Skip to main content
121 votes

Meltdown and Spectre Attacks

This answer is an attempt at addressing simply the main concerns. The details here might not be exemplary accurate, or complete. I'll try to link to more detailed explanations when possible. What is ...
M'vy's user avatar
  • 13.1k
85 votes

On Windows boxes, is patching for Spectre and Meltdown necessary?

the only point of easy penetration to a system seems to be via javascript running in a web browser. How about Flash? Java? Silverlight? VBA in an office document? Any applications that load web-pages ...
Hector's user avatar
  • 11k
66 votes

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

You can do either, but I recommend applying for a CVE so that customers who get threat intelligence feeds are more likely to notice the issue and expedite a patch. Assigning a CVE also makes it easier ...
Polynomial's user avatar
  • 135k
60 votes
Accepted

My Android phone is vulnerable, but there are no updates?

You are essentially asking what to do if you are using software which is known to be vulnerable but where no updates are available. This is a problem not restricted to Android phones but you'll find ...
Steffen Ullrich's user avatar
55 votes

What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?

It can't be exploited remotely without another vulnerability. You need to be able to execute commands on the system already. A classic example would be a web shell. Say the server is running a web ...
Volker's user avatar
  • 1,253
48 votes
Accepted

What's the Impact of the CloudFlare Reverse Proxy Bug? ("#CloudBleed")

Compared to the famous HeartBleed bug leak, this is similar in some ways: the uninitialized memory exposure means unrelated private data is disclosed. The things that are better This only affected ...
Jeff Ferland's user avatar
  • 38.4k
31 votes

On Windows boxes, is patching for Spectre and Meltdown necessary?

In my world, applying patches is a given. We're going to do it and it takes an exception to NOT apply a patch. Right now, those are exploits we know about for Spectre and Meltdown. However, what's ...
baldPrussian's user avatar
  • 2,778
28 votes

What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?

The dirty cow vulnerability, is a a privilege escalation vulnerability in Linux kernel versions 2.6.22 and higher; it has existed since 2007 and was fixed on Oct 18, 2016. What is the possible impact ...
GAD3R's user avatar
  • 2,231
28 votes
Accepted

As an end user, what risk is there in browsing a public website that uses TLSv1?

There is currently no real risk just based on the TLS protocol version for the end user when visiting a site which provides only TLS 1.0 (TLSv1) with a modern browser, i.e. a current version of Chrome,...
Steffen Ullrich's user avatar
25 votes

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

It would be helpful to publish the CVE so that others know it's necessary to update: as you said, they can see it in threat intelligence feeds (or CVE scans) instead of having to read the changelog of ...
Luc's user avatar
  • 33k
23 votes
Accepted

Vim Modeline Vulnerabilities

Although in theory modelines shouldn't allow you to do anything bad, sanitizing modeline functions input is hard. There have been several security issues in the past that allowed arbitrary command ...
Calimo's user avatar
  • 505
23 votes
Accepted

New CVE-2018-5407 "PortSmash vulnerablity" in Intel CPU

As with a lot of breaking-news coverage of computer security, there's a lot of questionable reporting on PortSmash. It's not actually very interesting, as it doesn't really add much to the attacker ...
Johnny's user avatar
  • 1,061
19 votes

My Android phone is vulnerable, but there are no updates?

This is a pervasive problem with nearly all Android phone vendors. I suspect (only suspicion, I'm afraid) that they do it to boost the sales of their new models. I have tried reaching out to vendors ...
Sas3's user avatar
  • 2,656
13 votes
Accepted

Why do several bug bounties ignore user enumeration?

Because they are already aware of the issue. This is evident of them making a mention on the exclusion list. Not mentioning it would likely lead to a lot of users pointing it out. And since they are ...
Bacon Brad's user avatar
  • 3,412
12 votes

What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?

CVE-2016-5195 is a so-called privilege escalation exploit. It allows you to elevate the privilege level from a normal Linux user to root. But privilege escalation exploits are usually local exploits (...
kaidentity's user avatar
  • 2,654
11 votes

Should I use SSL/TLS renegotiation?

