Gregg's Security News Aggregator

Currently, this "blog" is nothing more than a news aggregator which

gets security information from over 30 sources. As you'll note,

a number of the sources are not specific to security. Advanced

filtering is definitely needed.






Subscribe to "Gregg's Security News Aggregator" in Radio UserLand.

Click to see the XML version of this web page.

Click here to send an email to the editor of this weblog.
 

 

Saturday, April 10, 2004
 

----------------------------------------------------------------------
Yahoo! News - Technology
----------------------------------------------------------------------
1.  Making Phones Of Handheld Organizers (washingtonpost.com). washingtonpost.com - Is Skype Technologies' new Internet-phone software for handheld organizers just a geeky, long-range walkie-talkie, or is it the next nail in the coffin of traditional telephone companies?
----------------------------------------------------------------------
NewsIsFree: Security
----------------------------------------------------------------------
2.  Re: GNU Sharutils buffer overflow vulnerability.
3.  Scorched 3D Format String Flaw Lets Remote Users Crash the Server and May Permit Arbitrary Code Execution

11:16:54 PM    comment []

----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
1.  Gator Files for IPO to Raise $150 Million
----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
2.  BugTraq: Re: IPv4 fragmentation --> The Rose Attack. Sender: Darren Reed [avalon at caligula dot anu dot edu dot au]
3.  BugTraq: Re: GNU Sharutils buffer overflow vulnerability.. Sender: Dan Yefimov [dan at D00M dot integrate dot com dot ru]
----------------------------------------------------------------------
NewsIsFree: Security
----------------------------------------------------------------------
4.  RSniff Connection State Error Lets Remote Users Deny Service
5.  Open WebMail Input Validation Flaw Lets Remote Users Create Arbitrary Directories

10:16:32 PM    comment []

----------------------------------------------------------------------
New York Times: Technology
----------------------------------------------------------------------
1.  To Read the Menu, Baby Boomers Turn to Eye Treatments. Biology and vanity are collaborating to make vision correction techniques a boom market. By Milt Freudenheim.
2.  Robo-Cars Make Cruise Control So Last Century. As cars become more in touch with surroundings and able to act autonomously, drivers are on the brink of the Jetsons age. By Danny Hakim.
----------------------------------------------------------------------
Hack the Planet
----------------------------------------------------------------------
3.  An evil idea: It's possible to kick anyone off a 802.11 access point by forging a disassociate message (even if you don't control the AP). How long will it be until hotspots start kicking users off competing hotspots (especially free ones) to get more business?

9:16:13 PM    comment []

----------------------------------------------------------------------
Boing Boing
----------------------------------------------------------------------
1.  To Do in LA: Glenn Tillbrook doc film free preview. Friend o' BoingBoing and rock-n-roll legend bassgoddessgreta (Moby, Debbie Harry, The Nuns, etc.) sends word of an offbeat new documentary film starring former Squeeze frontman Glenn Tilbrook. Twenty years ago with Squeeze, touring meant 18 wheelers, hotel suites and police-escorted limos. Now Tilbrook's music now finds its audience through a more independent route -- which involves a big mobile home and lots of open highway.

In November 2001, to support the release of his debut solo CD, The Incomplete Glenn Tilbrook, Glenn embarked on a different kind of independent route as he took to the road in America: One man, two guitars and a mobile home.

Glenn Tilbrook: One for the Road follows him on every step of that journey: arriving in the States; picking up his mobile home; performing the shows; meeting the fans; packing away his guitars; camping at campgrounds; traveling in the RV: All access, all of the time. It's an intimate look at how an established musician adjusts to his new independent surroundings. It's a commentary on the current state of the music industry. But, most importantly, it's a human interest story that transcends its musical base.

Link to movie homepage, and check it out in LA at a free preview screening on Tuesday, May 11th, 8:00pm at CineSpace, 6356 Hollywood Blvd. 2nd Floor. 323 817 3456.

2.  Remix of W's WMD joke. This remix of George W's WMD joke at the White House Correspondants' Dinner is vicious, brilliant and true.

3.6MB QuickTime Link

(via Dan Gillmor)

3.  eBay listings by RSS. Create your own RSS feed for your favorite eBay search. Link (Thanks, Chris Pirillo!)
4.  Distributed Proofreaders pass 4,000 ebooks. An anonymous person writes:
Distributed Proofreaders is a volunteer driven website that is committed to putting Public Domain books online. OCR generated text is reviewed online and compared to page scans. Once the book has completed the proofreading process it is posted to Project Gutenberg where the ebook is available to the world for free.

On April 6th Distributed Proofreaders posted it 4,000 ebook: "Aventures du capitaine Hatteras" by Jules Verne. Yes, it is in French. Come help us produce more free ebooks in more languages at Distributed Proofreaders. Proofread a page a day, that's all we ask.

Link

5.  London's ghost tube-stations.

This site is devoted to the 40-some abandoned and ghost tube stations on the London Underground, including accounts of guided tours.

