Slashdot Mirror

Proper attribution for that quote: Andrew S. Tanenbaum

Lucky Google Link

Thankfully, this particular worm isn't smart enough to identify the OS of the target, thus it *could* possibly end up using the incorrect return address for the *actual* OS target, thus causing the RPC process to crash.

A week or so back, global return address were identified for Windows 2000 and Windows XP. This meant that regardless of service pack or region, Windows 2000 could be 0wned using a single return address. Ditto fo XP.

It appears as though this worm uses the original dcom.c exploit code, which did not have the universal return addresses.

It won't be long until the next variation of this type of worm is released, with much more intelligence.

They will be able to reply to your emails using the remailer service. You WILL remain completely anonymous and your integrity will never have an opportunity to be called into question.

Alternative A: Send an email to Full Disclosure from an anonymous remailer using an SSL proxy. then, the world knows about the issue, and you don't have to worry about your paranoid delusions of jack booted thugs knocking your door.

Alternative B: SEnd an email to security@fuckinggayasscompany or abuse@fuckinggayassocmpany, wait 60 days and then release it.

Alternative C: Don;t tell anyone, get all A's.

Do whatever floats your boat, shithole.

Oh wait, I get it. You found some lase ass XSS vuln and you want to launch a white-hat "ethical hacking" career out of it, but oyu are too gay to do anything but make yourself out like a 1337 hax0r on /. Grow some balls, or get back in the closet with moronin_wood and the rest of the hax0r wannabes.

It was posted by an unknown user known as "Marion Barry" on the Full Disclosure mailing list. That was about 14 hours ago, I believe. The list address is here

You can find the original exploit here.

1. Exploit AUF buffer overflow which loads a minimal version of linux with an ftp server
2. Upload modifed dashboard
3. Restart system
4. ???
5. LINUX!@$#

-dk

Soderless/chipless X-box hack right here

Flaw in dashboard, aslo published by Microsoft, and worse than any savegame hacks.

From Full Disclosure:
Clickable link
http://lists.netsys.com/pipermail/full-disclosur e/ 2003-July/010895.html

[snip]
For an unknown reason this check is not performed on the audio (.wav) and font (.xtf) files. Unfourtunately for Microsoft there exists an exploitable integer underflow vulnerabilitiy within the font file loader which can be exploited with a malformed font file. When the XTF header is processed the dashboards reads a 4 byte blocksize field from the font file. This is expected to represent the size of some datablock including the 4 bytes of the size field itself. The blocksize is then allocated and the sizefield is copied into the beginning of the buffer. This is already a possible overflow bug when the field contains the values 0..3. Due to memory alignment this is not exploitable. But then the blocksize is decreased by 4 because the dashboard wants to read the rest of the block into memory. Obviously values of 0..3 will underflow when decreased by 4 and this results in the dashboard wanting to read up to ~4 gigabytes of data from the font file in a f.e. 3 bytes buffer.
Because the XBOX malloc()/free() implementation is also storing control information inbound and is similiar to the Windows 2000/XP heap allocators this bug is exploitable and allows execution of arbitrary code. The attached proof of concept code shows that exploiting is possible with offsets that are equal on all dashboards and XBOX versions known.
[/snip]

No, IIRC the last story on slashdot about a vulnerablity was this one. The exploit it mentioned was an integer underflow vulnerablity.

This message has been doubly encrypted with rot13 for enhanced security.

Full-Disclosure would be a better example.

Re-read the top of the Slashdot discussion page, or see here: see here

There was a relevant message from Dan Veditz, of the Mozilla securitygroup, on the full discolsure list just this morning. I'd post the text but the lamesness filter doesn't like it. You can read it here.

There was a relevant message from Dan Veditz, of the Mozilla securitygroup, on the full discolsure list just this morning. I'd post the text but the lamesness filter doesn't like it. You can read it here.

Last year they tried to fool the IETF with something like "responsibility rfc" which was almost the same as this. The IETF just said "No" to it. An archived copy is available Now they are trying the same in a m$ owned circle. Since symantec is part of oisafety, don't expect real discussion about this on bugtraq. Some bashing of this nonsense is available on the "Full disclosure" mailing list: thread The response to the draft rfc was Free Hacker Manifest"

Last year they tried to fool the IETF with something like "responsibility rfc" which was almost the same as this. The IETF just said "No" to it. An archived copy is available Now they are trying the same in a m$ owned circle. Since symantec is part of oisafety, don't expect real discussion about this on bugtraq. Some bashing of this nonsense is available on the "Full disclosure" mailing list: thread The response to the draft rfc was Free Hacker Manifest"

Easy. Bugtraq goes all quiet and everyone moves to the unmoderated Full-Disclosure list (and hopes the random offtopic stuff stops). Bugtraq has been all "responsible disclosure" (newspeak) for at the very least a couple of months now, on the quiet anyway, with the moderators actually refusing early disclosure of some bugs. Stop relying on it, it is not telling you everything you need to know.

Ah, 1977: disco was big; pantslegs and shoes were even bigger.

Not everything was big, however. In those days, if you needed a "network number", you had 8 bits from which to choose.

