<<<
Chronological Index
>>> <<<
Thread Index
>>>
Re: [ga] This Forum virus hits form one subscriber - Causes...
No, Jeff. Leah challenged you to the same standard of either put up or shut
up.
The burden of proof is on you, Jeff, as the accuser/plaintiff, but you
know that since you have a law degree, right? So, why don't you
conduct yourself to the same common standard as an ethical officer of
the court and show us the evidence? After all, the district attorney
is all powerful with the Grand Jury, so you should be in 'fat cat'
city.
Since you have no evidence, then Leah is acquitted. So, just leave
her alone and redirect your delusions somewhere else.
I also challenge you, myself, again. Show me the evidence. If it is
real, then you can forget everything I said above. I will be on your
side and against Leah. However, until you do that, just knock it off.
It smells foul and you are the only person who can fix it . . . .
Thanks,
Monday, May 17, 2004, 9:12:47 PM, Jeff Williams <jwkckid1@xxxxxxxxxxxxx> wrote:
JW> Don and all former DNSO GA members or other interested stakeholders/users,
JW> Thanks anyway Don, but I have already done what you suggest below.
JW> And Leah also did most of the work for us all... Hence your suggestion
JW> is irrelevant...
JW> Don Brown wrote:
>> See below --
>>
>> Monday, May 17, 2004, 4:21:26 AM, Jeff Williams <jwkckid1@xxxxxxxxxxxxx> wrote:
>> JW> Leah and all former DNSO GA members or other interested stakeholders/users,
>>
>> JW> Oh? Well than why did you twice inform us all that you did? Oh yes
>> JW> and BTW I did not say you were using Norton Firewall.. And
>> JW> BTW as well the info I provided included "Symantec Norton AntiSpam
>> JW> 2004"
>> Send us the links to the archives of Leah's posts, in which she
>> says she is running that firewall.
>>
>> JW> So, why was it that your Email address was several times carrying
>> JW> a attached file that contained a virus, even after it was several times
>> JW> pointed out your Email address, and not spoofed as you claimed, was
>> JW> still sending out a virus in an attached file?
>> Provide the complete headers of those e-mails which conclusively prove
>> the e-mail actually came from her and was not forged/spoofed.
>>
>> JW> Now I can believe that VERY recently you have changed or added
>> JW> additional virus protect software as you state below... But that's after
>> JW> some time after the fact Leah... Too much time after the fact...
>>
>> JW> The proof as you well know Leah is in the archives. I have no
>> JW> problem what so ever providing that proof in a court of proper
>> JW> jurisdiction ANY TIME! I await your service...
>> Just provide the evidence here. You'll need to provide the complete
>> e-mail headers.
>>
>> I you can't or won't substantiate your position here, with the hard
>> evidence, then just leave her alone. IOW, put up or shut up.
>>
>> Thanks,
>>
>> JW> Leah G wrote:
>>
>> >> Can it Jeff. I don't use Norton Firewall or Norton Internet Security.
>> >> I use Norton AV, Trend Micro online and others for virus scanning. My
>> >> firewall is a double - Zone Alarm Pro and a linux firewall. In
>> >> addition, I keep track of vulnerabilities in all software I use and
>> >> update regularly. I'm probably in the minority in terms of keeping up
>> >> with security alerts. Most people do not.
>> >>
>> >> I'm really sick of this, Jeff. Some infected machine has my email
>> >> address and it is being spoofed. If you can't check headers and realize
>> >> that, I'm sorry, but continuing to insist that I have an infected
>> >> machine or that my machine is the source of the viruses sent to this
>> >> list is something you need to RETRACT unless you can prove it - and you
>> >> can't because it is untrue. Now I'm angry.
>> >>
>> >> Leah
>> >>
>> >> Jeff Williams wrote:
>> >>
>> >> > All former DNSO GA members or other interested stakeholders/users,
>> >> >
>> >> > Lately or recently this forum has been hit by Leah's Email address
>> >> > containing viruses. The cause seems to be from the following,
>> >> > given Leah's several self proclaimed use of Norton.