Link

(via Pirotcar)


6.  Hip hop Man of Constant Sorrow. This is Battlestar America's pretty cool hip-hop remix of Man of Constant Sorrow.

1.4MB MP3 Link

(Thanks, John!)

----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
7.  Pearl, a Robot for the Elderly
----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
8.  Vulns: Jarle Aase War FTPD USER/PASS Buffer Overflow Vulnerability. War FTPD is an Internet FTP server by Jarle Aase.

War FTPD is reported prone to multiple buffer overflow vulnerabilities. The issues present themselves due to a lack of ...

9.  Vulns: Mcafee FreeScan CoMcFreeScan Browser Information Disclosure Vulnerability. Mcafee FreeScan is a web-based service that detects viruses and trojan horses. It is a freely available service that can be run via a web browser. The 'McFreeScan.CoMcFre...
10.  Vulns: HP OpenView Operations/VantagePoint Remote Authentication Bypass Vulnerability. HP OpenView provides network and system administration services for managing nodes across multiple network domains.

OpenView Operations and OpenView VantagePoint have b...

----------------------------------------------------------------------
NewsIsFree: Security
----------------------------------------------------------------------
11.  TechTV: Cryptainer LE "Keep the goons from bagging your important files"

8:15:42 PM    comment []

----------------------------------------------------------------------
Boing Boing
----------------------------------------------------------------------
1.  New short from Susannah Breslin. Former BoingBoing guestblogger Susannah "Invisible Cowgirl" Breslin celebrates a birthday today. She also a new short story out in Ducky Magazine. Dig the phat cover art. Excerpt:

One morning, she woke up and discovered that her head was gone. She had reached up to pat her hair, or rub the sleep from her eyes, or scratch her ear, and she had realized that her head was nowhere to be found. Where, she wondered, had it gone? She had no idea at all. She could not recall, in fact, very well what had happened the previous evening. She had been at a bar, and she had gotten drunk, and then she had come back home. From what she could remember, her head had still been sitting squarely on her shoulders when she had climbed into bed. Perhaps, she considered, her head had run off at some point during the night while she lay sleeping.


Link to "The Woman Who Lost Her Head".

----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
2.  Personalized Moon Crash
----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
3.  Vulns: HP-UX stmkfont Alternate Typeface Library Buffer Overflow Vulnerability. The stmkfont utility is a compiler designed to generate X and PCL fonts. Options exists which allows a user to specify the primary and alertante typeface library path.

A...


7:15:23 PM    comment []

----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
1.  Massachusetts Considering Desalination Plants
----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
2.  Vulns: Sambar Server Search Script Mixed Query Vulnerability. Sambar Server is a commercially-available web server package distributed by Sambar Technologies.

A problem with the software may make it possible for a remote user to de...

3.  Vulns: Microsoft Windows Media Services NSIISlog.DLL Remote Buffer Overflow Vulnerability. Microsoft Media Services provides functionality for providing streaming media content to clients from IIS. It ships with a number of Microsoft Windows 2000 server release...
4.  Vulns: RhinoSoft Serv-U FTP Server MDTM Command Time Argument Buffer Overflow Vulnerability. RhinoSoft Serv-U FTP Server is designed for use with Microsoft Windows operating systems.

Serv-U FTP Server has been reported prone to a remote stack based buffer overfl...

5.  Vulns: Sun Solaris SAdmin Client Credentials Remote Administrative Access Vulnerability. Solaris is the Unix operating system variant maintained and distributed by Sun Microsystems.

A problem has been discovered in the Sun Solaris sadmin service. Because of...

6.  Vulns: Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability. Microsoft Windows provides a DCOM (Distributed Component Object Model) interface to the RPC (Remote Procedure Call) protocol. A buffer overrun vulnerability has been rep...
7.  Vulns: Microsoft SQL Server 2000 Resolution Service Stack Overflow Vulnerability. A vulnerability has been discovered in Microsoft SQL Server 2000 that could make it possible for remote attackers to gain access to target hosts.

A problem in the SQL Se...


6:15:05 PM    comment []

