Bug#631213: O: arp-scan -- arp scanning and fingerprinting tool

2011-06-28 Thread Tim Brown
On Tuesday 21 June 2011 15:56:10 Rene Mayorga wrote: > Package: wnpp > Severity: normal > > The current maintainer of arp-scan, Tim Brown , > is apparently not active anymore. Therefore, I orphan this package now. > > Maintaining a package requires time and skills. P

Bug#570621: Parsing output = derivative work? (was: RFS: gnetworktester)

2011-03-06 Thread Tim Brown
ap folk to get something both we and they= =20 feel comfortable with. I can probably dig out some references from our and= =20 their mailing lists too if necessary. Tim =2D-=20 Tim Brown <mailto:t...@65535.com> --nextPart2958378.qgascxSZ95 Content-Type: application/pgp-signature; name=si

Bug#299007: Insecure PATH in /root/.profile

2011-01-31 Thread Tim Brown
consequence of it? > > > > It's waiting for someone to do the work required to come up with a > > transition plan. No one so far has had time and interest to work on it. > > The details of what needs to be done at a high level are covered in the > > open Policy bug. &g

Bug#597312: [Openvas-distro-deb] Bug#597312: openvas-server: [INTL:it] Italian translation of the debconf templates

2010-10-05 Thread Tim Brown
On Saturday 18 September 2010 16:52:22 Vincenzo Campanella wrote: > Package: openvas-server > Version: 2.0.3-3 > Severity: wishlist > Tags: l10n patch > > Enclosed please find the updated Italian translation of the Debconf > template. This has been committed to trun

Bug#525975: Fwd: Re: Duplicate bug

2009-11-01 Thread Tim Brown
As per a suggestion on #debian-mentors I've noted that the same bug was filed upstream by me (http://bugs.kde.org/show_bug.cgi?id=204849) and that I have submitted a patch on the upstream bug to fix the described problem. Tim -- Tim Brown <mailto:t...@nth-dimension.org.uk> <

Bug#481297: Bug#481296: Bug#481297: any progress on oui.txt unification?

2009-02-17 Thread Tim Brown
e time the bug was files I contacted the upstream for it and he was vauguely interested in splitting it out.. but noone else seemed massively fussed so I didn't push the matter. Tim -- Tim Brown <mailto:t...@nth-dimension.org.uk> <http://www.nth-dimension.org.uk/> -- To UNSUB

Bug#491114: Work around confirmation

2008-07-17 Thread Tim Brown
> /etc/udev/rules.d/65_dmsetup.rules needs to be changed so that the three first lines all have GOTO="device_mapper_end". Confirmed that this resolves the problem. Cheers, Tim -- Tim Brown <mailto:[EMAIL PROTECTED]> <http://www.nth-dimension.org.uk/> -- To UNS

Bug#481296: Please coordinate the oui.txt file at some common shared place

2008-05-25 Thread Tim Brown
ou be interested in making this feature request happen? Tim -- Tim Brown <mailto:[EMAIL PROTECTED]> <http://www.nth-dimension.org.uk/> -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Bug#481296: Please coordinate the oui.txt file at some common shared place

2008-05-25 Thread Tim Brown
work with them to resolve the issue there. Tim -- Tim Brown <mailto:[EMAIL PROTECTED]> <http://www.nth-dimension.org.uk/> -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Bug#480578: irpas Build-Depends incorrect?

2008-05-10 Thread Tim Brown
Package: irpas Version: 0.10-4 Severity: important Justification: fails to build from source irpas now requires Build-Depends libpcap0.7-dev, rather than libpcap-dev. When this change is made, it will then build on amd64. -- System Information: Debian Release: lenny/sid APT prefers unstable

Bug#466146: festival: Default configuration allows unauthenticated remote code execution

2008-03-01 Thread Tim Brown
On Saturday 01 March 2008 14:44:01 Nico Golde wrote: > Hi Tim, > > * Tim Brown <[EMAIL PROTECTED]> [2008-03-01 15:28]: > > On Tuesday 19 February 2008 20:12:29 Nico Golde wrote: > > > > It > > > > probably also needs rewording since SuSE confirmed it

