Hot answers tagged known-vulnerabilities
49
It crashed because some input was not processed correctly. An attacker may try to find the code path that leads to the faulty procedure and attempt to execute arbitrary code through potential vulnerabilities.
Crashes may give an attacker valuable information about the system and its internal details.
Crashes may create temporary vulnerabilities or leave ...
45
CVE-2012-4969, aka the latest IE 0-day, is a based on a use-after-free bug in IE's rendering engine. A use-after-free occurs when a dynamically allocated block of memory is used after it has been disposed of (i.e. freed). Such a bug can be exploited by creating a situation where an internal structure contains pointers to sensitive memory locations (e.g. the ...
31
Apple apparently takes this seriously, since they "disabled Java" in users' computers, which is a rather drastic move. This actually smells like a pretext to kill off the technology, as part of a wider strategy.
For this specific hole, there are a few details there. It is all about the Java applet model. To understand:
Java is a programming language and a ...
29
The computer cannot guess what it is "supposed" to do. Instead, it does exactly what it is told to do -- that's what programming is about. As a corollary, computers have no initiative whatsoever, so if they are asked to do something stupid or nonsensical then they just do it.
A bug is what happens when the sequence of instruction written by the programmer ...
23
There is quite a lot of them:
Metasploitable: Currently there are 2 versions.
Kioptrix: Currently 4 challenges.
Hackademic: Apparently 2 VM, check 1 and 2.
pWnOS: Currently 2 challenges.
Standalone which you can install directly without VM, this is to hone your Webattack-Fu:
OWASP WebGoat
Damn Vulnerable Web Application
Mutillidae
19
The OS and web server with which you have the most experience are usually going to be the most secure.
Security depends on all of the layers, not just the web server. If you pick one with very few vulnerabilities, but don't understand how to configure it, you will most likely not understand how to configure it securely.
They are all mature web ...
13
As of the end of 2010, the US government deprecates these algorithms based on recommendations from the very savvy folks at NIST:
SHA-1
1024-bit RSA or DSA
160-bit ECDSA (elliptic curves)
80/112-bit 2TDEA (two key triple DES)
MD5 never was an acceptable algorithm for government use, along with many other older algorithms.
For security through the year ...
13
There used to be a "vulnerability" where the image could send a HTTP 401 Unauthenticated response, which would trigger a login screen for the user. If you set this as forum avatar, it would spawn a login popup for anyone visiting a page where your avatar appears. Lots of people will then attempt to log in with some username and password combination, probably ...
12
The vast majority of web applications do not allow query stacking. With PHP/MySQL application can allow for query stacking if you use the mysqli::multi_query()or mysqli_multi_query() functions.
You can exploit these systems using sub-select, union-selects, blind sql injection, into outfile, or loadfile(). Sqlmap is a great tool for automating these ...
12
Get a known clean version of your site and identify the differences between the known good code the and current (hacked) production code. Study how the changes may have been made and repair.
Update the passwords.
Fix the FTP certificate issue - consider using 2 factor authentication.
Find a way to scan your code for vulnerabilities - peer review or ...
12
If the only user on the database that can change records is root and your CMS uses the root user to perform queries then you have a problem. Your root user should never be used by a website.
Get a limited user which can only access the tables and records he needs to access restricted with the right permissions. If he doesn't need delete or update, then ...
11
It's not exactly a guide, but I believe CWE - Common Weakness Enumeration is excellent source of common software vulnerabilities (not just web) and it is up to date. And of course for web application, the OWASP site contains a lot of useful information about web application vulnerabilities.
11
The first point I'd make is that the number of hits on a given vulnerability/exploit db is not a reliable indicator of overall security. This could largely be defined by other factors such as the focus of security researcher's efforts or disclosure policies.
Even a quick read over the project websites provides an indicator of the likely comparative security ...
11
Canaries and other volatiles do not prevent the overflow; they just try to cope with the consequences of an overflow which has happened. The canary tries to detect the case of an overflow which overwrote the return address in a stack frame. DEP is one step further, it assumes that the return address has been overwritten and followed, and it restricts the ...