----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
1.  Sun Sacks UltraSparc V and 3300 Employees
----------------------------------------------------------------------
Hack the Planet
----------------------------------------------------------------------
2.  BTW, somehow Time Warner has managed to make HBO On Demand suck even more than regular digital cable. Their slogan should be "Would you like some TV with your MPEG artifacts?"
3.  Having only seen Deadwood and Tombstone, I wonder if all Westerns are based on the plot of the retired lawman and his hard-drinking, hard-gambling gunslinger buddy coming to town and reluctantly cleaning up.
4.  Saw Matchstick Men last night. I thought it was good up until the ending.
5.  The Register: Sun shelves UltraSPARC V in favor of the great unknown. Just before this story came out I got a resume from an UltraSPARC V designer; as they say, all rumors come true eventually, and some sooner rather than later.
6.  Wi-Fi Networking News: Tool to Crack Cisco LEAP Released.
7.  The Register: Chip start-up boosts Wi-Fi rate by '10-20 times' (by using the whole band at once -- I'm not sure whether this makes the case for more unlicensed spectrum or not).
8.  The Inquirer: Intel FB-DIMMs to offer real memory breakthroughs, part 2, part 3. Always good to see some high-end IBM technology making it into the mainstream. Considering the lameness of DDR2, I wonder if FB-DIMMs based on overclocked DDR or GDDR3 DRAMs would be better.
----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
9.  Vulns: NexGen FTP Server Remote Directory Traversal Vulnerability. Nexgen FTP server is a commercially available FTP server designed to run under the Microsoft Windows platform. It is developed using the Nexgen Server Software Developme...
10.  Vulns: TCPDump ISAKMP Delete Payload Buffer Overrun Vulnerability. tcpdump is prone to a remotely exploitable buffer overrun vulnerability.

This issue exists in tcpdump's ISAKMP packet display functions (in the print-isakmp.c source f...

11.  Vulns: TCPDump ISAKMP Identification Payload Integer Underflow Vulnerability. tcpdump is prone to a denial of service vulnerability due to an integer underflow.

This issue exists in tcpdump's ISAKMP packet display functions (in the print-isakmp.c ...

12.  Vulns: GNU Sharutils shar Command Line Parsing Buffer Overflow Vulnerability. The GNU Sharutils are a collection of utilities for creating and manipulating shell archive files. It is freely available for Unix and Unix variant operating systems. T...

5:14:52 PM    comment []

----------------------------------------------------------------------
Boing Boing
----------------------------------------------------------------------
1.  Nevermind broadband -- many First Americans don't have phone service. Comments from an NPR listener who heard a segment I did for "Day to Day" on the president's promise to make broadband accessible to all Americans by the year 2007. Eric Martin says:
Phone penetration on reservations just passed the 50% mark within this decade and even where there are phone lines on US reservations a lot of them are old copper lines that can't handle dial-up. So before Bush goes and gets the rest of the country hooked up with high speed, he should make sure that all Americans, including Native Americans, have basic phone service. John Edwards wasn't lying when he was talking about two Americas.

There are some interesting stats on the lack of phone penetration in "Indian Country" on this FCC website.

2.  Implicit ideology in video games. From Reason Magazine, an article analysing the ways that video games influence our politics and world-view.

So implicit politics might be the better way to influence player opinion. But as a political vehicle, games may have an inherent bias. Bridging an ideological chasm, libertarian Iain Smedley and socialist Julian Stallabras agree that computer games possess a native individualism. Writing a decade ago, Smedley noted the "heroic and individualistic philosophy" of video games, in which the player "does not merely cheer on the hero in [his] struggle; the player’s actions determine the outcome." Writing contemporaneously in New Left Review, Stallabras concurred: In games, "the passivity of cinema and television is replaced by an environment in which the player’s actions have a direct, immediate consequence on the virtual world." For Stallabras, this makes computer games "a capitalist and deeply conservative form of culture."

Stallabras’ wide-ranging indictment of computer games is remarkable for its combination of savvy ("in Doom...all the corpses of a particular monster always look exactly the same") and pessimism ("The defining image in all this comes, not from any game, but naturally enough from a blockbuster film, Terminator 2; it is the jarring crunch of human skulls under the bright chrome of a robot foot"). Stallabras contends that many offensive traits of games are concealed by "chrome," by which he means slick user interfaces and graphical eye candy. What would he think of the recent release whose title is Chrome? Probably the same thing he writes about the video game as a medium: that it tricks players into imitating idealized markets and sweatshop labor through repetitive manipulation of game objects and numbers, that it is shaped by "the parameters of the computer industry’s links with the military," and that its innate objectification "leads to...an ever greater blurring of the use of people as instruments in the world and the game." But he might appreciate the irony that Chrome developer Techland is located in Poland.

Link

(via Terra Nova)

----------------------------------------------------------------------
Yahoo! News - Technology
----------------------------------------------------------------------
3.  Livewire: When You've Got to Google Better, Ask an Expert (Reuters). Reuters - When you search the Web, do you find lots of information, but not the answer to your question? If so, you're not alone.
----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
4.  Tracking the Blackout Bug
----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
5.  BugTraq: Backdoor in X-Micro WLAN 11b Broadband Router. Sender: RISKO Gergely [xmicro at risko dot hu]
6.  Vulns: ClamAV RAR Archive Remote Denial Of Service Vulnerability. ClamAV is a freely available, open source virus scanning utility. It is available for the Unix and Linux platforms.

ClamAV has been reported prone to a remote denial of...

7.  Vulns: Tunez Multiple Remote SQL Injection Vulnerabilities. Tunez is a freely available, open source web MP3 jukebox. It is available for the Unix and Linux platforms.

Several problems in the handling of user-supplied input have...


