Sunday, June 13, 2004

---------------------------------------------------------------------- NewsIsFree: Security ---------------------------------------------------------------------- 1.  [waraxe-2004-SA#032 - Multiple security flaws in PhpNuke 6.x - 7.3] 2.  COELACANTH: After Math 10:25:58 PM    comment [] ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 1.  Remembering Pioneer 10 ---------------------------------------------------------------------- NewsIsFree: Security ---------------------------------------------------------------------- 2.  Blog :: Taking the Hypocritical Oath 9:25:38 PM    comment [] ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 1.  Why Users Blame Spatial Nautilus ---------------------------------------------------------------------- SecurityFocus Vulns ---------------------------------------------------------------------- 2.  Vulns: KSymoops KSymoops-GZNM Insecure Temporary File Handling Symbolic Link Vulnerability. Ksymoops is a Kernel oops and error message decoder. X-NAS-Bayes: #0: 1.96596E-013; #1: 1 X-NAS-Classification: 0 X-NAS-MessageID: 1631 X-NAS-Validation: {E681C936-E9F0-4DDC-9901-74301AF33E67} Ksymoops ships with several scripts, one of these scripts is 'ksymoops-gznm'. It is reported that the 'ksymoops-gznm... 8:25:18 PM    comment [] ---------------------------------------------------------------------- SecurityFocus Vulns ---------------------------------------------------------------------- 1.  Vulns: Blackboard Learning System Dropbox File Download Vulnerability. Blackboard Learning System is web-based educational software. X-NAS-Bayes: #0: 3.9569E-019; #1: 1 X-NAS-Classification: 0 X-NAS-MessageID: 1630 X-NAS-Validation: {E681C936-E9F0-4DDC-9901-74301AF33E67} It is reported that Blackboard improperly allows users to download files posted in the 'Digital Dropbox'. ... ---------------------------------------------------------------------- NewsIsFree: Security ---------------------------------------------------------------------- 2.  Security Focus: SMTP.Proxy Remote Format String Vulnerability "may be exploited to execute arbit... 3.  Security Focus: Skype Technologies Skype CallTo URI Handler Buffer Overrun Vulnerability "it is ... 7:24:57 PM    comment [] ---------------------------------------------------------------------- Ars Technica ---------------------------------------------------------------------- 1.  Video on Demand tie-in with TiVo shows a glimpse of TiVo's plans?. Last week TiVo revealed its intention to get into the content distribution business, but they said little about the details of their plan. Many assumed that TiVo would be aiming for an "on demand" service that would tap into the Internet. Not quite. By Ken "Caesar" Fisher. ---------------------------------------------------------------------- Yahoo! News - Technology ---------------------------------------------------------------------- 2.  Skeptics Question Wi-Fi's Viability (AP). AP - Alas, wireless Internet may not be the technology sector's salvation after all. Small companies, some publicly traded, are burning cash trying to turn Wi-Fi into viable business. Some have already shut down. ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 3.  Buy Lindows, Get Fedora and Mandrake Too? ---------------------------------------------------------------------- SecurityFocus Vulns ---------------------------------------------------------------------- 4.  Vulns: Multiple Microsoft Internet Explorer Script Execution Vulnerabilities. Multiple issues have been reported in Microsoft Internet Explorer. Though these issues have been reported by a reliable source, communication issues have presented diffi... 5.  Vulns: Microsoft Internet Explorer ADODB.Stream Object File Installation Weakness. The Microsoft ActiveX Data Objects 2.5 Library provides support for the ADODB.Stream Object. This object may be accessed by various methods from within ASP pages or thr... 5:24:17 PM    comment [] ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 1.  California Initiative to Expand DNA Database 4:23:58 PM    comment [] ---------------------------------------------------------------------- BBC News | Technology | UK Edition ---------------------------------------------------------------------- 1.  Microsoft races to deter hackers. The software giant faces a new threat from hackers that may leave millions of computers vulnerable. ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 2.  More 3D Displays to Come ---------------------------------------------------------------------- NewsIsFree: Security ---------------------------------------------------------------------- 3.  MDKSA-2004:056-1 - Updated krb5 packages fix buffer overflow vulnerabilities 3:23:37 PM    comment [] ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 1.  Government-Funded GPL Software ---------------------------------------------------------------------- SecurityFocus Vulns ---------------------------------------------------------------------- 2.  Vulns: OpenBSD ISAKMPD Security Association Piggyback Delete Payload Denial Of Service Vulnerability. isakmpd is the IKE key management daemon provided with OpenBSD. isakmpd is used when negotiating security associations in authenticated or encrypted network traffic and i... 3.  Vulns: Edimax 7205APL 802.11b Wireless Access Point Default Backdoor Account Vulnerability. The Edimax 7205APL is a 802.11b wireless access point which has a web-based configuration application. X-NAS-Bayes: #0: 5.31916E-019; #1: 1 X-NAS-Classification: 0 X-NAS-MessageID: 1622 X-NAS-Validation: {E681C936-E9F0-4DDC-9901-74301AF33E67} The Edimax 7205APL is reported to contain a default backdoor accou... 4.  Vulns: Skype Technologies Skype CallTo URI Handler Buffer Overrun Vulnerability. Skype Technologies Skype is peer-to-peer communications software that provides for Internet based voice communications. Skype is reported to be prone to a buffer overrun... 2:23:17 PM    comment [] ---------------------------------------------------------------------- SecurityFocus Vulns ---------------------------------------------------------------------- 1.  Vulns: Billion BIPAC-640 AE Administrative Interface Authentication Bypass Vulnerability. Billion BIPAC-640 AE is an appliance firewall and NAT that can be used to share a single broadband Internet connection. X-NAS-Bayes: #0: 6.40792E-018; #1: 1 X-NAS-Classification: 0 X-NAS-MessageID: 1621 X-NAS-Validation: {E681C936-E9F0-4DDC-9901-74301AF33E67} Billion BIPAC-640 AE is reported prone to an auth... 1:22:57 PM    comment [] ---------------------------------------------------------------------- Ars Technica ---------------------------------------------------------------------- 1.  Wireless routers birthing bugs aplenty. The past two weeks there have been two considerable WiFi router flaws that we thought we should bring to your attention. First off, the massively popular Linksys WRT54G has a remote access flaw. By Ken "Caesar" Fisher. ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 2.  Are PDAs Simply Finished? 3.  New Digital Audio Formats ---------------------------------------------------------------------- SecurityFocus Vulns ---------------------------------------------------------------------- 4.  Vulns: Squid Proxy NTLM Authentication Buffer Overflow Vulnerability. Squid is a freely available, open source web proxy software package. It is designed for use on the Unix and Linux platforms. X-NAS-Bayes: #0: 1.99318E-045; #1: 1 X-NAS-Classification: 0 X-NAS-MessageID: 1619 X-NAS-Validation: {E681C936-E9F0-4DDC-9901-74301AF33E67} Squid Web Proxy Cache is reportedly affected... 12:22:37 PM    comment [] ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 1.  Super Maps for the 21st Century ---------------------------------------------------------------------- SecurityFocus Vulns ---------------------------------------------------------------------- 2.  Vulns: SMTP.Proxy Remote Format String Vulnerability. smtp.proxy is an SMTP gateway that is available for UNIX and Linux variants. X-NAS-Bayes: #0: 6.49617E-019; #1: 1 X-NAS-Classification: 0 X-NAS-MessageID: 1618 X-NAS-Validation: {E681C936-E9F0-4DDC-9901-74301AF33E67} smtp.proxy is prone to a remotely exploitable format string vulnerability. This issue may b... 11:22:17 AM    comment [] ---------------------------------------------------------------------- CNET News.com ---------------------------------------------------------------------- 1.  Week ahead: Eyes on Oracle, earnings. The Justice Department's case against Oracle will be closely watched, as will the database giant's earnings report. ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 2.  Meteorite Crashes Through New Zealand Roof 10:21:57 AM    comment [] ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 1.  