Bug#466146: festival: Default configuration allows unauthenticated remote code execution

2008-03-01 Thread Tim Brown
t works. I've attached a patch that I think resolves this issue on stable - no warranties. Just wanted to make this final email as I'm intending to release my advisory shortly subject to any updates here. Tim -- Tim Brown <mailto:[EMAIL PROTECTED]> <http://www.nth-dimension.o

Bug#466146: festival: Default configuration allows unauthenticated remote code execution

2008-02-19 Thread Tim Brown
On Tuesday 19 February 2008 19:20:23 Nico Golde wrote: > * Tim Brown <[EMAIL PROTECTED]> [2008-02-19 20:08]: > > I've just notice that the security tracker > > http://security-tracker.debian.net/tracker/status/release/unstable has > > been updated for festival. Ho

Bug#466146: festival: Default configuration allows unauthenticated remote code execution

2008-02-19 Thread Tim Brown
Nico, I've just notice that the security tracker http://security-tracker.debian.net/tracker/status/release/unstable has been updated for festival. However it is wrong. This bug *is* remotely exploitable (due to the afore mentioned lack of ACLs). Tim -- Tim Brown <mailto:[EMAIL P

Bug#466146: festival: Default configuration allows unauthenticated remote code execution

2008-02-19 Thread Tim Brown
vious bug history there was some discussion about disabling the system command too, but IMO this does little to fix the underlying problem of an unauthenticated scheme interpreter bound to a remote port with no ACLs or authentication. Tim -- Tim Brown <mailto:[EMAIL PROTECTED]> <

Bug#466146: festival: Default configuration allows unauthenticated remote code execution

2008-02-18 Thread Tim Brown
be pushed to unstable and backported to stable security. Tim -- Tim Brown <mailto:[EMAIL PROTECTED]> <http://www.nth-dimension.org.uk/> -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Bug#466146: festival: Default configuration allows unauthenticated remote code execution

2008-02-17 Thread Tim Brown
On Monday 18 February 2008 01:40:00 Kumar Appaiah wrote: > On Sun, Feb 17, 2008 at 05:32:44PM +0000, Tim Brown wrote: > > I've just built it here. It is lintian clean and the patch provides the > > required security fix. However 2 small points, 1) The logging doesn&#x

Bug#466146: festival: Default configuration allows unauthenticated remote code execution

2008-02-17 Thread Tim Brown
as this is a security bug. Another thought, the fix will require backporting to stable so that it can go into the security updates. Tim -- Tim Brown <mailto:[EMAIL PROTECTED]> <http://www.nth-dimension.org.uk/> -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "u

Bug#466146: festival: Default configuration allows unauthenticated remote code execution

2008-02-17 Thread Tim Brown
t work as /var/log/festival isn't created (and owned by festival,audio) 2) Passwords are displayed by debconf rather than hiding them with *'s. I'm only a fellow maintainer, but I'm sure your mentor can provide appropriate feedback on these issues. Cheers, Tim -- Tim Brown <m

Bug#466146: festival: Default configuration allows unauthenticated remote code execution

2008-02-16 Thread Tim Brown
escalation attacks. Tim -- Tim Brown <mailto:[EMAIL PROTECTED]> <http://www.nth-dimension.org.uk/> -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Bug#466146: festival: Default configuration allows unauthenticated remote code execution

2008-02-16 Thread Tim Brown
Package: festival Version: 1.96~beta-5 Severity: critical Tags: security Justification: root security hole Nth Dimension Security Advisory (NDSA20080215) Date: 15th February 2008 Author: Tim Brown <mailto:[EMAIL PROTECTED]> URL: <http://www.nth-dimension.org.uk/> / <http://www

Bug#435456: ITP: openvas-client -- Remote network security auditor, the client

2007-07-31 Thread Tim Brown
Package: wnpp Severity: wishlist Owner: Tim Brown <[EMAIL PROTECTED]> * Package name: openvas-client Version : 0.9.1 Upstream Author : OpenVAS <[EMAIL PROTECTED]> * URL : http://www.openvas.org/ * License : GPL Programming Lang: C Description