4:14:32 PM    comment []

----------------------------------------------------------------------
Ars Technica
----------------------------------------------------------------------
1.  Immediacy of Mac OS X Trojan horse threat exaggerated. Intego's security annoucement about the viability of a Trojan horse for Mac OS X has turned out to be a case of FUD. By Eric Bangeman.
----------------------------------------------------------------------
Boing Boing
----------------------------------------------------------------------
2.  To do in LA: Living art from Mushrooms, Oysters. Artist Philip Ross makes sculpture out of living oysters and mushrooms. A show of new work launches in Los Angeles this weekend.

Machine Project announces the opening of "Organized" by artist Phillip Ross, on Saturday April 10th from 5-8 pm. Mr Ross will give a talk on his work at the gallery the following Sunday, April 11th at 3pm. Artist, amateur bio-engineer and member of the San Francisco mycological society, Mr. Ross uses living organisms as the inspiration and means by which he makes his work. Through the design and creation of highly controlled environments, Mr. Ross manipulates, nurtures and transforms a variety of living species into sculpture.

Mr. Ross's work lies at the disparate intersection of homegrown technologies, folk art, materials science, and D.I.Y. cultivation techniques. The show includes a series of Reishi mushrooms grown into highly artificed forms, the aforementioned sculpture grown out of oysters, and a self-contained survival capsule for one living plant. These sculptures are at once highly crafted and naturally formed, skillfully manipulated and sloppily organic.

Link (Thanks, Mara!)
3.  Web Zen -- Music Zen.

midisko

8bitpeoples

opaquechannel

gameboyzz orchestra

bent2004

jump around mp3

robot soul mp3

mame jump

titanium rhapsody

kohina radio


web zen home, web zen store, (Thanks, Frank).

4.  To Do in LA: Glenn Tillbrook doc film free preview.

Friend o' BoingBoing and rock-n-roll legend bassgoddessgreta (Moby, Debbie Harry, The Nuns, etc.) sends word of an offbeat new documentary film starring former Squeeze frontman Glenn Tilbrook. Twenty years ago with Squeeze, touring meant 18 wheelers, hotel suites and police-escorted limos. Now Tilbrook's music now finds its audience through a more independent route -- which involves a big mobile home and a new indie sensibililty.

In November 2001, to support the release of his debut solo CD, The Incomplete Glenn Tilbrook, Glenn embarked on a different kind of independent route as he took to the road in America: One man, two guitars and a mobile home.

Glenn Tilbrook: One for the Road follows him on every step of that journey: arriving in the States; picking up his mobile home; performing the shows; meeting the fans; packing away his guitars; camping at campgrounds; traveling in the RV: All access, all of the time. It's an intimate look at how an established musician adjusts to his new independent surroundings. It's a commentary on the current state of the music industry. But, most importantly, it's a human interest story that transcends its musical base.

Link to movie homepage, and check it out in LA at a free preview screening on Tuesday, May 11th, 8:00pm at CineSpace, 6356 Hollywood Blvd. 2nd Floor. 323 817 3456.

5.  Nevermind broadband -- many First Americans don't have phone service. Comments from an NPR listener who heard a segment I did for "Day to Day" on the president's promise to make broadband accessible to all Americans by the year 2007. Eric Martin says:
Phone penetration on reservations just passed the 50% mark within this decade and even where there are phone lines on US reservations a lot of them are old copper lines that can't handle dial-up. So before Bush goes and gets the rest of the country hooked up with high speed, he should make sure that all Americans, including Native Americans, have basic phone service. John Edwards wasn't lying when he was talking about two Americas.

There are some interesting stats on the lack of phone penetration in "Indian Country" on this FCC website.

----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
6.  Demonstration Against Software Patents in Europe
----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
7.  BugTraq: RE: Full-Disclosure is now ILLEGAL in France ! (Vulnerabilties, Technical details, Exploits ...). Sender: Amer Karim [amerk at nautilis-sys dot com]
8.  Vulns: Centrinity FirstClass Desktop Client Local Buffer Overflow Vulnerability. Centrinity FirstClass Desktop is a client application used to manage the FirstClass server.

A buffer overflow vulnerability has been identified in the application that m...

9.  Vulns: Microsoft Internet Explorer Remote IFRAME Denial Of Service Vulnerability. A denial of service vulnerability has been reported to affect Internet Explorer. The issue is reported to present itself when Internet Explorer attempts to render IFRAME ...

3:14:13 PM    comment []

----------------------------------------------------------------------
Boing Boing
----------------------------------------------------------------------
1.  Help Monochrom do something weird and funny with text and images. Past guestblogger Johannes writes, "Cartoons often consist of two parts ... the graphical element and the text below the drawing (example). We need around 300 such text elements, ... only the text elements. We need JPEGs, maximum width 300 px. Please send the files as attachments. Thanx a lot in advance! We'll keep you updated!"

Mailto Link

(Thanks, Johannes!)