Flaw in Florida E-Voting Machines ---------------------------------------------------------------------- NewsIsFree: Security ---------------------------------------------------------------------- 2.  W32.Sober.H@mm 9:21:37 AM    comment [] ---------------------------------------------------------------------- Yahoo! News - Technology ---------------------------------------------------------------------- 1.  Programs: Wild West Duels Make 'Red Dead Revolver' a Hit (Reuters). Reuters - (Gene Emery is a columnist who covers science and technology. His Internet address is GEmery(at)Cox.net. Any opinions in the column are his alone.) 8:21:18 AM    comment [] 7:20:58 AM    comment [] ---------------------------------------------------------------------- Boing Boing ---------------------------------------------------------------------- 1.  Man wins person-v-horse race for first time in 25 years. There's a Welsh town that hosts an annual 22-mile human-verus-horse footrace, with a £1000 cumulative prize for any human beats the horse that's gone unclaimed for 25 years -- until now. X-NAS-Bayes: #0: 0.10866; #1: 0.89134 X-NAS-Classification: 0 X-NAS-MessageID: 1611 X-NAS-Validation: {E681C936-E9F0-4DDC-9901-74301AF33E67} Bookies William Hill had to pay out on scores of bets struck at odds of 16/1. This year's contest had a record 500 runners and more than 40 horses and riders competing for the winning title. Link (via Ben Hammersley) 2.  State of Wireless London. Julian Priest has written an excellent report on the state of "Wireless London" -- the wheres and hows of WiFi in the city. The reason that it has been possible to operate freenetwork access point type nodes without charge is that once the equipment is installed, the incremental cost of allowing others to use it is very low. If you are already paying for network access for yourself, and have installed a wireless network, the additional cost of offering it to the public is negligible. The initial hardware costs are also low, at less than 100 GBP for an access point, and with running costs of 25 GBP per month it makes for a very affordable system. However, commercial hotspots are faced with significantly more costs over and above the minimal equipment and networking costs, such as a billing infrastructure, help desks, credit checking, location payments, maintenance contracts, share holder dividends and marketing, to name a few. This is inevitably reflected in prices charged for the service. It remains to be seen how these commercial models burdened with such overheads will compete with the freenetworking ones, and whether the marketing spend, and the strategy of local monopoly will be justified by the returns. Link (via Oblomovka) ---------------------------------------------------------------------- BBC News | Technology | UK Edition ---------------------------------------------------------------------- 3.  Rockstar plays with Wild West. Get a first taste of Red Dead Revolver, the latest game by Rockstar, the people behind Grand Theft Auto. ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 4.  UK Anti-Spam Laws Criticised ---------------------------------------------------------------------- NewsIsFree: Security ---------------------------------------------------------------------- 5.  Policy: No contract interrogators 6.  50 failed airstrikes revealed 6:20:38 AM    comment [] ---------------------------------------------------------------------- NewsIsFree: Security ---------------------------------------------------------------------- 1.  [OpenPKG-SA-2004.029] OpenPKG Security Advisory (apache) 2.  sysstat trigger Script Symlink Arbitrary File Overwrite 3.  Multiple Vendors FTP Client Pipe Character Arbitrary Code Execution 4.  Symantec Norton AntiVirus 2002 Beta Encryption Weakness 5.  Symantec Norton AntiVirus 2002 Beta AutoProtect Disable 6.  EasyBoard 2000 ezman.cgi Content-Type Header Overflow 7.  EasyBoard 2000 ezadmin.cgi Content-Type Header Overflow 8.  EasyBoard 2000 ezboard.cgi Content-Type Header Overflow 9.  sysstat post Script Symlink Arbitrary File Overwrite 5:20:21 AM    comment [] ---------------------------------------------------------------------- Boing Boing ---------------------------------------------------------------------- 1.  