As of 2020, TLS renegotiation is no more because it was insecure. Renegotiation is removed from TLS 1.3 onward, year 2018. All major software disabled renegotiation by default since as far as 2009 (...
user5994461's user avatar
  • 1,296
11 votes

What are the main vulnerabilities of TLS v1.1?

Sticking with TLS 1.0 is a very bad idea and pretty unsafe. Can be POODLEd, BEASTed and otherwise padding-Oracled as well. Lots of other CVE weaknesses still apply which cannot be fixed unless by ...
Bernd P's user avatar
  • 111
8 votes

How can you check and analyze SSL ports other than 443?

I use https://testssl.sh/ testssl.sh is a free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and ...
Colonel Panic's user avatar
8 votes
Accepted

Do high-level programming languages have more vulnerabilities or security risks than low-level languages?

Major Caveat upfront: It is possible to be insecure in any language, any time, and only developer attentiveness/awareness can fix this. SQL injection is still a thing. Higher-level languages ...
Jared Smith's user avatar
  • 2,106
8 votes

My Android phone is vulnerable, but there are no updates?

It's a bit late for you now (I imagine), but as an Android fan I make sure and only buy phones from manufacturers that I know provide regular security updates. In the past I've had phones that ...
Conor Mancone's user avatar
8 votes

On Windows boxes, is patching for Spectre and Meltdown necessary?

Yes, because it can be used for privilege escalation. Usually, if an attack compromises a host, they only have user privileges. Using this vulnerability, they can escalate privileges by leaking ...
Daniel Grover's user avatar
8 votes

On Windows boxes, is patching for Spectre and Meltdown necessary?

Install the patches unless you have a very strong reason not to. The approach you describe can basically be summed up as this: I know about exploit X. I could patch my OS to resolve exploit X, or ...
Cort Ammon's user avatar
  • 9,416
8 votes

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

You are not required to request a CVE, but you are free to do so when you think it will be benificial. A CVE is just a central number that identifies a vulnerability, which can assist when ...
Sjoerd's user avatar
  • 31.8k
8 votes

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

I think the most important question is if your product comes with an auto-updater. If it auto-updates by default, then a CVE can sometimes do more harm than good by putting your product into the ...
Nosajimiki's user avatar
  • 1,857
7 votes

What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?

At least it does affect Android 5.0.1 (Kernel Version 3.10.54+). I just tried out this code on a device using Termux and editing a file owned by root works flawlessly. I like that, because there is no ...
sigalor's user avatar
  • 171
7 votes

Meltdown and Spectre Attacks

Simple tips In addition to M'vy's excellent answer, I just want answer this question: What can I do in order to be safe? Spectre, Meltdown and Rowhammer are CPU conceptual bugs, so they couldn't be ...
F. Hauri  - Give Up GitHub's user avatar
6 votes

What is the possible impact of dirtyc0w a.k.a. "Dirty COW" bug?

How scary is it? In principle, a privilege escalation is quite scary since it more or less renders all access control meaningless. In practice, it hopefully matters little. You first have to have ...
Damon's user avatar
  • 5,221
6 votes

As an end user, what risk is there in browsing a public website that uses TLSv1?

As an end user, probably nothing. The very stage where you are at the communication sequence of a TLS transaction makes it so you are not really vulnerable to anything other than MITM. Most of the ...
Bristran's user avatar
  • 121
5 votes

Why do several bug bounties ignore user enumeration?

In addition to @Bacon Brad's excellent answer above, I would like to include three more reasons as to why "user enumeration" is often listed under the "out of scope bugs" sections in security policies....
EdOverflow's user avatar
  • 1,326
5 votes
Accepted

I'm running Android 4.1.2; it includes known vulnerabilities. Installing a newer firmware image would take time and effort. Must I really do so?

That depends how important is anything you do on the phone. If it is prepaid plan and you only anonymously watch youtube clips and surf the web, the worst that could happen is your phone becoming just ...
Matija Nalis's user avatar
  • 2,305

Only top scored, non community-wiki answers of a minimum length are eligible