----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
2.  Scotts Testing Genetically Modified Grass
----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
3.  Vulns: Libxml2 Remote URI Parsing Buffer Overrun Vulnerability. Libxml2 is an XML parser and toolkit that is implemented in C.

A remotely exploitable buffer overrun vulnerability has been reported in Libxml2. This issue is due to in...

4.  Vulns: Apache mod_python Module Malformed Query Denial of Service Vulnerability. Apache's mod_python is a module which allows the web server to interpret Python scripts. mod_python supports Apache 1.3.x and 2.x, and is available for Windows, Linux and...
5.  Vulns: Monit HTTP Content-Length Parameter Denial of Service Vulnerability. Monit is a utility for the Linux and Unix operating systems that is designed to monitor processes, devices, files, and directories. The application makes use of an HTTPS ...
6.  Vulns: Panda ActiveScan ASControl.DLL Remote Heap Overflow Vulnerability. Panda ActiveScan is an antivirus application for detecting and eliminating malicious code.

A heap overflow vulnerability has been identified in the application that may ...


2:13:53 PM    comment []

----------------------------------------------------------------------
Boing Boing
----------------------------------------------------------------------
1.  Wild west themeparks kicking ass in Bavaria. Steve sez, "It's not quite a fetish but clearly 'wild west' life is big and serious in parts of German and Czech life..."

Main Street features covered plank sidewalks, double-decker railings and cutout clapboard facades. Outside the sheriff's office, the town marshal, Big Joe - a Turkish-born character actor little more than three feet tall - obligingly poses for photos, pointing his six-gun at guests and ordering "Hände hoch!" ("Hands up!")...Pullman City, in fact, is one of more than a dozen Wild West theme parks and similar attractions in Europe, from Spain to Scandinavia. I visited several others, including two parks in the Czech Republic and one near Vienna.

They all form part of a multifaceted Wild West subculture in Europe that includes everything from country music festivals and cowboy saloons to an established rodeo circuit. Tens of thousands of Europeans study (or even live like) trappers, American Indians or other frontier archetypes as a hobby. They join clubs, dress up in elaborate costumes and often take to the woods on weekends to live in tepees or sleep "cowboy style" under the stars. "People dream of a free, beautiful country, of romantic campfires and heroes in the saddle," said Detlef Jeschke, a Nuremberg-born former champion European rodeo cowboy who is Pullman City's program manager.

Link

(Thanks, Steve!)

----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
2.  Cisco's LEAP Authentication Cracked
----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
3.  Vulns: Kerio Personal Firewall Web Filtering Remote Denial Of Service Vulnerability. Kerio Personal Firewall (KPF) is a desktop firewall solution that performs stateful packet inspection. It is available for the Microsoft Windows platform.

Kerio Persona...

4.  Vulns: Cisco WLSE/HSE Devices Default Username and Password Vulnerability. Cisco Wireless LAN Solution Engine (WLSE) devices provide centralized management including monitoring, network security, and optimization for the Cisco Wireless LAN infra...
5.  Vulns: Apache Error Log Escape Sequence Injection Vulnerability. Apache is a freely available Web server for Unix and Linux variants, as well as Microsoft operating systems.

It has been reported that the Apache web server is prone to ...

6.  Vulns: Apache Mod_SSL HTTP Request Remote Denial Of Service Vulnerability. mod_ssl is the implementation of SSL (Secure Socket Layer) for the Apache webserver.

mod_ssl has been reported to be prone to a remote denial of service vulnerability. ...


1:13:33 PM    comment []

----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
1.  Vulns: Mcafee FreeScan CoMcFreeScan Browser Object Buffer Overflow Vulnerability. Mcafee FreeScan in a web based antivirus application.

The CoMcFreeScan browser object is reported to be prone to a buffer overflow vulnerability. The issue is reportedly...

2.  Vulns: ESignal Remote Buffer Overflow Vulnerability. eSignal is an application that provides real-time stock market information. It is commercially available for the Microsoft Windows platform.

It has been reported that e...

3.  Vulns: PHPBB Privmsg.PHP SQL Injection Vulnerability. phpBB is an open-source web forum application that is written in PHP and supported by a number of database products. It will run on most Unix and Linux variants, as well ...

12:13:14 PM    comment []

----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
1.  More SUSE Linux 9.1 Reviews
----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
2.  Vulns: SuSE YaST Online Update Insecure Temporary File Creation Vulnerability. SuSE YaST Online Update is a software update utility that facilitates the installation of software updates from an online repository.

SuSE YaST Online Update reportedly ...

3.  Vulns: F-Secure BackWeb Local Privilege Escalation Vulnerability. F-Secure BackWeb is an update module for various F-Secure products.

A vulnerability has been reported in F-Secure BackWeb that may permit local attackers to gain system ...


