A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.

learn more… | top users | synonyms

4
votes
1answer
720 views

Hubs, Switches, and Bridges - Flaws and Security Superiority

It just isn't clear to me which choice is good for creating small/intermediate networks. I know one of flaws of Hubs is that they send all packets to all nodes connected to it, in contrast to Switch ...
-2
votes
2answers
137 views

Under what circumstances can two computers receive packets at the same public IP address? [closed]

Under what circumstances could two completely different machines receive packets at the same class C IP address that is not within the IANA-reserved private IPv4 network ranges?
1
vote
1answer
9k views

Microsoft Windows RPC (135/tcp) security risks

I was running a vulnerability scan against a Windows Server of mine, TCP port 135. I got the following output: By sending a Lookup request to the portmapper TCP 135 it was possible to enumerate ...
8
votes
2answers
4k views

Implications of Trace/Track Methods on Apache

When performing vulnerability scans using Nessus, against a host running Apache, one expected result is always "HTTP TRACE / TRACK Methods Allowed". While this result only has a base CVSS of 4.3, I ...
5
votes
2answers
382 views

Dangerous hardware ports?

Using Passware Forensic Toolkit you can extract the bitlocker key using live memory dumping through Firewire (either by using an existing Firewire port, or by inserting an pcmcia/expresscard ...
3
votes
1answer
396 views

WPA vulnerabilities for pentest

As I am a network&IT enthusiast, I was asked by a friend to pentest his WPA network. I'm wondering if there is anything else I can do beside a bruteforce attack, trying the KARMA attack on ...
14
votes
2answers
1k views

Flaw in encryption through pseudorandom number stream (from gpg documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
5
votes
2answers
299 views

Advice for writing my first application security review

I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The ...
2
votes
3answers
1k views

Vulnerabilities of RFID Smartcards

Recently my organization wants to move into the smart card system instead of static password. We want to move the entire infrastructure to the smartcard system. we are looking for a single smartcard ...
3
votes
3answers
542 views

Are there known hacks or security problems on broadband USB dongles?

USB broadband dongles seem to be common everywhere now though I'm not sure what the most widely accepted name for them is. In case I'm using poor terminology I'm referring to USB sticks which contain ...
7
votes
4answers
10k views

Security issues with allowing Dropbox installations on client PC's in our organisation

Does anyone know if there is any good reasons not to allow Dropbox installations on our client PC's? All the PC's have antivirus installed and running. I know it is an additional attack vector to ...
1
vote
3answers
292 views

Is there a security problem accessing my laptop via WIFI?

I'm developing a web application for mobile devices on my local server in my laptop. My laptop is connected to company network via LAN. And, my project manager, wants to check the web application ...
11
votes
1answer
1k views

SSL TLS renegotiation vulnerability - current situation in clients

Reading about the SSL renegotiation problem CVE-2009-3555 one knows that servers supporting old type of renegotiation are vulnerable to data injection. We also have tools to test them (openssl ...
7
votes
1answer
639 views

Is MediaWiki viable for sensitive information?

I was under the impression that MediaWiki, due to its nature as "open for all Wiki platform", is not tailored towards managing sensitive information. I found some warnings about this on the MediaWiki ...
0
votes
3answers
2k views

Dropbox vulnerability details

Dropbox (the online cloud storage provider) was recently in the news for some security and privacy vulnerabilities. What was the problem, and what has been done to resolve it?
13
votes
2answers
951 views

Can Windows malware harm a Linux computer when it's executed with Wine?

I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables. I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
4
votes
3answers
646 views

SCADA Operating System & Security Exploits

So I have a basic question on the SCADA operating system, which the manufacturers do not disclose. From my experience I can see VxWorks running in some of them, and Windows or Linux in some of them. ...
12
votes
2answers
461 views

HSM track records?

What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?
7
votes
2answers
671 views

What risks are inherent with connecting to an untrusted public key server?

