A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

3
votes
2answers
4k views

FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack. reference- ...
2
votes
0answers
89 views

Where to search for vulnerabilities in a WordPress theme? [closed]

I have been doing research on a custom WordPress theme. I'm not very familiar with this CMS and how it works on the inside: where should I start my security analysis? Should I look for SQL Injection ...
2
votes
1answer
598 views

Is the 'SUIDGuard' patch safe to implement?

Can someone who really knows what they're looking at advise whether the patch published here by Stefan Esser is in fact safe to install? While I'm very concerned that Apple haven't published an ...
3
votes
2answers
101 views

Where to check if a specific OS / service is vulnerable despite being patched, because of a vendor's decision?

I need to discuss how to mitigate the risk of services which are vulnerable despite being patched (typically because they are not maintained by the vendor anymore, or because the vendor does not want ...
10
votes
1answer
5k views

.JPEG File upload shell via EXIF comments

I came across this advisory recently and I'm a bit confused by both exploits, but specifically the file upload vulnerability. I don't understand how to actually exploit this condition (or even why ...
2
votes
3answers
121 views

Temporary XSS Vulnerability

I found xss on a textarea field. When you enter a character to this field it output the character in real time so when I input the following code: <input onclick=alert(document.cookie)> there ...
2
votes
2answers
142 views

Does the CVSS impact score correspond to probability?

From http://nvd.nist.gov/cvsseq2.htm, I noticed that the CVSS standard attributes the following impact values ​​for confidentiality, integrity and availability: 0 for none impact, 0.275 for ...
4
votes
4answers
11k views

Is diskcryptor really secure?

Diskcryptor is an open-source competitor to TrueCrypt for Windows. It has an edge over Truecrypt for system encryption, because it allows for more than one independently encrypted system partition, ...
0
votes
0answers
101 views

How do Common Vulnerabilities and Exposures (CVEs) work?

The Common Vulnerabilities and Exposures (CVE) system is a dictionary of publicly known information security vulnerabilities and exposures in publicly released software packages. I am looking for a ...
0
votes
1answer
162 views

The way vulnerabilities like CVE-2014-4148 are discovered [duplicate]

What is the most probable way the vulnerabilities like CVE-2014-4148 are discovered? How long does it take to find such one? Are there other ways? Which is the most successful one?
2
votes
1answer
65 views

Is auto-redirecting to another site a secure defense against POODLE?

Normally, servers that support SSL 3.0 are vulnerable to the POODLE attack. But, consider a server that has the following interesting combination of features: It supports SSL 3.0. If you connect to ...
13
votes
2answers
779 views

How to make a website patch their poor security?

I am following an online class from a local institution. Recently, I've noticed they don't hash passwords because they sent me my password by e-mail in clear text. The website has a lot of personal ...
0
votes
5answers
66 views

Where can I find a description list for major vulnerabilities? [closed]

I'm looking for a description list for major vulnerabilities such as SQLi, XSS etc. The format should be like this: Short Description: Description: Impact: Solution/How to prevent: ...
0
votes
0answers
153 views

Exchange Autodiscover XML question (Exploit related)

Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. ...
6
votes
1answer
259 views

Does mutual SSL authentication increases protection against a Poodle attack?

Recently we found our self pondering whether a certificate based mutual SSL authentication protects against a Poodle attack over SSLv3? We’re stuck in a situation where a client-application only ...
2
votes
2answers
4k views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
1
vote
1answer
316 views

Security risks if a server in not supported anymore

I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements. What are the security risks that we might ...
2
votes
1answer
71 views

DNS Rebinding attack - does this attack require victim to use an attacker's DNS server for resolution? How will that happen?

Usually a preferred DNS server will be set in router's configuration and it will be either the organization's server or some trusted public server. So how would attacker get the victim to use his DNS ...
1
vote
1answer
127 views

Is native app vulnerable to FREAK attack? If yes, how to detect it as a user?

When I research about FREAK attack, most of them explain about the server and browser vulnerability, but how about native apps (e.g. Windows executable program, mobile apps)? From Mark's answer on ...
3
votes
1answer
406 views

If a web server only has a 2048-bit RSA key, can a FREAK based attack still happen?

I think I'm missing something with the FREAK SSL vulnerability. I understand that the MITM server requests the RSA EXPORT ciphersuite which is limited to a 512-bit key (which in turn is feasible to ...
1
vote
2answers
508 views

Why are some attacks more famous than others (heartbleed, BEAST, POODLE, etc)?

Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs. Is it because they have a cool name and a logo, or is the CVE severity metric somewhat ...
5
votes
1answer
2k views

POODLE and TLS…not SSL

In December there was a new attack surface of POODLE against TLS 1.0 (think this also covers 1.1 and 1.2?). Anyway, as a system administrator for Windows Server 2008/2012 what can we do do prevent ...
1
vote
2answers
330 views

How to test the php vulnerability CVE-2014-3515

How to test if I'm vulnerable regarding CVE-2014-3515? My vendor supplied me with a patch and verified that it installed however I would like to verify that I am no longer vulnerable. My vendor ...
2
votes
2answers
673 views

List of most common network vulnerabilities a la OWASP Top 10 [closed]

I am trying to find the most commonly used attack vectors/techniques on computer networks in the style of the owasp top 10, for my thesis work. The reports shouldn't be older than 2-3 years. Can you ...
3
votes
7answers
799 views

Are URL shorteners “vulnerable” due to open redirects?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
5
votes
2answers
726 views

On Hawkes' technique to bypass canaries

I found this reference to bypass canaries: http://sota.gen.nz/hawkes_openbsd.pdf It recommends to brute force the canary byte-for-byte. I don't understand how this works: "Technique is to brute force ...
33
votes
5answers
6k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
2
votes
0answers
100 views

Case Studies of high profile hacks [closed]

Every hack happens because of a form of security vulnerability or another, and I feel that the best way to avoid/fix these vulnerabilities is to learn about them. Is there anywhere on the internet ...
8
votes
3answers
11k views

Force a connection via SSL3 to detect POODLE vulnerability

I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server. The server I am currently ...
2
votes
2answers
17k views

known public exploits for vsftpd 2.0.1/2.0.5

I somehow noticed that there were numerous reports of security vulnerabilities of vsftpd 2.0.1~2.0.5; however, there just seems to be no public exploits. The server I am working on has vsftpd 2.0.5 ...
3
votes
2answers
257 views

Fuzzing and its impact on testing environment

I asked this question on StackOverflow but got no answers so I thought that I would try my luck here since fuzzing is closely related to security and often used in vulnerability assessment tests. I'm ...
5
votes
3answers
1k views

Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation”

I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me. In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
22
votes
9answers
5k views

What cryptographic algorithms are not considered secure? [closed]

What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
8
votes
1answer
979 views

Example of how the remaining shellshock bash bug CVE-2014-7169 (taviso bug) could be exploited?

I have a general idea about the Shellshock bash bug (CVE-2014-6271 reported Sep 24, 2014) of what the vulnerability is and how it could be exploited. Here you find examples on how to exploit the ...
7
votes
2answers
750 views

How stack smashing is prevented?

I just read AlephOne's paper on smashing the stack, and implemented it on my machine (Ubuntu 12.04), it was a bit old so had to take a lot of help from the internet but I enjoyed it. Now, I want to ...
3
votes
2answers
2k views

How to exploit via Metasploit vulnerabilities found with Nessus?

I am new in the field and trying to pentest a php web app locally stored on my host pc using metasploit from a kali vm. I have run some scanners like wmap,OpenVAS and Nessus and found some ...
1
vote
0answers
89 views

Find the location of a hidden host

I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
-2
votes
1answer
97 views

Best and most current sites for security breaches [duplicate]

I'm taking my masters in cyber-security and as a student I come across a lot of garbage when doing research. What are sites with the latest security breaches? Thanks for the help in advanced. My ...
2
votes
1answer
578 views

Why Shellshock works in useragent string?

I was wondering why Shellshock works when put in the useragent. Based on what I could find it is because a web server (e.g Apache) uses the useragent string in its internal working. Why would a ...
2
votes
1answer
262 views

Are Java applications vulnerable to CVE-2014-6321 (WinShock)?

CVE-2014-6321 (also known as MS14-066) is a heap overflow vulnerability discovered by Microsoft engineers in Schannel, the SSL/TLS implementation used by Windows. My Java application uses SSL (JSSE ...
1
vote
1answer
153 views

Is this somebody trying to exploit a vulnerability?

On our website, when an invalid PHP session ID is detected, it's logged and regenerated. This invalid session has been logged: n040jl1nujch72tkrmr0uilnl1, ...
-3
votes
1answer
160 views

Buffer overflow without using environment variables [closed]

I was trying to overflow buffers and I was wondering , Is there anyway to do a buffer overflows without using environment variables ?
2
votes
3answers
1k views

Open Source Vulnerability Scanner

I'm looking for an open source vulnerability scanner that I could install on one of my machines and point to all my others. Ideally, I'd be able to configure a nightly scan where all of my other nodes ...
1
vote
0answers
772 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
216
votes
4answers
95k views

SSL3 “POODLE” Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What ...
0
votes
2answers
309 views

POODLE vulnerability in major social networking

Social networking is a corner stone for a majority of our daily lives, be it communicating with friends, sharing photos or even using social networking for advertising and business promotion. Whilst ...
1
vote
2answers
464 views

SSLv3 cannot be disabled, can I use weak cipher as a workaround?

We're using lighttpd 1.5.0-2349 which unfortunately doesn't support the option to disable SSLv3. I think a potential workaround would be to only allow it to use some cipher which has already been ...
3
votes
1answer
421 views

Performing POODLE attack

I trying to perform POODLE attack on a hosted server that I've configured to support only SSLv3. The scenario is I logged on my server and it sends the cookie in response that will be stored by the ...
1
vote
0answers
309 views

Windows OLE Vulnerability CVE-2014-4114 “Sandworm”

Just heard about a new vulnerability and am using the same format as the POODLE guy for this one. What is the Sandworm vulnerability? I use [product/browser]. Am I affected? Is [product] ...
197
votes
5answers
121k views

What is a specific example of how the Shellshock Bash bug could be exploited?

I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could ...