11:12:52 AM    comment []

----------------------------------------------------------------------
Boing Boing
----------------------------------------------------------------------
1.  BBC tries DRM-free distribution. Dan sez, "The BBC is putting it's annual Reith Lectures online in DRM-free mp3 for download, for the first time ever. May not seem like a big deal, but it's the first time we've managed to do something like this. It's a trial to test public reaction (in terms of downloads and public opinion) - if successful, it's likely to make it more likely for the BBC to offer more programmes for download like this. It'd be great if Boing-Boingers could check it out and tell the BBC what they think of all this..."

Link

(Thanks, Dan!)

2.  Mynah bird "boing boing boing" clip. Ian Brown found this weird clip of a mynah bird saying "boing boing boing."

17K WAV Link

(Thanks, Ian!)

----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
3.  AOL to Give Away Spammer's Porsche
----------------------------------------------------------------------
NewsIsFree: Security
----------------------------------------------------------------------
4.  Bagle Automatic Distribution and Execution
5.  eWeek: Security Updates on Tap for Server 2003
6.  Vmyths: Security firm announces it will ATTACK customers at no extra charge "launches denial-of-...

10:12:32 AM    comment []

----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
1.  Tiny Surveillance Aircraft Fly in Tucson

9:12:12 AM    comment []

----------------------------------------------------------------------
Boing Boing
----------------------------------------------------------------------
1.  Playmobil Porn Intro.

Apropos of the Playmobil TSA Playset, Hubert sez, "Another favourite is this bedroom set, which threatens to erupt into Playmobil porn at any second. I think the woman is holding a hookah and the guy's moustache is... just... inappropriate."

Link


----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
2.  Vulns: RealNetworks RealOne Player/RealPlayer Remote R3T File Stack Buffer Overflow Vulnerability. RealPlayer/RealOne Player are media players that are available for various operating systems, including Microsoft Windows and Mac OS.

It has been reported that RealOne ...

----------------------------------------------------------------------
NewsIsFree: Security
----------------------------------------------------------------------
3.  Wired: OS X Trojan Horse Is a Nag "Security experts on Friday slammed security firm Intego for e...
4.  Crackalaka IRC Server Can Be Crashed By Remote Users
5.  Sun Cluster Race Condition Lets Remote Users Panic the Cluster

8:11:52 AM    comment []

----------------------------------------------------------------------
NewsIsFree: Security
----------------------------------------------------------------------
1.  Scorched 3D Chat Box Format String Vulnerability
2.  Scorched 3D Chat Box Format String Vulnerability
3.  Gentoo update for scorched3d
4.  Gentoo update for scorched3d
5.  RSniff Multiple Connection Denial of Service Vulnerability
6.  RSniff Multiple Connection Denial of Service Vulnerability
7.  Scorched 3D Chat Box Format String Vulnerability
8.  Gentoo update for pwlib
9.  Gentoo update for iproute
10.  Gentoo update for scorched3d
11.  RSniff Multiple Connection Denial of Service Vulnerability

7:11:32 AM    comment []

----------------------------------------------------------------------
Ars Technica
----------------------------------------------------------------------
1.  FCC receives stay, will appeal cable ruling to the Supreme Court. FCC hopes the Supreme Court will overturn a ruling on the definition of cable internet services. By Fred "zAmboni" Locklear.
----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
2.  The Only Way Microsoft Can Die is by Suicide
----------------------------------------------------------------------
The Register
----------------------------------------------------------------------
3.  Germany moots jail for spammers. 'We need really hard sanctions' By Monika Ermert .
4.  NY Times hacker sentencing delayed. Lamo awaits fate By Kevin Poulsen, SecurityFocus .
----------------------------------------------------------------------
Wired News
----------------------------------------------------------------------
5.  Opponents Take Swing at GMO Grass. Lawn-products company Scotts is testing a bioengineered version of a creeping grass favored by golf courses. The company claims the Roundup-resistant grass is unlikely to spread, but a surprising assortment of challengers disagree.
6.  USDA Rejects Drug-Laced Rice. The agency turns down a biotech company's proposal to grow rice that's been genetically modified to produce proteins that fight infection. The rice could contaminate normal crops, critics say. By Kristen Philipkoski.
7.  Women Drive Changes in Car Design. Volvo unveils a concept car at the New York Auto Show designed with a woman's touch -- eight of them, actually. An all-female team of engineers put it together. John Gartner reports from New York.
8.  Gator, er, Claria Files for IPO. Even with high-profile lawsuits, complaints from users and new state laws banning ad-spouting programs, the adware company formerly known as Gator has filed to go public. By Amit Asaravala.
9.  OS X Trojan Horse Is a Nag. The first Trojan for Mac OS X is anything but, experts say, and Thursday's warning from antivirus company Intego was unnecessarily alarmist. By Leander Kahney.
10.  Space Celebration Circles Globe. April 12 is the anniversary of Yuri Gagarin's pioneering orbit of Earth, so what's the best way to mark it? Party around the world! By James Bernard Frost.
----------------------------------------------------------------------
NewsIsFree: Security
----------------------------------------------------------------------
11.  Gentoo update for pwlib
12.  Gentoo update for pwlib
13.  Gentoo update for iproute
14.  Gentoo update for iproute

