Re: [PEN-TEST] ports

["Frasnelli, Dan" <dfrasnel () COREWAR COM>]

> A bit busy at the moment, so hopefully this 'quick' explanation
> is sufficient.

"Haste makes waste" or something like that.

> Just some trivia you may not know about X11 forwarding:
> - the X11 traffic is not sent through an encrypted channel
> - a remote user can 'spy' on an ssh session under certain
>   circumstances by reading off those ports (ie. xkey).

My apologies to the list for this inaccurate information..
I recognized the mistake after sending, but it was too late.

The above pertains to older/misconfigured versions of ssh.
With Data Fellows on-site at my workplace at the time,
we discovered the second 'confidentiality' bug.
It is difficult to exploit and requires information not
readily available to remote users.  The vulnerability
occurs when cookies fail and authentication falls back
to ip-only.

No the report is not available, and yes current versions
are not vulnerable.

-dan