>> >> > See ( fixes now avalible, below. Note: switch to some other
>> >> > vendors virus ware Leah )
>> >> >
>> >> > ======================
>> >> >
>> >> > HIGH: Symantec Firewall Products Multiple Vulnerabilities
>> >> > Affected:
>> >> > Symantec Norton Internet Security 2002
>> >> > Symantec Norton Internet Security 2003
>> >> > Symantec Norton Internet Security 2004
>> >> > Symantec Norton Internet Security Professional 2002
>> >> > Symantec Norton Internet Security Professional 2003
>> >> > Symantec Norton Internet Security Professional 2004
>> >> > Symantec Norton Personal Firewall 2002
>> >> > Symantec Norton Personal Firewall 2003
>> >> > Symantec Norton Personal Firewall 2004
>> >> > Symantec Client Firewall 5.01, 5.1.1
>> >> > Symantec Client Security 1.0, 1.1, 2.0(SCF 7.1)
>> >> > Symantec Norton AntiSpam 2004
>> >> >
>> >> > Description: Symantec firewall products, used by both enterprises and
>> >> > home users, contain the following vulnerabilities in the "SYMDNS.SYS"
>> >> > module. This module validates the DNS and NetBIOS name service
>> >> > responses before allowing them to pass through the firewall.
>> >> >
>> >> > (1) The module contains a stack-based buffer overflow that can be
>> >> > triggered by a DNS response with an overlong "CNAME" field. The
>> >> > overflow can be exploited to execute arbitrary code with the
>> >> > "KERNEL" privileges.
>> >> >
>> >> > Note that the firewall processes all DNS response packets i.e. any UDP
>> >> > packet with source port 53. Hence, the flaw lends itself to easy
>> >> > exploitation via spoofed UDP packets.
>> >> >
>> >> > (2) The module contains another stack-based buffer overflow that can be
>> >> > triggered by a specially crafted NetBIOS response with an overlong
>> >> > NetBIOS name. The overflow can be exploited to execute arbitrary code
>> >> > with the "KERNEL" privileges. Note that if the client allows Windows
>> >> > file sharing, the NetBIOS name service port 137/udp is open.
>> >> >
>> >> > (3) The module contains a heap-based buffer overflow that can be
>> >> > triggered by a crafted NetBIOS response. The problem arises when the
>> >> > NetBIOS response does not contain the "Type", "Class", "Time-to-Live"
>> >> > and "Data Length" fields in a "Resource Record". The heap-based
>> >> > overflow can be leveraged to execute arbitrary code with "KERNEL"
>> >> > privileges, but is believed to be difficult to exploit reliably.
>> >> >
>> >> > (4) The module contains a denial-of-service vulnerability. The problem
>> >> > arises because a malicious domain name, constructed by using the DNS
>> >> > "compressed name pointer", can cause the decoding routine to enter an
>> >> > "infinite" loop. A hard reboot is required to restore the system to
>> >> > normalcy. The technical details required to exploit all the
>> >> > vulnerabilities have been posted.
>> >> >
>> >> > Status: Symantec has confirmed the flaws; updates available. Clients
>> >> > are advised to use the "LiveUpdate" feature to get the latest fixes.
>> >> >
>> >> > Council Site Actions: Three of the reporting council sites are using
>> >> > the affected product. One site has already patched their systems via
>> >> > the LiveUpdate Feature. Another site has only notified their sysadmins
>> >> > and has not yet planned how to remediate. They are expecting a major
>> >> > effort since they were hit hard by the recent BlackIce attack. The
>> >> > third site has a large number of Symantec users; however they do not
>> >> > officially support the software and do not plan any action at this time.
>> >> >
>> >> > They said that if there is an exploit released in the wild, they will
>> >> > inform the end users who have signed up for general security
>> >> > notifications.