6:11:13 AM    comment []

----------------------------------------------------------------------
Ars Technica
----------------------------------------------------------------------
1.  Will regulation burst the VoIP bubble?. A heavy handed approach to regulation may nip VoIP in the bud. By Fred "zAmboni" Locklear.
2.  X-Prize! SpaceShipOne reaches Mach 2. The leading contender to claim the X-Prize sucessfully completes a Mach 2 test flight By Fred "zAmboni" Locklear.
----------------------------------------------------------------------
Boing Boing
----------------------------------------------------------------------
3.  TTY services used by Nigerian credit-card scammers. TTY relay services are phone-banks staffed by operators who take text messages from the TTY terminals used by deaf people and read them aloud into telephones. This lets deaf people order pizzas, and otherwise interact with the hearing telephony world.

Recently, TTY systems have gone web-based: instead of using specialized TTY hardware, deaf people can use a chat interface in a browser window to interact with the operators.

This fact has not escaped Nigerian credit-card scammers. These folks are piping the output of Babelfish and other machine-translation services into the chat interface and directing the operators to place calls to merchants, directing them to ship goods paid for with stolen credit card numbers to mail-drops.

Merchants stand to lose big if they fall for the ruse - callers often try to order more than $10,000 worth of expensive equipment. People who legitimately use the service fear businesses will stop taking their calls, thinking they are fraud artists...

The only possible beneficiaries are the successful scammers - profiting from free phone calls intended for deaf people - and the four phone companies that provide Internet relay service. They are paid for the calls by the minute.

Link

(via /.)

4.  Hugo ballot online. The 2003 Hugo Nominees have been announced:

Best Novel (462 ballots)

* Paladin of Souls -- Lois McMaster Bujold (Eos)
* Humans -- Robert Sawyer (Tor Books)
* Ilium -- Dan Simmons (Eos)
* Singularity Sky -- Charles Stross (Ace Books)
* Blind Lake -- Robert Charles Wilson (Tor Books)

Link

5.  EFF on Gmail. On EFF's Deep Links blog, some preliminary analysis of Google's Gmail terms-of-service:

"People are entitled to know what kind of information Google will pull from email, whether or not it logs this information, and for how long," said EFF's Kevin Bankston. "Can your Gmail address or any other personal identifier be linked to those logs, or to your Google search history?"

"Gmail's privacy policy states that 'Google welcomes feedback on this document and policy as the Gmail service is currently in an early testing stage.' While that's a nice sentiment, we can't give meaningful feedback until we have all the facts."

The remedy to the situation is obvious: Google needs to let us all know precisely what the privacy/convenience trade-off is for using Gmail, and soon.

Link

(Thanks, Inder!)

6.  Lessig's Free Culture Chinese fan-trans. Kevin sez, "Some Chinese bloggers have recently launed a collabrative transaltion project to translate Lessig's Free Culture into Chinese, Create a Wiki page in SocialBrain. So far, 21 people have joined this collaborative project, memes appeared in lots of blogs. 12 chapters were assigned by contributors to translate."

Link

(Thanks, Kevin!)

7.  Playmobil Airport Security playset.

Get your kiddies started on a career with real growth potential with this Playmobil airport security playset.

Link

(Thanks, Armand!)

8.  Kosher for Passover circus. Ringling Bros and Barnum and Bailey threw a Kosher-for-Passover circus at Madison Square Gardens for 19,0000 orthodox Jews, selling bun-less hot-dogs and hiding the female performers.

The Greatest Show on Earth had its ethnic flourishes. The band started the afternoon by playing "Dayenu," a rousing song at the Passover Seder that children love. And David Larible, the master clown they call the Prince of Laughter, wore a yarmulke to perform a miracle that more than one youngster must have thought was right up there with the parting of the Red Sea and the Ten Plagues: he turned another performer into a goat for several heart-stopping seconds.

Link

(Thanks, Rose!)

----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
9.  Vulns: Sysstat Insecure Temporary File Creation Vulnerability. Sysstat is a system monitoring utility for Linux.

Sysstat is prone to an issue that may allow malicious local users to corrupt system files, most likely resulting in los...

10.  Vulns: Sysstat Isag Temporary File Creation Vulnerability. Sysstat is a system monitoring utility for Linux. Sysstat includes a command (Isag) for representing system information graphically.

The Sysstat Isag command is prone t...

