A vulnerability which is known to the designers, implementers, or operators of the system, but has not been corrected.
-1
votes
0answers
116 views
FREAK Attack: How to disable all EXPORT ciphers in OpenSSL?
As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack.
reference-
...
1
vote
2answers
83 views
Why are some attacks more famous than others (heartbleed, BEAST, POODLE, etc)?
Eg Heartbleed, aka CVE-2014-0160, only has a CVE severity of 5.0. Yet the media went crazy about these bugs.
Is it because they have a cool name and a logo, or is the CVE severity metric somewhat ...
4
votes
1answer
254 views
POODLE and TLS…not SSL
In December there was a new attack surface of POODLE against TLS 1.0 (think this also covers 1.1 and 1.2?). Anyway, as a system administrator for Windows Server 2008/2012 what can we do do prevent ...
1
vote
2answers
75 views
How to test the php vulnerability CVE-2014-3515
How to test if I'm vulnerable regarding CVE-2014-3515? My vendor supplied me with a patch and verified that it installed however I would like to verify that I am no longer vulnerable. My vendor ...
3
votes
2answers
322 views
List of most common network vulnerabilities a la OWASP Top 10 [closed]
I am trying to find the most commonly used attack vectors/techniques on computer networks in the style of the owasp top 10, for my thesis work. The reports shouldn't be older than 2-3 years. Can you ...
2
votes
0answers
56 views
Case Studies of high profile hacks [closed]
Every hack happens because of a form of security vulnerability or another, and I feel that the best way to avoid/fix these vulnerabilities is to learn about them.
Is there anywhere on the internet ...
1
vote
1answer
159 views
POODLE vulnerability solution : Effect on customer or client side
I am using windows server 2008 R2 and I have lot of customers who use windows XP,7 and 8 with some of them still using IE6. So now I want to disable SSL3 and enable TLS 1.1 as a security measure for ...
2
votes
2answers
80 views
Fuzzing and its impact on testing environment
I asked this question on StackOverflow but got no answers so I thought that I would try my luck here since fuzzing is closely related to security and often used in vulnerability assessment tests.
I'm ...
-1
votes
2answers
59 views
What are the available public or commercial feeds for Malware correlated with the vulnerabilities they exploit [on hold]
To understand the severity of different types of malware, are there any freely available or commercial feeds of malware hashes mapped with public exploits that exploit vulnerabilities listed in ...
3
votes
2answers
274 views
How to exploit via Metasploit vulnerabilities found with Nessus?
I am new in the field and trying to pentest a php web app locally stored on my host pc using metasploit from a kali vm. I have run some scanners like wmap,OpenVAS and Nessus and found some ...
2
votes
1answer
139 views
Why Shellshock works in useragent string?
I was wondering why Shellshock works when put in the useragent.
Based on what I could find it is because a web server (e.g Apache) uses the useragent string in its internal working.
Why would a ...
2
votes
1answer
243 views
Are Java applications vulnerable to CVE-2014-6321 (WinShock)?
CVE-2014-6321 (also known as MS14-066) is a heap overflow vulnerability discovered by Microsoft engineers in Schannel, the SSL/TLS implementation used by Windows.
My Java application uses SSL (JSSE ...
-3
votes
1answer
63 views
Buffer overflow without using environment variables [closed]
I was trying to overflow buffers and I was wondering ,
Is there anyway to do a buffer overflows without using environment variables ?
1
vote
2answers
366 views
SSLv3 cannot be disabled, can I use weak cipher as a workaround?
We're using lighttpd 1.5.0-2349 which unfortunately doesn't support the option to disable SSLv3. I think a potential workaround would be to only allow it to use some cipher which has already been ...
6
votes
3answers
4k views
Force a connection via SSL3 to detect POODLE vulnerability
I have been reading up on the POODLE vulnerability. From my understanding, and correct me if I am wrong, you need to allow connections to be made via SSLv3 on the server.
The server I am currently ...
1
vote
0answers
267 views
Windows OLE Vulnerability CVE-2014-4114 “Sandworm”
Just heard about a new vulnerability and am using the same format as the POODLE guy for this one.
