Tagged Questions
0
votes
0answers
112 views
Examples of vulnerabilities being changed in only one (of many) places [closed]
I'm looking into source code analysis and was wondering if folks know of examples, in open source projects, of vulnerabilities where there were multiple "very similar" vulnerabilities in the same ...
8
votes
3answers
699 views
Example of a backdoor submitted to an open source project?
To clarify immediately, I'm not interested in writing a backdoor. I have no interest in submitting backdoor changelists to projects myself.
I'm researching some source modeling techniques, and we're ...
2
votes
2answers
302 views
Is it a weakness to be able to see server side scripting?
Are languages such as Cold Fusion and PHP less secure because they are embedded in HTML which is sent to a client? Someone told me they are less secure because they lack abstraction.
CLARIFICATION: ...
10
votes
2answers
191 views
security implications of NULL dereference
Suppose we have code like this:
struct somedata {
int a;
int b;
};
struct somedata *data;
/* ... */
data = malloc(sizeof(struct somedata));
data->a = something;
Now, as you can see, NULL ...
4
votes
3answers
378 views
How do I protect myself against the attacks in this php script?
Due to a vulnerability in how PHP was installed (Shared VPS with PHP installed as an Apache module instead of CGI) and hence how OSCommerce was configured (with security of 777 on certain ...
31
votes
8answers
2k views
Should I bother teaching buffer overflows any more?
The students are skeptical that turning off non-executable stacks, turning off canaries and turning off ASLR represents a realistic environment. If PaX, DEP, W^X, etc., are effective at stopping ...
48
votes
18answers
3k views
What security resources should a white-hat *developer* follow these days?
What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days?
Do Include:
Late breaking information on new security issues (RSS, Twitter, etc)
A website that ...