----------------------------------------------------------------------
NewsIsFree: Security
----------------------------------------------------------------------
11.  Flowers Spam Scam
12.  Computer Viruses And Organized Crime
13.  What's Wardialing?
14.  Gso Begins A Clean-up
15.  Rampant Epidemics Of Powerful Malicious Software
16.  Top Security Pros Head To Cybersecurity Summit
17.  Secretary Tom Ridge At The Cyber Security Summit
18.  Technet Fights Security Ignorance
19.  Denying Ddos
20.  Bug Devices Track Officials At Summit
21.  President Signs Antispam Law
22.  Reflecting On Linux Security In 2003
23.  Measuring Risk: Do I Have Any Volunteers?
24.  Three Blind Mice ... Err .. Phreaks
25.  'mydoom' Creators Unleash 'doomjuice'
26.  Microsoft To Hackers: Drop That Code!
27.  Latest Mydoom Outbreak Spreading, Deletes Files
28.  New Worm Tragets Icq
29.  Top Ten Viruses And Hoaxes Of February
30.  CNN: Virus tries to take bite out of Apple "first Trojan horse virus to target Apple's latest op...
31.  eWeek: Security Alert - New BugBear Worm Discovered "BugBear.E was discovered early Tuesday, and...
32.  Wired: OS X Trojan Horse Is a Nag "Security experts on Friday slammed security firm Intego for e...
33.  Hacker Lamo's Sentencing Postponed (TechWeb)
34.  Worm Triggers Attacks on File-Trading Services (washingtonpost.com)

5:10:52 AM    comment []

----------------------------------------------------------------------
Dilbert
----------------------------------------------------------------------
1.  Dilbert for 10 Apr 2004.
----------------------------------------------------------------------
Yahoo! News - Technology
----------------------------------------------------------------------
2.  Letter: Vendors Should Agree On Spam-Reducing Standards (TechWeb). TechWeb - Consultant Chip Burkitt calls on vendors to agree on standards for spam-blocking technology. He also provides a tip for configuring mail servers to reject messages from nonexistent domains.
3.  Microsoft Trying Soft Sell To Beat Open Source (TechWeb). TechWeb - Microsoft CEO Steve Ballmer actually praised open source this week, and the company released software under an open source license. That's a long-way from recent fire-breathing attacks.
4.  Worm Triggers Attacks on File-Trading Services (washingtonpost.com). washingtonpost.com - The latest variant of the Netsky worm is directing infected computers to launch Web-based attacks against music- and file-trading Web services such as Kazaa, taking down at least one company's Web sites in the process.
----------------------------------------------------------------------
BBC News | Technology | UK Edition
----------------------------------------------------------------------
5.  UK gamers stumble during top match. The UK's top gaming clan Four-Kings has been beaten during an exhibition match organised by Intel.
----------------------------------------------------------------------
NewsIsFree: Security
----------------------------------------------------------------------
6.  Corporate security workgroup announces recommendations
7.  TSA to launch registered traveler program

4:10:33 AM    comment []

----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
1.  Listen to the Sky
----------------------------------------------------------------------
NewsIsFree: Security
----------------------------------------------------------------------
2.  IBM HTTP Server OpenSSL Vulnerabilities
3.  AzDGDatingLite Cross Site Scripting Vulnerability
4.  nukeKalender Multiple Vulnerabilities
5.  KAME Racoon IKE Daemon RSA Signature Verification Vulnerability
6.  Gentoo update for ipsec-tools
7.  1st Class Mail Server Directory Traversal and Cross Site Scripting
8.  Kerio Personal Firewall URL Handling Denial of Service
9.  Sun Cluster Global File System Denial of Service Vulnerability
10.  Open WebMail Directory Creation Vulnerability
11.  Gentoo update for heimdal

3:10:12 AM    comment []


2:09:52 AM    comment []

----------------------------------------------------------------------
NewsIsFree: Security
----------------------------------------------------------------------
1.  France Bans Full Disclosure

1:09:32 AM    comment []

----------------------------------------------------------------------
Yahoo! News - Technology
----------------------------------------------------------------------
1.  Dell to Load Oracle Software on Computer Servers (Reuters). Reuters - No. 2 personal computer maker Dell Inc. (DELL.O) will begin selling database software from Oracle Corp.(ORCL.O) that has been pre-loaded onto its computer servers, an offer aimed at small and medium-sized businesses.
----------------------------------------------------------------------
Slashdot
----------------------------------------------------------------------
2.  Build Your Own Steadicam
----------------------------------------------------------------------
SecurityFocus Vulns
----------------------------------------------------------------------
3.  Vulns: HP-UX Support Tools Manager Denial of Service Attack. Support Tools Manager is a software package included with HP-UX designed to make administration of systems easier. HP-UX is the Hewlett Packard UNIX Operating System desi...

12:23:32 AM    comment []


Click here to visit the Radio UserLand website. © Copyright 2004 Gregg Doherty.
Last update: 5/3/2004; 12:26:40 AM.
This theme is based on the SoundWaves (blue) Manila theme.
April 2004
Sun Mon Tue Wed Thu Fri Sat
        1 2 3
4 5 6 7 8 9 10
11 12 13 14 15 16 17
18 19 20 21 22 23 24
25 26 27 28 29 30  
Mar   May