A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

4
votes
1answer
94 views

Does mutual SSL authentication increases protection against a Poodle attack?

Recently we found our self pondering whether a certificate based mutual SSL authentication protects against a Poodle attack over SSLv3? We’re stuck in a situation where a client-application only ...
5
votes
2answers
509 views

TrueCrypt vs BitLocker

I would like to ask which one of these TrueCrypt or BitLocker is safer to implement and encrypt the data in a small business environment (Windows 7, 8.1 and Windows Server 2012r) I read about ...
0
votes
2answers
137 views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
2
votes
1answer
41 views

DNS Rebinding attack - does this attack require victim to use an attacker's DNS server for resolution? How will that happen?

Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS ...
3
votes
3answers
83 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character on realtime so when i input the following code: <input onclick=alert(document.cookie)> there ...
1
vote
1answer
102 views

Is native app vulnerable to FREAK attack? If yes, how to detect it as a user?

When I research about FREAK attack, most of them explain about the server and browser vulnerability, but how about native apps (e.g. Windows executable program, mobile apps)? From Mark's answer on ...
3
votes
1answer
151 views

If a web server only has a 2048-bit RSA key, can a FREAK based attack still happen?

I think I'm missing something with the FREAK SSL vulnerability. I understand that the MITM server requests the RSA EXPORT ciphersuite which is limited to a 512-bit key (which in turn is feasible to ...
0
votes
1answer
2k views

FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack. reference- ...
1
vote
2answers
185 views

Why are some attacks more famous than others (heartbleed, BEAST, POODLE, etc)?

Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs. Is it because they have a cool name and a logo, or is the CVE severity metric somewhat ...
4
votes
1answer
449 views

POODLE and TLS…not SSL

In December there was a new attack surface of POODLE against TLS 1.0 (think this also covers 1.1 and 1.2?). Anyway, as a system administrator for Windows Server 2008/2012 what can we do do prevent ...
1
vote
2answers
121 views

How to test the php vulnerability CVE-2014-3515

How to test if I'm vulnerable regarding CVE-2014-3515? My vendor supplied me with a patch and verified that it installed however I would like to verify that I am no longer vulnerable. My vendor ...
3
votes
2answers
429 views

List of most common network vulnerabilities a la OWASP Top 10 [closed]

I am trying to find the most commonly used attack vectors/techniques on computer networks in the style of the owasp top 10, for my thesis work. The reports shouldn't be older than 2-3 years. Can you ...
2
votes
0answers
85 views

Case Studies of high profile hacks [closed]

Every hack happens because of a form of security vulnerability or another, and I feel that the best way to avoid/fix these vulnerabilities is to learn about them. Is there anywhere on the internet ...
1
vote
1answer
287 views

POODLE vulnerability solution : Effect on customer or client side

I am using windows server 2008 R2 and I have lot of customers who use windows XP,7 and 8 with some of them still using IE6. So now I want to disable SSL3 and enable TLS 1.1 as a security measure for ...
2
votes
2answers
108 views

Fuzzing and its impact on testing environment

I asked this question on StackOverflow but got no answers so I thought that I would try my luck here since fuzzing is closely related to security and often used in vulnerability assessment tests. I'm ...
3
votes
2answers
501 views

How to exploit via Metasploit vulnerabilities found with Nessus?

I am new in the field and trying to pentest a php web app locally stored on my host pc using metasploit from a kali vm. I have run some scanners like wmap,OpenVAS and Nessus and found some ...
2
votes
1answer
235 views

Why Shellshock works in useragent string?

I was wondering why Shellshock works when put in the useragent. Based on what I could find it is because a web server (e.g Apache) uses the useragent string in its internal working. Why would a ...
2
votes
1answer
251 views

Are Java applications vulnerable to CVE-2014-6321 (WinShock)?

CVE-2014-6321 (also known as MS14-066) is a heap overflow vulnerability discovered by Microsoft engineers in Schannel, the SSL/TLS implementation used by Windows. My Java application uses SSL (JSSE ...
-3
votes
1answer
91 views

Buffer overflow without using environment variables [closed]

I was trying to overflow buffers and I was wondering , Is there anyway to do a buffer overflows without using environment variables ?
1
vote
2answers
391 views

SSLv3 cannot be disabled, can I use weak cipher as a workaround?

We're using lighttpd 1.5.0-2349 which unfortunately doesn't support the option to disable SSLv3. I think a potential workaround would be to only allow it to use some cipher which has already been ...
6
votes
3answers
5k views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
1
vote
0answers
270 views

Windows OLE Vulnerability CVE-2014-4114 “Sandworm”

Just heard about a new vulnerability and am using the same format as the POODLE guy for this one. What is the Sandworm vulnerability? I use [product/browser]. Am I affected? Is [product] ...
3
votes
1answer
296 views

Performing POODLE attack

I trying to perform POODLE attack on a hosted server that I've configured to support only SSLv3. The scenario is I logged on my server and it sends the cookie in response that will be stored by the ...
1
vote
2answers
247 views

POODLE vulnerability in major social networking

Social networking is a corner stone for a majority of our daily lives, be it communicating with friends, sharing photos or even using social networking for advertising and business promotion. Whilst ...
201
votes
4answers
83k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What ...
2
votes
1answer
126 views

Is this somebody trying to exploit a vulnerability?

