
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital Vaccine protection filter ID...
  
• 

  ZDI-12-024 : Total Defense Suite UNC Management Web Service uncsp_ViewReportsHomepage SQL Injection Vulnerability

  Posted: February 8th, 2012, 9:33am PST

  Tags:   

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-024 : Total Defense Suite UNC Management Web Service
  uncsp_ViewReportsHomepage SQL Injection Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-024
  February 8, 2012
  
  -- CVE ID:
  
  -- CVSS:
  7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
  
  -- Affected Vendors:
  
  Total Defense
  
  -- Affected Products:
  
  Total Defense CA Total Defense
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this...
  
• 

  ZDI-12-023 : Total Defense Suite UNC Management Web Service Database Credentials Disclosure Vulnerability

  Posted: February 8th, 2012, 9:31am PST

  Tags:   

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-023 : Total Defense Suite UNC Management Web Service Database
  Credentials Disclosure Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-023
  February 8, 2012
  
  -- CVE ID:
  
  -- CVSS:
  7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
  
  -- Affected Vendors:
  
  Total Defense
  
  -- Affected Products:
  
  Total Defense CA Total Defense
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by...
  
• 

  ZDI-12-022 : Total Defense Suite UNC Management Console ExportReport SQL Injection Vulnerability

  Posted: February 8th, 2012, 9:29am PST

  Tags:   

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-022 : Total Defense Suite UNC Management Console ExportReport
  SQL Injection Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-022
  February 8, 2012
  
  -- CVE ID:
  
  -- CVSS:
  10, AV:N/AC:L/Au:N/C:C/I:C/A:C
  
  -- Affected Vendors:
  
  Total Defense
  
  -- Affected Products:
  
  Total Defense CA Total Defense
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital...
  
• 

  ZDI-12-021 : Adobe Reader BMP Resource Signedness Remote Code Execution Vulnerability

  Posted: February 8th, 2012, 9:22am PST

  Tags:   

  Posted by ZDI Disclosures on Feb 08

  ZDI-12-021 : Adobe Reader BMP Resource Signedness Remote Code
  Execution Vulnerability
  http://www.zerodayinitiative.com/advisories/ZDI-12-021
  February 8, 2012
  
  -- CVE ID:
  CVE-2011-4373
  
  -- CVSS:
  7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P
  
  -- Affected Vendors:
  
  Adobe
  
  -- Affected Products:
  
  Adobe Reader
  
  -- TippingPoint(TM) IPS Customer Protection:
  TippingPoint IPS customers have been protected against this
  vulnerability by Digital Vaccine protection filter...
  
• 

  Netbeans Jira Plugin does not check https certificates

  Posted: February 8th, 2012, 7:53am PST

  Tags:   

  Posted by Carlos Pantelides on Feb 08

  Title:
  -------
  Netbeans Jira Plugin does not check https certificates
  
  Disclosure Timeline:
  -----------------------------
  [2012-01-02] Vulnerability reported (http://netbeans.org/bugzilla/show_bug.cgi?id=206848)
  [2012-01-03] Assigned
  [2012-01-30] More info added and asked for status
  [2012-02-08] No answer, fully disclosed
  
  Introduction
  ------------
  
  Jira is a project tracking tool. It provides an API. (www.atlassian.com/software/jira)
  
  Netbeans...
  
• 

  Re: posting xss notifications in sites vs software packages

  Posted: February 8th, 2012, 7:44am PST

  Tags:   

  Posted by Packet Storm on Feb 08

  In some cases, a cross site scripting vulnerability in a given site can affect a large user base and the code is custom
  to the business. As an example, a cross site scripting issue in gmail is probably more catastrophic than a cross site
  scripting vuln in some half-rate CMS. Not to mention there's the other situation where small website design shops
  repackage other open source code, brand it as part of their offering, and never provide...
  
• 

  Re: posting xss notifications in sites vs software packages

  Posted: February 8th, 2012, 5:55am PST

  Tags:   

  Posted by Luis Santana on Feb 08

  Typically you will run into instances where a website is employing a custom
  CMS/plugin/module/whatever and as such there may not be a specific software
  to call out as the one at fault.
  
  It's like finding an XSS in Microsoft, 99% chance they are running their
  own custom CMS so at that point you are just left with saying that
  Microsoft is vulnerable to XSS as there is no name to the software at hand.
  
• 

  Cyberoam Central Console v2.00.2 - File Include Vulnerability & Video

  Posted: February 8th, 2012, 2:24am PST

  Tags:   

  Posted by research () vulnerability-lab com on Feb 08

  Title:
  ======
  Cyberoam Central Console v2.00.2 - File Include Vulnerability
  
  Date:
  =====
  2012-02-08
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=405
  
  VL-ID:
  =====
  405
  
  Introduction:
  =============
  Cyberoam Central Console (CCC) appliances offer the flexibility of hardware CCC appliances and virtual CCC
  appliances to provide centralized security management across distributed Cyberoam UTM appliances, enabling
  high...
  
• 

  posting xss notifications in sites vs software packages

  Posted: February 8th, 2012, 2:23am PST

  Tags:   

  Posted by b on Feb 08

  What is the point of posting notifications of XSS vulnerabilities in
  specific web sites instead of alerts of xss vulns in specific software
  packages?
  
  This question was prompted by all the postings by that vulnerability lab
  stuff.
  
• 

  Fwd: DVR Security Issue

  Posted: February 8th, 2012, 1:27am PST

  Tags:   

  Posted by Jason Ellison on Feb 08

  I tried to report this to the vendor in 2009. SHODAN "OwnServer1.0":
  Results 1 - 10 of about 11832 for OwnServer1.0 country:US.
  
  -Jason Ellison
  
  ---------- Forwarded message ----------
  From: Jason Ellison <infotek () gmail com>
  Date: Fri, Apr 10, 2009 at 5:02 PM
  Subject: DVR Security Issue
  To: sales () tibetsystem com
  
  Hello,
  
  I am a I.T. consultant in the U.S.  I have
  discovered a security flaw in your product.  Please...