Defcon Wifi Shootout Contest. Get ready for the second annual "Defcon Wifi Shootout Contest", July 30 - August 1, 2004, at this year's Defcon in Vegas. The goal of this year's contest is to achieve the greatest possible connect distance between two 802.11b stations through innovative engineering and antenna design. Wonderful prizes and fun are available to all who participate! X-NAS-Bayes: #0: 3.82299E-178; #1: 1 X-NAS-Classification: 0 X-NAS-MessageID: 1606 X-NAS-Validation: {E681C936-E9F0-4DDC-9901-74301AF33E67} Link (via socalwug) 2.  Signal Orange: representing Iraq war dead on bodies of the living. The organizers of the "Signal Orange" t-shirt campaign want people to wear shirts displaying the identities of individual US soldiers killed in Iraq. They say the project serves to remind the world that war creates real victims on both sides -- people who align="left" width="225" height="191"> Signal Orange is a project to make the invisible visible -- which is a premise and prerequisite for democracy. The goal of Signal Orange is to unveil the faces that the Bush Administration wants hidden -- and to stop pretending that its actions in Iraq are inconsequential. This is a response: Signal Orange represents the dead with the living -- wearing T-shirts in their names. There is> Link 3.  Wanna buy a villa in Iraq?. Odd real estate listings are almost as fun to surf as weird eBay auctions. Here's an ad for what sounds like a charming Baghdad villa, complete with "recently restored water and electricity," and "Big basement designed also as anti-aircraft bunker with water facilities." Asking price for the property is>Link (Thanks, Jean-Luc) ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 4.  Casio's Credit Card Watch 3:19:38 AM    comment [] ---------------------------------------------------------------------- Boing Boing ---------------------------------------------------------------------- 1.  The postman always texts twice: shag phones. Disposable mobiles purchased specifically for the purpose of illicit sexual liasons. A Boingboing pal in the UK says reports of this odd social trend are legit -- throwaway phones allow sekrit lovers to communicate by SMS or voice, on the downlow. Snip from the blog where I first read the phrase "shag phone": X-NAS-Bayes: #0: 4.30278E-265; #1: 1 X-NAS-Classification: 0 X-NAS-MessageID: 1605 X-NAS-Validation: {E681C936-E9F0-4DDC-9901-74301AF33E67} I heard someone (honest) talking about their "shag phone" the other day. He was a married man having an affair with a lady who was also married. It seems that one of the first heady rituals of the affair was to purchase a "his and her" pair of Pre-pay shag phones. Only they knew each other's number, so when the phone rang, they could answer in an appropriately passionate way. While much the same effect could be achieved with caller recognition (assuming they were mobile literate), there was more than just a romantic gesture involved with this behavior. Technology still can't hide your phone bill from a suspicious spouse. And it can't hide your amour's frequently dialed number from prying eyes. Better to get a pair pre-pay phones with no incriminating phone bills or records. A small example of how the mobile is impacting on 21st century life. Link 2.  Paid song "ads" on radio walk, talk, quack like payola. An article in the LA Times about record companies paying radio stations to air specific songs as ads. Critics say the practice is a lot like the "payola" systems of the 1950s, which for the most part were outlawed long ago. During a single week in May, Canadian pop rocker Avril Lavigne's new song Don't Tell Me aired no fewer than 109 times on Nashville radio station WQZQ-FM. The heaviest rotation came between midnight and 6 a.m., an on-air no man's land visited largely by insomniacs, truckers and graveyard shift workers. On one Sunday morning, the three-minute, 24-second song aired 18 times, sometimes as little as 11 minutes apart. Those plays, or "spins," helped Don't Tell Me vault into the elite top 10 on Billboard magazine's national pop radio chart, which radio program directors across the country use to spot hot new tunes. But what many chart watchers may not know is that the predawn saturation in Nashville ­ and elsewhere ­ occurred largely because Arista Records paid the station to play the song as an advertisement. In all, sources said, WQZQ aired Don't Tell Me as an ad at least 40 times the week ending May 23, accounting for more than one-third of the song's airplay on the station. Link (totally retarded site registration required) (via pho) 3.  