jetlib.sec » Full Disclosure » February 20, 2012

Feeds

133122 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

Full Disclosure

• February 20, 2012
• 

  Re: Why are phone internet operators using UK MoD and US DoD IP ranges in their networks?

  Posted: February 20th, 2012, 7:21pm PST

  Tags:   

  Posted by Valdis . Kletnieks on Feb 20

  On Tue, 21 Feb 2012 05:22:04 +0400, "Andrey G. Sergeev (AKA Andris)" said:
  
  Probably lazy. Probably *not* dumb. There was almost certainly a long internal
  discussion of the relative costs and risks of deploying multiple 10/8 instances (and
  having to deal with collisions between them), and sqatting on an allocated but
  unrouted /8 like 7/8, 25/8, 40/8, and similar (and almost certainly *not* having
  to deal with collisions).
  
  And...
  
• 

  [Spanish] - Webinario gratuito - Desarrollo de botnets usando XSS

  Posted: February 20th, 2012, 7:09pm PST

  Tags:   

  Posted by runlvl on Feb 20

  Estimados, el proximo webinario gratuito es este sabado 25 de febrero,
  17 horas ( Hora Argentina )
  Tema: Desarrollo de botnets usando XSS
  Duracion: 1 hora
  Link de registracion: http://www.anymeeting.com/PIID=EC52DB88884B
  
  Los esperamos!
  
  Juan Sacco
  Exploit Pack
  
• 

  Re: Fwd: [Webappsec] Call for Assistance: OWASP Virtual Patching Survey

  Posted: February 20th, 2012, 6:33pm PST

  Tags:   

  Posted by coderman on Feb 20

  i see your survey contained many reasons for using virtual patching,
  none of which included: "Haste: virtual patches can be deployed
  extremely quickly relative to any other remediation technique."
  
  who wrote this survey?
  
  i am disappoint. ಠ_ಠ
  
• 

  Re: Why are phone internet operators using UK MoD and US DoD IP ranges in their networks?

  Posted: February 20th, 2012, 6:22pm PST

  Tags:   

  Posted by Andrey G. Sergeev (AKA Andris) on Feb 20

  Hi Julius,
  
  Sun, 19 Feb 2012 20:45:20 +0200 Julius Kivimäki wrote:
  
  Not only Sprint and T-Mobile - here is the snip from one recent spam
  message:
  
  Received: from megafonpro.ru (mail.megafonpro.ru [193.201.231.40])
  by fr51.aha.ru (Postfix) with SMTP id C24E72E3F
  for <andris () aernet ru>; Thu, 12 Jan 2012 13:03:34 +0400 (MSK)
  Received: from Privet (83.149.9.199) by megafonpro.ru (7.3.118.8)
  id 49AFA7CF0308FD8C for...
  
• 

  Fwd: [Webappsec] Call for Assistance: OWASP Virtual Patching Survey

  Posted: February 20th, 2012, 6:04pm PST

  Tags:   

  Posted by Jeffrey Walton on Feb 20

  From the folks at OWASP. Please take a moment to provide feedback if
  you have helpful comments.
  
  ---------- Forwarded message ----------
  From: Ryan Barnett <rcbarnett () gmail com>
  Date: Mon, Feb 20, 2012 at 10:25 AM
  Subject: [Webappsec] Call for Assistance: OWASP Virtual Patching Survey
  To: webappsec () lists owasp org
  
  Identification of web application vulnerabilities is only half the
  battle with remediation efforts as the other.  In an...
  
• 

  IPv6 NIDS evasion and IPv6 fragmentation/reassembly improvements

  Posted: February 20th, 2012, 3:38pm PST

  Tags:   

  Posted by Fernando Gont on Feb 20

  Folks,
  
  FYI, just posted:
  <http://blog.si6networks.com/2012/02/ipv6-nids-evasion-and-improvements-in.html>
  
  It contains some test results regarding the implementation of RFC 5722
  and draft-ietf-6man-ipv6-atomic-fragments.
  
  Thanks,
  
• 

  Re: Downloads Folder: A Binary Planting Minefield

  Posted: February 20th, 2012, 2:51pm PST

  Tags:   

  Posted by Grandma Eubanks on Feb 20

  Malware has been using it to spread through local shares and also using it
  as easy privilege escalations for known trusted software. Like I said and
  have always said, the vectors are going to be local and for further
  compromise.
  
• 

  Re: Downloads Folder: A Binary Planting Minefield

  Posted: February 20th, 2012, 2:22pm PST

  Tags:   

  Posted by Sanguinarious Rose on Feb 20

  They do not need a specific extension for LoadLibrary() to work.
  
  This is more having to do with dll search paths which has been a known
  exploit vector for a long while now. I do know Win7 fixes this by just
  not checking the local directories when it loads a .exe, I am unsure
  if Vista does the same, and I am positive WinXP checks local
  directories first since I've done so under WinXP.
  
  They might have something interesting with the...
  
• 

  Vulnerabilitites in Debian F*EX

  Posted: February 20th, 2012, 1:51pm PST

  Tags:   

  Posted by muuratsalo experimental hack lab on Feb 20

  Dear all,
  I have discovered some vulnerabilitites in Debian F*EX <= 20100208 and
  F*EX 20111129-2.
  
  F*EX (Frams's Fast File EXchange) is a service (GPL software) that can be
  used to allow users anywhere on the Internet to exchange files of ANY size
  quickly and conveniently. The sender uploads the file to the F*EX-server
  and the recipient automatically gets a notification e-mail with a
  download-URL. The sender must be a registered user in...
  