What is the Sandworm vulnerability?
I use [product/browser]. Am I affected?
Is [product] ...
3
votes
1answer
260 views
Performing POODLE attack
I trying to perform POODLE attack on a hosted server that I've configured to support only SSLv3. The scenario is I logged on my server and it sends the cookie in response that will be stored by the ...
1
vote
2answers
235 views
POODLE vulnerability in major social networking
Social networking is a corner stone for a majority of our daily lives, be it communicating with friends, sharing photos or even using social networking for advertising and business promotion. Whilst ...
197
votes
4answers
78k views
SSL3 “POODLE” Vulnerability
Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one.
What ...
2
votes
1answer
119 views
Is this somebody trying to exploit a vulnerability?
On our website, when an invalid PHP session ID is detected, it's logged and regenerated.
This invalid session has been logged:
n040jl1nujch72tkrmr0uilnl1, ...
-1
votes
1answer
100 views
Shellshock vulnerability for pc inside LAN
A common pc running bash inside a home LAN network (with a router/gateway providing internet access to the LAN) does not have any contact with the external internet, except browser navigation and the ...
1
vote
1answer
322 views
Exploiting shellshock
On doing some digging on the shell shock vulnerability, I found that being able to run the exploit via a remote location depends on whether the attacker actually knows the exact cgi script which uses ...
-2
votes
1answer
937 views
The correct way to check for vulnerability CVE-2014-7169 (aftershock)
I found two ways of checking for the vulnerability CVE-2014-7169 (aftershock or taviso bug)
bashcheck uses:
cd /tmp;rm echo 2>/dev/null
X='() { function a a>\' bash -c echo 2>/dev/null > ...
9
votes
1answer
885 views
Example of how the remaining shellshock bash bug CVE-2014-7169 (taviso bug) could be exploited?
I have a general idea about the Shellshock bash bug (CVE-2014-6271 reported Sep 24, 2014) of what the vulnerability is and how it could be exploited. Here you find examples on how to exploit the ...
11
votes
5answers
2k views
Is replacing bash with another shell a prudent step?
Considering that RedHat and other major teams in business are conducting an audit in bash and have uncovered a few other vulnerabilities besides -7169 (-7186 and -7187), is it sensible to link /bin/sh ...
0
votes
0answers
282 views
How are you able to inject bash script through the user agent
I was looking over the new Bash exploit and was looking at this post in particular.
Attack scenarios of the new Bash vulnerability
What I don't understand is how does including bash in the ...
21
votes
1answer
9k views
Attack scenarios of the new Bash vulnerability [duplicate]
Odds are that you're already aware of the newly discovered Bash bug. It can be tested using env x='() { :;}; echo vulnerable' bash -c "echo this is a test".
What yet I haven't understand is, what ...
182
votes
5answers
101k views
What is a specific example of how the Shellshock Bash bug could be exploited?
I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could ...
-2
votes
1answer
86 views
Best and most current sites for security breaches [duplicate]
I'm taking my masters in cyber-security and as a student I come across a lot of garbage when doing research. What are sites with the latest security breaches? Thanks for the help in advanced.
My ...
3
votes
4answers
229 views
Vulnerability exploitation in Java
I am not intimately familiar with Java, so this could be a stupid question.
In a C program I can find buffer overflows or may be a ROP based exploit to run custom code. How is it done in the context ...
1
vote
0answers
53 views
use after free vulnerability [closed]
I am struggling trying to understand use after free vulnerabilities, can someone explain it for me with C language source code, and how it can be used to write to arbitary memory location or to cause ...
1
vote
2answers
59 views
secure flash update
The default method for updating flash is through Adobe's unsecured http portal, which seems to be a serious security concern, given the access that flash has on a user's machine. Can anyone recommend ...
0
votes
0answers
72 views
Find the location of a hidden host
I'm doing a penetration test for a client who wants me to try and target a specific server. I have managed to get credentials(hard-coded in an in-house app) to a limited account on this server that ...
2
votes
2answers
245 views
Why is Un1c0rn exposing wget on heartbleed?