And what big, draconian agency did they set up to parcel out that meager supply of numbers? His name was Jon Postel. According to RFC739, Jon was the go-to guy, not just for network numbers, but for all your numeric needs:

If you are developing a protocol or application that will require the use of a link, socket, etc. please contact Jon to receive a number assignment.

Actually, Jon was probably not draconian at all; he sounds like a nice fellow. Need a number? Just ask Jon. It seems ARPANET really had that personal touch.

Story submitter here - I forgot the attribution (my bad); I picked this up from the Full Disclosure mailing list, specifically, this post by Richard M. Smith.

Story submitter here - I forgot the attribution (my bad); I picked this up from the Full Disclosure mailing list, specifically, this post by Richard M. Smith.

...it to become the largest botnet in the world, thanks to this dream of a bug in the supernodes that's been around since Christmas, discovered by the K++ author (yes, Sharman et al do know)!

Let's face it, it wouldn't be surprising if the RIAA used this. Might be illegal, but who's to say it isn't some script kiddie turned cracker wanting to take a new world r00ting record?

Well, the Full-Disclosure list that I am involved with was one of the ones that received the premature announcement, but I'm sure you'll agree that even with the follow-up it was far from anything that provided a remote exploit. The tone of the thread seemed to indicate that there was already interest in this 'in the wild' before it was disclosed to the lists in question, in any case. Kudos to the Sendmail team for getting the fix out so promptly.

Well, the Full-Disclosure list that I am involved with was one of the ones that received the premature announcement, but I'm sure you'll agree that even with the follow-up it was far from anything that provided a remote exploit. The tone of the thread seemed to indicate that there was already interest in this 'in the wild' before it was disclosed to the lists in question, in any case. Kudos to the Sendmail team for getting the fix out so promptly.

Well, the Full-Disclosure list that I am involved with was one of the ones that received the premature announcement, but I'm sure you'll agree that even with the follow-up it was far from anything that provided a remote exploit. The tone of the thread seemed to indicate that there was already interest in this 'in the wild' before it was disclosed to the lists in question, in any case. Kudos to the Sendmail team for getting the fix out so promptly.

Confirmation of DDOS and DNS issues here (and here

Confirmation of DDOS and DNS issues here (and here

If you enjoy Bugtraq and can put up with the occasional flame war ... FD is an awesome list. FD Charter

Which stories are you reading?

The lockergnome one, which is the one from today:
http://www.lockergnome.com/update/archives/week_20 03_03_16.html

It makes reference to emails and html pages, which relate the the vuln I referred to.

BTW, it looks like details are available now:

http://lists.netsys.com/pipermail/full-disclosure/ 2003-March/004574.html

I didn't see anything posted to the lists (Bugtraq, Vulnwatch, Full Disclosure, etc.) about this either, until the Gentoo announcement yesterday. For an issue Macromedia calls critical, they sure are being quiet about it.

Ill know better next time.

According to this post on the Full-Disclosure list, the CVS bug has been known underground for a while. Wonder what they've been doing with it?

Who submited the link? Ursus Maximus (rdsteph@earthlink.net).

Worst than dupe.

There is a flaw in jar file handling that may allow a user to execute arbitrary commands...

HP attempts to use DMCA against security researchers UPDATED: 2002-07-31 19:45 ET

This contains some new information from Kevin..

There was a new list started about 2 weeks ago, directly because of this potential issue:

Here was the announcement:

Subject: Announcing new security mailing list

We are pleased to announce the creation of a new security mailing list
dedicated to FULL DISCLOSURE. When Scott Chasin handed over the bugtraq
mailing list, it was clearly dedicated to the immediate and full
dissemination of security issues. The current bugtraq mailing list has
changed over the years, and some of us feel it has changed for the worse.

If you believe in full disclosure, and wish to participate in unfettered,
and unmoderated discussions, please feel free to subscribe to the new
mailing list by accessing http://lists.netsys.com

I'm amazed that people are still using the old unchecked C library functions. There are checked versions for all of them. I stopped using the unchecked versions in the early 1980s. As was suggested in 1995, it's time to pull all those functions out of the standard library and move them to something called "deprecated". The open-source community should try this; it would break lots of programs at compile time, but they'd be easy to fix. And you've got the source.

Gene Spafford (co-author of the O'Reilly book on security, many seminal papers on Computer security, and minder of such tools as Tripwire - the man knows what he's talking about) had this to say some years ago on security challenges:

http://www.netsys.com/fire walls/firewalls-9511/0743.html

He lists so many good reasons (eight) to distrust this sort of challenge that it is difficult to summarise the message here. Best to click and read it yourself.

The point goes for every package where the author tries to "prove" security in this way - be it Sidewinder, Qmail or Microsoft. In many cases, the only result is to damage security by giving miscreants some "free time" to try and crack the system, for free, without fear of punishment.

Tiger teams have their place in a properly designed, properly managed security audit. Using unpaid tiger teams as the principal means is useless and dangerous. Will Microsoft move to assure its customers that this is simply a small part of a large, thorough security audit?