Thomas Pornin brought up a good point about PGP key servers in an answer to a recent question, here: Shouldn't GPG key fetching use a secure connection? ...you should not trust the key ...
5
votes
6answers
453 views

Determining vulnerable software on client machines

I am interested in how attackers manage to identify vulnerable versions of software on client machines, behind a large network or stand alone at home. I am not interested in portscanning at all, as ...
8
votes
2answers
559 views

Recent Facebook XSS exploit details

There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...
4
votes
2answers
2k views

Command line Nessus/OpenVAS or NSE to find specific vulns?

Which methods do you use to quickly scan a network for certain vulnerabilities? I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
6
votes
5answers
571 views

Naming convention based exploits

The book Web Hacking Exposed has a number of instances where the attacker would essentially use patterns in naming conventions to design attacks. Can any one point me to any study on ...
0
votes
1answer
333 views

What is the “Australian Failure”?

In the notes for my Computer Security course, the lecturer refers to the "Australian Failure" on slide 19. I'm assuming he's referring to a well known security system failure, but I can't find what it ...
7
votes
3answers
993 views

Exploit-db like websites, where people can search for security bugs

If someone has to decide between 2 very similar server programs, or operating systems, then it searches on sites like: http://www.exploit-db.com/search/ so that there he could get enough ...
7
votes
4answers
4k views

OpenBSD vs. NetBSD security

If i search for the two words: OpenBSD and NetBSD on: http://www.exploit-db.com/ then i get 17 hits regarding security bugs on OpenBSD, and 8 hits regarding security bugs on NetBSD. So what are ...
6
votes
2answers
560 views

Where can I find a list of un-patched CVEs for a specific piece of software?

Is there a database of vulnerabilities somewhere, that can be queried in such a way as to return results for all non-patched vulnerabilities for a specific piece of software? For example, I would ...
6
votes
2answers
2k views

Known security vulnerabilities in JBoss 4.x.x?

We just had a breach of one of our servers, where an intruder got access using the JBoss account and started running exploit scripts. The server has been taken offline and is being investigated, but ...
9
votes
3answers
1k views

How can I mitigate the threat that DPAPick poses to my DPAPI protected data?

The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications). DPAPick was presented at BlackHat ...
16
votes
7answers
499 views

which site do you use to view details of vulnerabilities?

Which site/sites do you guys use to view details of security vulnerabilities?
23
votes
6answers
394 views

How to keep an eye on upgrades, patches and security issues for used open-source libraries?

For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
4
votes
3answers
296 views

Strategy against browser exploits on Windows?

On a friend's computer is some kind of spam bot installed. It sends messages like Hello: I received my apple iPad 32GB ordered on an online shop (www.elevalley.com ) today. So exciting ...
20
votes
6answers
1k views

Is there a guide of general/common IT vulnerabilities?

I'm looking for an updated and comprehensive guide of general/common IT vulnerabilities (general information). I do not want you to do the job for me, I just want to point me in the right direction: ...
10
votes
2answers
407 views

Risks of Using Google Native Client

I was wondering if there were any possible risks in using Google Native Client. I know it is sandboxed, but the idea still seems risky, and at least leaves another route open for compromising your ...
7
votes
4answers
324 views

How big is the risk, to enable scripting in the Web browser?

While browsing the web, many websites executes scripts (mainly javascript) that are executed without the user noticing. How big is the risk, to get Malware unnoticed while surfing with scripting ...
22
votes
4answers
3k views

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
22
votes
10answers
3k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
15
votes
5answers
979 views

Is Google Chrome a better secured browser?

I was amazed that IE 8, Safari, Firefox were hacked so fast. Is it really Chrome so good or it was not tested? Has anyone other results of independent investigations about security of web browsers? ...
20
votes
8answers
1k views

What cryptographic algorithms are not considered secure?

What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
9
votes
3answers
7k views

Which webserver is more secure, Apache, nginx or lighttpd?

We are trying to decide which webserver to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?