Bug#433472: ITP: dirbuster -- Directory & file brute forcing, with a twist

2007-07-17 Thread Tim Brown
ces - the lists are generated from crawling the net, so are based on real file/directory names used by developers * Auditing dynamic applications where URLs don't necessarily map on to files * Auditing web server ACLs * Load testing - it can produce up to 6000 requests/second I'd also poi

Bug#433472: ITP: dirbuster -- Directory & file brute forcing, with a twist

2007-07-17 Thread Tim Brown
Package: wnpp Severity: wishlist Owner: Tim Brown <[EMAIL PROTECTED]> * Package name: dirbuster Version : 0.9.7 Upstream Author : James Fisher <[EMAIL PROTECTED]> * URL : http://sourceforge.net/projects/dirbuster/ * License : LGPL Programmin

Bug#415036: ITP: arp-scan -- arp scanning and fingerprinting tool

2007-03-15 Thread Tim Brown
Package: wnpp Severity: wishlist Owner: Tim Brown <[EMAIL PROTECTED]> * Package name: arp-scan Version : 1.5 Upstream Author : Roy Hills <[EMAIL PROTECTED]> * URL : http://www.nta-monitor.com/tools/arp-scan/ * License : GPL Programming Lang: C

Bug#414534: ITP: sucrack -- multithreaded su bruteforcer

2007-03-13 Thread Tim Brown
On Monday 12 March 2007 18:25, Joerg Jaspert wrote: > On 10956 March 1977, Tim Brown wrote: > > Why package it? Other than the practical uses outlined above, because > > having binaries on a system outside of the package management system is a > > PITA to keep track of

Bug#414534: ITP: sucrack -- multithreaded su bruteforcer

2007-03-12 Thread Tim Brown
k or so). Personally, I am English. Through my day job, I have clarification regarding changes to UK law that might affect this tool and we have had assurances that legitimate security researchers and the tools they develop will not be targetted here in the UK. Tim -- Tim Brown <m

Bug#414534: ITP: sucrack -- multithreaded su bruteforcer

2007-03-12 Thread Tim Brown
"john")? John actually requires you have access to the hashed / encrypted passwords. Since sucrack drives a console tool (by default su) it can be used in places where John can't - for example auditing SSH key phrases, or where the penetration tester is attempting to escalate privile

Bug#414534: ITP: sucrack -- multithreaded su bruteforcer

2007-03-12 Thread Tim Brown
On Monday 12 March 2007 16:08, Hendrik Sattler wrote: > Am Montag 12 März 2007 12:30 schrieb Tim Brown: > > Package: wnpp > > Severity: wishlist > > Owner: Tim Brown <[EMAIL PROTECTED]> > > > > * Package name: sucrack > > Version : 1.1 &

Bug#414534: ITP: sucrack -- multithreaded su bruteforcer

2007-03-12 Thread Tim Brown
On Monday 12 March 2007 13:02, Marco d'Itri wrote: > On Mar 12, Tim Brown <[EMAIL PROTECTED]> wrote: > > sucrack is a multithreaded Linux/UNIX tool for cracking local user > > accounts via wordlist bruteforcing su > > What is the point of packaging this? I'

Bug#414534: ITP: sucrack -- multithreaded su bruteforcer

2007-03-12 Thread Tim Brown
On Monday 12 March 2007 13:57, Marco d'Itri wrote: > On Mar 12, Tim Brown <[EMAIL PROTECTED]> wrote: > > I'm packaging a bunch of security tools that I use in my job pen testing. > > I do not understand how you would use such a tool in packaged form. > If you ca

Bug#414534: ITP: sucrack -- multithreaded su bruteforcer

2007-03-12 Thread Tim Brown
Package: wnpp Severity: wishlist Owner: Tim Brown <[EMAIL PROTECTED]> * Package name: sucrack Version : 1.1 Upstream Author : Nico Leidecker <[EMAIL PROTECTED]> * URL : http://www.leidecker.info/ * License : GPL Programming Lang: C