Tag Info

New answers tagged

0

Typically you verify a vulnerability in three ways: Run exploit code. Did it blow up? Check your package manager's documentation. Do you have their version? Check the code. Do you have the affected lines? Since #3 is not effective for binaries, and you do not want to run exploit code, your other option is updating. I'd imagine by now that every distro ...


2

If you just want to block a specific IP: iptables -A INPUT -s 1.2.3.4 -j DROP You can't reject a TCP connection which has the later intent of visiting a particular URL, because the TCP connection has to be made before that information can be transferred. To be honest, I wouldn't worry about it. It's probably a drive-by attack against a random plugin or ...


1

If the exploits triggers an arbitrary code execution, you are compromised as soon as you read the trapped webpage. Since it's a 0-day there are no strict way of detecting the attack, or avoiding it (no patch, no known signature, no known behaviours) The possible ways to avoid this would be: running an resident anti-virus that can monitor your computer ...


1

If an attacker has a sandbox-bypassing 0day exploit, there is little you can do. The best way of preventing this from happening is having good web-browsing hygiene. Things you can do to limit your risk of infection: Run an Add blocker (advertisements are often targetted as they're widespread across different websites) Run no-script plugin (to prevent ...


1

The string provided does appear to be an attempt to exploit the Shellshock vulnerability. With cgi disabled your attack surface should be reduced. With regards to countermeasures, patching to address the issue would be the most effective approach. The following links provides guidance on assessing whether your installation is vulnerable, as well as steps ...


1

Detection is fairly easy and a well-known problem that your security and incident event monitoring solutions (SIEM) should be able to shine light on, AlienVault (OSSIM) is an example of such a solution, as is Prelude, via event correlation. It's worth keeping up on correlation as an art unto itself: ...



Top 50 recent answers are included