Issue 4 Astalavista Security Newsletter
492d751f3c31d4d620033abe24b48776691a16ffa121f0ead0a34a4f41ea635e
Issue 2 Astalavista Security Newsletter
01bd7d5eebd974150d38e3b2387b71a7ba51ca405ed452364211f6e35746f523
Issue 3 Astalavista Security Newsletter
e646d451cfb1e653e4174de5a96977b584656490f329d4382924d45586b829e6
Featured articles - Can our 5k firewall tell us if we're really under attack? ; Will my PC ever be secured? Part 1 - basic security concepts - Interview with Mitchell Rowton from SecurityDocs.com
ff7a6004fcd9cbf41371a09977a34aff81bdd511a32a67b3f1da4e91ad82c6c0
Issue 1 Astalavista Security Newsletter
4bfc66b4cc7969e00e63d3503f22f5de7786e39c2fb562bb813e5c3e32c2801e
Featured articles - Company's best practices on anti-spam prevention ; How to effectively fight spam - pratical tips - Interview with Dave Wreski from LinuxSecurity.com
a2781cc386867d81a71d62326e91d202b477ee4063ec51bd329b77fbef0d0dc4
Featured articles - Passwords - Common Attacks and Possible Solutions - Interview with Anthony Aykut from Frame4.com
d210bc4442e08b4f2b9a5c4c6e9a108b32e645ade65554176fb17e7d5f8940a0
Packet Storm new exploits for February, 2005.
191da9ffce9c9d89dc8e51895a6ec83a809653dcc1b497f0d0af65dc61cfbda4
Gentoo Linux Security Advisory GLSA 200502-32 - Ulf Harnhammar discovered that UnAce suffers from buffer overflows when testing, unpacking or listing specially crafted ACE archives. He also found out that UnAce is vulnerable to directory traversal attacks, if an archive contains ./.. sequences or absolute filenames.
ae4a4c5c890780d64193effa07efc6176d68f843d0ba2cc2659c08cbd16090df
Gentoo Linux Security Advisory GLSA 200502-31 - Takumi Asaki discovered that uim insufficiently checks environment variables. setuid/setgid applications linked against libuim could end up executing arbitrary code. Versions below 0.4.5.1 are affected.
96ef48c9a6a658e8af62e64b7d27c3a85a1dc6cdb6a33aa95d9b0b3ce8ea6cb4
This paper describes several techniques for exposing file contents using the site search functionality. It is assumed that a site contains documents which are not visible/accessible to external users. Such documents are typically future PR items, or future security advisories, uploaded to the website beforehand. However, the site is also searchable via an internal search facility, which does have access to those documents, and as such, they are indexed by it not via web crawling, but rather, via direct access to the files. Therein lies the security breach.
95d07a72940beb4eb7d8ef7e8dce89e68ae8dd623e9569d62e531063c6e241f1