http://www.seclists.org/lists/fulldisclosure/2008/Jul/date.html Latest posts to fulldisclosure with detailed descriptions fyodor@NOSPAMinsecure.org (fyodor) djeaux@NOSPAMdjeaux.com (djeaux) Scythe 2.10 Thu, 24 Jul 2008 01:50:04 PDT http://www.djeaux.com/images/scraped_88x31.png http://www.seclists.org/lists/fulldisclosure/2008/Jul FullDisclosure scraped from insecure.org en-us http://www.seclists.org/lists/fulldisclosure/2008/Jul/0412.html druid@NOSPAMcaughq.org (Iruid) Wed, 23 Jul 2008 22:48:38 -0500 / \ / \ / /\\##/ /\ \## ## \ \/ /# ## # ## \/ \/ Computer Academic Underground Exploit Code / Exploit ID: CAU-EX-2008-0003 Release Date: 2008.07.23 Title: bailiwickeddomain.rb Description: Kaminsky DNS Cache Poisoning Flaw Exploit for Domains Tested: BIND 9.4.1-9.4.2 ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0411.html druid@NOSPAMcaughq.org (Iruid) Wed, 23 Jul 2008 18:34:26 -0500 / \ / \ / /\\##/ /\ \## ## \ \/ /# ## # ## \/ \/ Computer Academic Underground Exploit Code / Exploit ID: CAU-EX-2008-0002 Release Date: 2008.07.23 Title: bailiwickedhost.rb Description: Kaminsky DNS Cache Poisoning Flaw Exploit Tested: BIND 9.4.1-9.4.2 ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0410.html security@NOSPAMmandriva.com (security_at_mandriva.com) Wed, 23 Jul 2008 17:29:00 -0600 Mandriva Linux Security Advisory MDVSA-2008:154 Package : xemacs Date : July 23, 2008 Affected: Corporate 3.0 Problem Description: A vulnerability in xemacs was found where an attacker could provide a group of files containing local variable definitions and arbitrary ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0409.html security@NOSPAMmandriva.com (security_at_mandriva.com) Wed, 23 Jul 2008 17:27:00 -0600 Mandriva Linux Security Advisory MDVSA-2008:153 Package : emacs Date : July 23, 2008 Affected: 2007.1, 2008.0, 2008.1, Corporate 3.0, Corporate 4.0 Problem Description: A vulnerability in emacs was found where an attacker could provide ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0408.html lists@NOSPAMcorest.com (Nahuel C. Riva) Wed, 23 Jul 2008 19:49:33 -0300 Hello! You can find it here: Package: What is the SDT Cleaner? SDT Cleaner is a tool that intends to clean the SSDT (system service descriptor table) from hooks. * The SDT Cleaner allows you to clean hooks installed by Anti-Virus and Firewalls. ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0407.html security@NOSPAMmandriva.com (security_at_mandriva.com) Wed, 23 Jul 2008 15:56:00 -0600 Mandriva Linux Security Advisory MDVSA-2008:153 Package : emacs Date : July 23, 2008 Affected: 2007.1, 2008.0, 2008.1, Corporate 3.0, Corporate 4.0 Problem Description: A vulnerability in emacs was found where an attacker could provide ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0406.html psz@NOSPAMmaths.usyd.edu.au (Paul Szabo) Thu, 24 Jul 2008 07:28:15 +1000 As a workaround, it is recommended to set DNS servers to forward only. Can someone explain why that helps? Cannot responses from the forwarder be spoofed same as normal query responses? Is it that "glue RRs" from forwarders are discarded; or that source ports of forwarded requests are ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0405.html thijs@NOSPAMdebian.org (Thijs Kinkhorst) Wed, 23 Jul 2008 20:59:43 +0200 - Debian Security Advisory DSA-1540-3 securityatdebian.org Thijs Kinkhorst July 23, 2008 - Package : lighttpd Vulnerability : denial of service Problem type : remote Debian-specific: no CVE Id(s) : CVE-2008-1531 This update fixes a regression in lighttpd introduced in DSA-1540, ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0404.html Aaron.Brown@NOSPAMadmeritia.de (Aaron Brown) Wed, 23 Jul 2008 19:09:27 +0200 adMERITia Vulnerability Report Vulnerability Information Vendor: EMC˛ Product: Centera Universal Access Version: CUA4.04735.p4 Vulnerability Type: Software Flaw Vulnerability: SQL Injection ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0403.html jmm@NOSPAMdebian.org (Moritz Muehlenhoff) Wed, 23 Jul 2008 22:33:58 +0200 - Debian Security Advisory DSA-1615-1 securityatdebian.org Moritz Muehlenhoff July 23, 2008 - Package : xulrunner Vulnerability : several Problem type : local/remote Debian-specific: no CVE ID : CVE-2008-2785 CVE-2008-2798 CVE-2008-2799 CVE-2008-2800 CVE-2008-2801 CVE-2008-2802 CVE-2008-2803 CVE-2008-2805 CVE-2008-2807 CVE-2008-2808 CVE-2008-2809 CVE-2008-2811 CVE-2008-2933 ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0402.html jmm@NOSPAMdebian.org (Moritz Muehlenhoff) Wed, 23 Jul 2008 22:07:11 +0200 - Debian Security Advisory DSA-1614-1 securityatdebian.org Moritz Muehlenhoff July 23, 2008 - Package : iceweasel Vulnerability : several Problem-Type : remote Debian-specific: no CVE ID : CVE-2008-2785 CVE-2008-2933 Several remote vulnerabilities have been discovered in the Iceweasel ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0401.html jamie@NOSPAMcanonical.com (Jamie Strandboge) Wed, 23 Jul 2008 15:39:07 -0400 Ubuntu Security Notice USN-628-1 July 23, 2008 php5 vulnerabilities CVE-2007-4782, CVE-2007-4850, CVE-2007-5898, CVE-2007-5899, CVE-2008-0599, CVE-2008-1384, CVE-2008-2050, CVE-2008-2051, CVE-2008-2107, CVE-2008-2108, CVE-2008-2371, CVE-2008-2829 A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 LTS ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0400.html dguido@NOSPAMgmail.com (Daniel Guido) Wed, 23 Jul 2008 15:14:15 -0400 This should play nicer with some auto-linking code: Sorry about that! -- Dan Guido Full-Disclosure - We believe in it. Charter: Hosted and sponsored by Secunia - http://www.seclists.org/lists/fulldisclosure/2008/Jul/0399.html dguido@NOSPAMgmail.com (Daniel Guido) Wed, 23 Jul 2008 14:40:03 -0400 This pair of essays were written in 4 hours the night before they were due for last year's Cyber Security Awareness Week at Polytechnic University. They were intended to answer the question, "Is the security industry like a lemon market?" as first brought up in a Wired ... http://www.seclists.org/lists/fulldisclosure/2008/Jul/0398.html rdancer@NOSPAMrdancer.org (Jan Minář) Wed, 23 Jul 2008 19:29:01 +0100 1. SUMMARY Product : Vim -- Vi IMproved Version : Tested with Vim 7.2b.10, filetype.vim 2008-07-17 Impact : Arbitrary code execution Wherefrom: Local and remote CVE : CVE-2008-2712 Original : This is an update of a previous advisory[1]. Vim patch 7.1.300 which ...