On our website, when an invalid PHP session ID is detected, it's logged and regenerated. This invalid session has been logged: n040jl1nujch72tkrmr0uilnl1, ...
-1
votes
1answer
110 views

Shellshock vulnerability for pc inside LAN

A common pc running bash inside a home LAN network (with a router/gateway providing internet access to the LAN) does not have any contact with the external internet, except browser navigation and the ...
1
vote
1answer
353 views

Exploiting shellshock

On doing some digging on the shell shock vulnerability, I found that being able to run the exploit via a remote location depends on whether the attacker actually knows the exact cgi script which uses ...
-2
votes
1answer
985 views

The correct way to check for vulnerability CVE-2014-7169 (aftershock)

I found two ways of checking for the vulnerability CVE-2014-7169 (aftershock or taviso bug) bashcheck uses: cd /tmp;rm echo 2>/dev/null X='() { function a a>\' bash -c echo 2>/dev/null > ...
9
votes
1answer
906 views

Example of how the remaining shellshock bash bug CVE-2014-7169 (taviso bug) could be exploited?

I have a general idea about the Shellshock bash bug (CVE-2014-6271 reported Sep 24, 2014) of what the vulnerability is and how it could be exploited. Here you find examples on how to exploit the ...
11
votes
5answers
1k views

Is replacing bash with another shell a prudent step?

Considering that RedHat and other major teams in business are conducting an audit in bash and have uncovered a few other vulnerabilities besides -7169 (-7186 and -7187), is it sensible to link /bin/sh ...
0
votes
0answers
327 views

How are you able to inject bash script through the user agent

I was looking over the new Bash exploit and was looking at this post in particular. Attack scenarios of the new Bash vulnerability What I don't understand is how does including bash in the ...
21
votes
1answer
8k views

Attack scenarios of the new Bash vulnerability [duplicate]

Odds are that you're already aware of the newly discovered Bash bug. It can be tested using env x='() { :;}; echo vulnerable' bash -c "echo this is a test". What yet I haven't understand is, what ...
184
votes
5answers
106k views

What is a specific example of how the Shellshock Bash bug could be exploited?

I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could ...
-2
votes
1answer
88 views

Best and most current sites for security breaches [duplicate]

I'm taking my masters in cyber-security and as a student I come across a lot of garbage when doing research. What are sites with the latest security breaches? Thanks for the help in advanced. My ...
4
votes
4answers
307 views

Vulnerability exploitation in Java

I am not intimately familiar with Java, so this could be a stupid question. In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context ...
1
vote
0answers
56 views

use after free vulnerability [closed]

I am struggling trying to understand use after free vulnerabilities, can someone explain it for me with C language source code, and how it can be used to write to arbitary memory location or to cause ...
1
vote
2answers
70 views

secure flash update

The default method for updating flash is through Adobe's unsecured http portal, which seems to be a serious security concern, given the access that flash has on a user's machine. Can anyone recommend ...
0
votes
0answers
75 views

Find the location of a hidden host

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
2
votes
2answers
278 views

Why is Un1c0rn exposing wget on heartbleed?

What's the point of spotlighting wget on heartbleed dumps? I'm specifically talking about this which is the first page of wget occurencies in heartbleed dumps. They put this page as a link on the ...
1
vote
2answers
184 views

Is php DOMDocument::loadXML completely secure?

Our application is using loadXML extensively to recieve data(input) from the users. Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using ...
5
votes
3answers
702 views

Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation”

I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me. In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
5
votes
0answers
40 views

Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation” [duplicate]

I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me. In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
0
votes
0answers
92 views

Is OpenSSL 0.9.8h affected by CVE-2014-0195?

I have spent time on finding out if OpenSSL 098h is affected by the CVE-2014-0195 ..but it seems I will have to understand the entire file d1_both.c to answer this question. 1) Preliminary look at ...
3
votes
8answers
602 views

Are URL shorteners “vulnerable” due to open redirects?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
1
vote
1answer
379 views

Cannot get access into a vulnerable Windows 2000 (MS03_026)

I'm trying to get access into a Windows 2000 server through the vulnerability MS03_026. An exploit is provided by Metasploit but I don't know why it isn't working. After filling the options (basically ...
0
votes
2answers
77 views

Which mechanism did Flame use to avoid being identified?

I got a question that says "What is the major difference in the USB propagation system used by Flame with regard to Stuxnet to prevent being identified?". After Googling for a while, I haven't found ...
-1
votes
1answer
226 views

BigDump v0.35b vulnerability [closed]

I dont understand what the problem with BigDump v0.35b. This site says that it have problem. But i dont understand it. Problem here? if (!$error && isset($_REQUEST["uploadbutton"])) { if ...
1
vote
1answer
67 views

How does the ruby vulnerability affect me?

Visiting this site: http://ruby-doc.org/ I get this message: There were 3 Ruby vulnerability reports in the last 14 days. 2 high, 1 medium. Most recent: CVE-2013-4562. See details. I only ...
2
votes
1answer
2k views

TLS v 1.1 vulnerabilities

My question concern TLS : What are the main vulnerabilities of TLS v1.1 ? Actually, none RFC describes v1.1 vulnerabilities, neither what pushed them to change to the new protocol 1.2 except ...