10
There is definitely a risk - scripting essentially allows execution of code on the browser. The vulnerabilities range from reading your browser's history to installing malware to phishing your bank credentials - each of which can potentially cause you "harm" in some way.
However, given that most of today's web sites rely on scripting, there's a huge loss ...
10
There's a couple of good ones in addition to DVL, that I've come across
Metasploitable is designed for testing out some of Metasploits functionality. There's some good information on using it in the free Metasploit Unleashed course.
There's also DVWA from a web applications perspective
EDIT:
Another good list I came across on a blog recently, has quite ...
10
There is the Access Control extension.
But, you should also read the Security issues with authorization extensions linked from there.
MediaWiki is not designed to be a CMS, or to protect sensitive data. To the contrary, it was designed to be as open as possible. Thus it does not inherently support full featured, air-tight protection of private content. ...
10
Switches are NOT a security feature.
That's the important part. A switch is an optimization over a hub, meant for better performance, not for security.
When a hub receives a packet (an ethernet frame), it dispatches it on all the other links. This is inconvenient in large networks, because this means that when two machines talk to each other, they ...
10
Ok, this is a pretty nasty flaw. If directory traversal is possible, the attacker might overwrite often-used executables in order to infect the box with malware. From there, the rest of the network could get infected through a whole range of different mechanisms: USB spreading, remote code execution vulnerabilities, spear phishing, etc.
Worse, they could ...
10
Canary
Stack canaries work by modifying every function's prologue and epilogue regions to place and check a value on the stack respectively. As such, if a stack buffer is overwritten during a memory copy operation, the error is noticed before execution returns from the copy function. When this happens, an exception is raised, which is passed back up the ...
9
Insecure but widely used cryptographic algorithms include:
hash functions: MD4, MD5, (SHA-1) (MD2 is also insecure but not widely used; SHA-1 is only "weakened"; MD4 and MD5 are also widely used in situations where cryptographic resistance is not required, so that's not a problem)
symmetric encryption: DES (56-bit key), RC4 (non-randomness -- but most ...
9
I’m guessing since you asked this question you find it frequently mind-numbing to locate good vulnerability descriptions. I hate it when I get stuck chasing down the details of a single vuln when there are 100s or 1000s of additional vulns in play.
My favorite sources are the vendors that run decent advisory sites, like:
Red Hat: ...
9
@rook : you should run a diff on the two kernels, after all those years (17 since the split) of divergence there isn't that much that is still common, however there is still cross-breeding between projects and a really good idea will spread all around.
OpenBSD got way more in the way of security architecture, as in compiler support to prevent buffer ...
9
Try these for a start:
http://www.securityfocus.com
http://osvdb.org
http://web.nvd.nist.gov
http://secunia.com
9
I'm not sure if there's anything specific to OpenPGP, but the problem you describe doesn't seem specific to this context.
As far as I'm aware, the exploits that lead to arbitrary code execution (e.g. based on buffer overflows) could happen to the processing of any type of a priori untrusted data that could be processed. Whether it happens in the code that ...
9
There was been at least five issues reported over the past few months
Problem with authentication, ie if you could access a hard disc that contained a dropbox folder you would have continuous access to their dropbox data
Data stored in dropbox is accessible by dropbox employees
A recent code update meant that any dropbox account could be accessed with ...
9
Other than the user's privacy settings, Facebook doesn't inhibit spiders. My scans show they are not even using a Web Application Firewall to block requests. The load to scrub every HTTP request of the most popular website would be massive undertaking. The problem is that your scanner isn't equipped to interact with a mostly JavaScript client communicating ...
9
VGA and HDMI are not one-way; besides the main send-pictures functionality, there is some low-bandwidth bidirectional communication. This is how a computer can "know" that a new display was connected, and what resolution to use on that display. In the case of VGA, this was a backported feature (VGA displays from the early 1990s could not do that).
...
Only top voted, non community-wiki answers of a minimum length are eligible