Web Zen: Hotel Motel Zen. ice hotel hotel pelirocco propeller island hotel the gobbler motel madonna inn wigwam village hoogerbrugge hotel web zen home, web zen store, (Thanks, Frank). 4.  More on "Why can't the BBC play MP3s?". Following up on this earlier BoingBoing post about the curious tale of Rodeohead MP3s, BoingBoing, and the BBC -- reader and geek sleuth Rupert Goodwins says, "I asked Mike Todd, one of BBC Radio's Broadcast Duty Managers, what was with that MP3 ban on the wireless. He said: "A lot depends on the amount of compression in the original MP3, but the CD-R request would be either to allow a linear version to be supplied, or a very much less compressed version. Every time lossy-compressed audio goes via a lossy part of the chain it gets worse (depending, of course, on the original level of compression and the type of audio)." A BH studio to the FM transmitter network is not a problem, but it is when it goes to DAB/Freeview/Dsat ... and then the studio itself may be being sourced via a lossy ISDN (as indeed Peel is). Add these together and the results could be dreadful ... therefore there's a policy to (a) not use MP3s unless editorial imperatives demand it and there is absolutely no other way, (b) not us Minidiscs except in certain circumstances and (c) have computer playout systems working with linear audio. BoingBoing reader Rupert continues: "There we have it. DAB is the European terrestrial digital radio system, Freeview is the UK's digital terrestrial TV system which has multiple radio channels too, and DSat is the digital satellite system. There's one heck of a lot of digital broadcasting round these parts, each with its own compression system, and that's before you start to worry about the streaming stuff on the Net." [Xeni speaking again here]. I'm still not sure that explains it. The BoingBoing reader who pointed John Peel to the Rodeohead MP3s says that when he learned Peel couldn't play the MP3s, he burned them to CD, sent them to Peel at the BBC, and they aired on Peel's show shortly thereafter. So, either (a) the issue was that Peel's show was simply unable to deal with downloading, storing, and playing digital files (but popping a CD in a player was no prob), or (b) the above theory is true, and Peel's show obtained and then aired a non-lossy version of the material, from someone other than this BoingBoing reader. 5.  Nokia launches phonecam with fashionsoftporn from photog Rankin. Handset maker Nokia promoted the release of a new phonecam/PDA with help from renowned British fashion photographer Rankin, and a bunch of hot nekkid fairy chicks. [Rankin] was given an advance trial of Nokia's latest and highest-resolution cameraphone, the 7610. With it, he crafted six huge A2 sized photographs and 60 other shots, inspired by the legendary Cottingley fairy photographs. By running the images through software filters, the former co-founder of the legendary Dazed & Confused magazine managed to conjure up incredibly sharp images of beautiful women posed as woodland fairies. All this from a one-megapixel cameraphone with 4 x digital zoom, and a very sharp colour display. Link to Mike Butcher's article in the Irish Times, and link to photo gallery with Rankin's digitally remixed phonecam images -- and some pics of the handset itself. ---------------------------------------------------------------------- Yahoo! News - Technology ---------------------------------------------------------------------- 6.  A Processor's Clock Speed Is Just One Measure of Performance (washingtonpost.com). washingtonpost.com - The question I hear over and over from readers and friends goes something like this: "I need a computer for running Microsoft Office and browsing the Web, not much else. How fast of a processor should I get?" 7.  AOL Wants Users to Get This Message (washingtonpost.com). washingtonpost.com - Instant messaging is both wildly popular and mostly profit-free, but America Online appears determined to change the second half of that description. 2:19:18 AM    comment [] ---------------------------------------------------------------------- Slashdot ---------------------------------------------------------------------- 1.  Searching for the Best Scripting Language 12:31:37 AM    comment []

© Copyright 2004 Gregg Doherty. Last update: 7/1/2004; 2:24:48 AM. This theme is based on the SoundWaves (blue) Manila theme.