>> >> >
>> >> > References:
>> >> > eEye Advisories
>> >> >
>> http://www.eeye.com/html/Research/Advisories/AD20040512D.html (DNS
>> >> > Overflow)
>> >> >
>> http://www.eeye.com/html/Research/Advisories/AD20040512A.html
>> (NetBIOS
>> >> > Stack Overflow)
>> >> >
>> http://www.eeye.com/html/Research/Advisories/AD20040512C.html
>> (NetBIOS
>> >> > Heap Overflow)
>> >> >
>> http://www.eeye.com/html/Research/Advisories/AD20040512B.html (DNS
>> DoS)
>> >> > Symantec Advisory
>> >> >
>> >>
>> http://securityresponse.symantec.com/avcenter/security/Content/2004.05.12.html
>> >> >
>> >> > DNS DoS Exploit
>> >> >
>> http://archives.neohapsis.com/archives/bugtraq/2004-05/0131.html
>> >> > SecurityFocus BID
>> >> > http://www.securityfocus.com/bid/10333
>> >> > http://www.securityfocus.com/bid/10334
>> >> > http://www.securityfocus.com/bid/10335
>> >> > http://www.securityfocus.com/bid/10336
>> >> >
>> ****************************************************************
>> >> >
>> >> > Regards,
>> >> >
>> >> > --
>> >> > Jeffrey A. Williams
>> >> > Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
>> >> > "Be precise in the use of words and expect precision from others" -
>> >> > Pierre Abelard
>> >> >
>> >> > "If the probability be called P; the injury, L; and the burden, B;
>> >> > liability depends upon whether B is less than L multiplied by
>> >> > P: i.e., whether B is less than PL."
>> >> > United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947]
>> >> >
>> ===============================================================
>> >> > Updated 1/26/04
>> >> > CSO/DIR. Internet Network Eng. SR. Eng. Network data security
>> >> > IDNS. div. of Information Network Eng. INEG. INC.
>> >> > E-Mail jwkckid1@xxxxxxxxxxxxx
>> >> > Registered Email addr with the USPS
>> >> > Contact Number: 214-244-4827
>> >> >
>> >> >
>> >>
>> >> --
>> >> Leah G.
>> >> http://forums.delphiforums.com/atlargeorg
>> >> http://forums.delphiforums.com/domainwatch
>>
>> JW> Regards,
>>
>> JW> --
>> JW> Jeffrey A. Williams
>> JW> Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
>> JW> "Be precise in the use of words and expect precision from others" -
>> JW> Pierre Abelard
>>
>> JW> "If the probability be called P; the injury, L; and the burden, B;
>> JW> liability depends upon whether B is less than L multiplied by
>> JW> P: i.e., whether B is less than PL."
>> JW> United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947]
>> JW> ===============================================================
>> JW> Updated 1/26/04
>> JW> CSO/DIR. Internet Network Eng. SR. Eng. Network data security
>> JW> IDNS. div. of Information Network Eng. INEG. INC.
>> JW> E-Mail jwkckid1@xxxxxxxxxxxxx
>> JW> Registered Email addr with the USPS
>> JW> Contact Number: 214-244-4827
>>
>> ----
>> Don Brown - Dallas, Texas USA Internet Concepts, Inc.
>> donbrown_l@xxxxxxxxxxxxxxxx http://www.inetconcepts.net
>> (972) 788-2364 Fax: (972) 788-5049
>> ----
JW> Regards,
JW> --
JW> Jeffrey A. Williams
JW> Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
JW> "Be precise in the use of words and expect precision from others" -
JW> Pierre Abelard
JW> "If the probability be called P; the injury, L; and the burden, B;
JW> liability depends upon whether B is less than L multiplied by
JW> P: i.e., whether B is less than PL."
JW> United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947]
JW> ===============================================================
JW> Updated 1/26/04
JW> CSO/DIR. Internet Network Eng. SR. Eng. Network data security
JW> IDNS. div. of Information Network Eng. INEG. INC.
JW> E-Mail jwkckid1@xxxxxxxxxxxxx
JW> Registered Email addr with the USPS
JW> Contact Number: 214-244-4827
----
Don Brown - Dallas, Texas USA Internet Concepts, Inc.
donbrown_l@xxxxxxxxxxxxxxxx http://www.inetconcepts.net
(972) 788-2364 Fax: (972) 788-5049
----
<<<
Chronological Index
>>> <<<
Thread Index
>>>
|