What's the point of spotlighting wget on heartbleed dumps?
I'm specifically talking about this which is the first page of wget occurencies in heartbleed dumps.
They put this page as a link on the ...
1
vote
2answers
154 views
Is php DOMDocument::loadXML completely secure?
Our application is using loadXML extensively to recieve data(input) from the users.
Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using ...
5
votes
3answers
553 views
Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation”
I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me.
In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
5
votes
0answers
38 views
Why does printf() vulnerability require 4-bytes of junk data? - “Hacking: The Art of Exploitation” [duplicate]
I've been reading "Hacking: The Art of Exploitation 2nd Ed." and I hit a part that's not explained clearly enough for me.
In the section "Writing to an Arbitrary Address" Jon Erickson creates a ...
0
votes
0answers
90 views
Is OpenSSL 0.9.8h affected by CVE-2014-0195?
I have spent time on finding out if OpenSSL 098h is affected by the CVE-2014-0195 ..but it seems I will have to understand the entire file d1_both.c to answer this question.
1) Preliminary look at ...
3
votes
8answers
528 views
Are URL shorteners “vulnerable” due to open redirects?
The OWASP state that open redirect is a vulnerability:
An open redirect is an application that takes a parameter and
redirects a user to the parameter value without any validation. This
...
1
vote
1answer
272 views
Cannot get access into a vulnerable Windows 2000 (MS03_026)
I'm trying to get access into a Windows 2000 server through the vulnerability MS03_026. An exploit is provided by Metasploit but I don't know why it isn't working. After filling the options (basically ...
0
votes
2answers
76 views
Which mechanism did Flame use to avoid being identified?
I got a question that says "What is the major difference in the USB propagation system used by Flame with regard to Stuxnet to prevent being identified?".
After Googling for a while, I haven't found ...
-1
votes
1answer
123 views
BigDump v0.35b vulnerability [closed]
I dont understand what the problem with BigDump v0.35b.
This site says that it have problem.
But i dont understand it.
Problem here?
if (!$error && isset($_REQUEST["uploadbutton"]))
{ if ...
1
vote
1answer
62 views
How does the ruby vulnerability affect me?
Visiting this site: http://ruby-doc.org/
I get this message:
There were 3 Ruby vulnerability reports in the last 14 days. 2 high, 1 medium. Most recent: CVE-2013-4562. See details.
I only ...
2
votes
1answer
2k views
TLS v 1.1 vulnerabilities
My question concern TLS :
What are the main vulnerabilities of TLS v1.1 ?
Actually, none RFC describes v1.1 vulnerabilities, neither what pushed them to change to the new protocol 1.2 except ...
1
vote
1answer
224 views
What Is AllowNullSessionFallback?
I've been examining various things under LSA in the registry, and I came across this:
...
2
votes
2answers
485 views
What was the security vulnerability behind Box and Dropbox and what's different now?
Earlier today I received a number of comments saying that my shared links were disabled. I looked around and saw a number of articles explaining what happened, and Dropbox posted an official statement
...
-3
votes
2answers
294 views
What types of software vulnerabilities are out there? [closed]
I have search a lot in the internet and I didn't find anything that is directly answer my question. What type of vulnerabilities are out there. I mean vulnerabilities like buffer overrun, not like XSS ...
-2
votes
3answers
183 views
How do I communicate security issues encountered on an online banking platform?
Occasionally, I've produced (and reproduced) the HTTP 500 Internal Server Error on an online banking platform - quite a famous one. I suppose the errors are due to bugs in back end code, possibly ...
2
votes
2answers
366 views
I've found security vulnerability in current linux distribution. What next?
I've installed ubuntu server 12.04 on VM two weeks ago.
I've created regular snapshots.
XXX time ago I've noticed unusual activity and I've found that a backdoor was installed into my server.
One of ...
0
votes
1answer
169 views
Fomat String vulnerability used to display data outside the function stack frame?
if we run the following code using the input "hi", the output will simply be "hi"
main(int argc, char **argv)
{
char *secret = "This is a secret 1\n";
char *secret2 = "This is ...