• 

  Re: Downloads Folder: A Binary Planting Minefield

  Posted: February 20th, 2012, 1:32pm PST

  Tags:   

  Posted by Jeffrey Walton on Feb 20

  While other conferences might be more appropriate, the acceptance
  underlines the problem with insecure library loading on Windows. Its
  still a big problem.
  
  Windows is not alone, and Linux suffers similar. See Tim Brown's
  "Breaking the links: Exploiting the linker,"
  www.nth-dimension.org.uk/pub/BTL.pdf.
  
  Jeff
  
• 

  Re: Downloads Folder: A Binary Planting Minefield

  Posted: February 20th, 2012, 1:28pm PST

  Tags:   

  Posted by Jeffrey Walton on Feb 20

  Hi Mitja,
  
  $ Look for the presence of any *.dll files in the Downloads
  $ folder and do the same as in the previous step.
  $ Delete all files from the Downloads folder.
  I don't believe a PE/PE+ executable needs a DLL extension to be loaded
  by LoadLibrary and friends.
  
  Perhaps a scanning/cleansing tool would be helpful.
  
  Jeff
  
• 

  Re: Why are phone internet operators using UK MoD and US DoD IP ranges in their networks?

  Posted: February 20th, 2012, 8:56am PST

  Tags:   

  Posted by Valdis . Kletnieks on Feb 20

  On Sun, 19 Feb 2012 20:45:20 +0200, =?ISO-8859-1?Q?Julius_Kivim=E4ki?= said:
  
  They apparently thought that their customers would never need to talk to
  anybody in the then-unallocated 25/8 and 28/8 blocks. I mean, it was only 1992
  or so when people started worrying that we'd run out of IPv4 space, so you can
  hardly blame companies that deployed large numbers of deviced before 1992 for
  doing stupid things not thinking about when address space...
  
• 

  Why are phone internet operators using UK MoD and US DoD IP ranges in their networks?

  Posted: February 20th, 2012, 8:09am PST

  Tags:   

  Posted by Julius Kivimäki on Feb 20

  So, it appears that Sprint and T-Mobile are using 25.*.*.* and 28.*.*.* as
  their phone network internal IPs.
  This causes a ton of security issues, why would they do this?
  
• 

  DC4420 - London DEFCON - February meet - Tuesday February 21st 2012

  Posted: February 20th, 2012, 8:00am PST

  Tags:   

  Posted by Major Malfunction on Feb 20

  This month we have our usual two talk format - one that you'll need to
  concentrate on (and which will give us time to break into the bar), and
  one through which you can sip the beer you bought to accompany the one
  you bought for me...
  
  Shaun Colley of IOActive will make our heads hurt with
  "printf tricks & setjmp/longjmp bugs"
  
  followed by
  
  "E-mail Headers I Have Known And Loved" from @gwire (of NTK fame)...
  
• 

  pcAnywhere Leaked Source Code - An Anonymous Review

  Posted: February 20th, 2012, 7:18am PST

  Tags:   

  Posted by Adam Behnke on Feb 20

  DISCLAIMER: InfoSec Institute received an anonymous submission concerning
  the leaked pcAnywhere source code. The article is published here, we have
  redacted any code snippets or other pieces of source code that were included
  in the original article. Otherwise it has been left unedited/unaltered.
  
  The pcAnywhere source code leaked out onto the internet late January 2012
  includes 47,021 files weighing in at 1.3GB. The October 2006 snapshot...
  
• 

  Re: Analysis of the "r00t 4 LFI Toolkit"

  Posted: February 20th, 2012, 5:40am PST

  Tags:   

  Posted by Benji on Feb 20

  A priv8 php shell, funniest thing I've ever heard on this list.
  
• 

  Re: Analysis of the "r00t 4 LFI Toolkit"

  Posted: February 20th, 2012, 5:37am PST

  Tags:   

  Posted by Gage Bystrom on Feb 20

  Uhh no, you misread what he said. He's saying he's seen that code in a few
  php shells that were supposedly meant to be private but the authors were
  miserable failures and he found the code anyways, not that he wrote it.
  
• 

  SEC Consult SA-20120220-1 :: Multiple Vulnerabilities in ELBA5

  Posted: February 20th, 2012, 2:10am PST

  Tags:   

  Posted by SEC Consult Vulnerability Lab on Feb 20

  SEC Consult Vulnerability Lab Security Advisory < 20120220-1 >
  =======================================================================
  title: Multiple Vulnerabilities in ELBA5
  product: ELBA 5
  vulnerable version: ELBA 5.4.1
  5.5.0 R00004 build 0778
  fixed version: partially in 5.5.0 R00004 build 0778
  all issues in 5.5.0 R5
  impact: Medium...
  
• 

  SEC Consult SA-20120220-0 :: Multiple critical vulnerabilities in VOXTRONIC voxlog professional

  Posted: February 20th, 2012, 2:06am PST

  Tags:   

  Posted by SEC Consult Vulnerability Lab on Feb 20

  SEC Consult Vulnerability Lab Security Advisory < 20120220-0 >
  =======================================================================
  title: Multiple critical vulnerabilities
  product: VOXTRONIC voxlog professional - voice recording
  solution
  vulnerable version: VOXTRONIC voxlog professional <= 3.7.2.729
  (webclient version)
  fixed version: unknown...
  
• 

  Re: Analysis of the "r00t 4 LFI Toolkit"

  Posted: February 20th, 2012, 12:35am PST

  Tags:   

  Posted by Manu on Feb 20

  But you saw it in a few """priv8""" php shells? And you say that is your
  code as 'r00t 4 LFI toolkit' ? Pathetic
  
  2012/2/19 InterN0T Advisories <advisories () intern0t net>