The tag has no wiki summary.

learn more… | top users | synonyms

-1
votes
0answers
4 views

Exploiting cve:2005-1794 [migrated]

I'm currently doing a penetration testing on a windows 2008 server.. The Nessus scan showed me 5 medium and 2 low severity vulnerabilities. When imported the scan result to metasploit I could see only ...
3
votes
2answers
7k views

Yum reports updated bash but binary still reports old version

I'm trying to update a CentOS 5 system in order to patch the bash vulnerability described in CVE-2014-6271 / RHSA-2014:1293-1, but am running into an issue. After seemingly-successfully updating bash ...
16
votes
4answers
21k views

How do I patch RHEL 4 for the bash vulnerabilities in CVE-2014-6271 and CVE-2014-7169?

A mechanism for remote code execution through Bash has been widely reported yesterday and today (September 24, 2014.) http://seclists.org/oss-sec/2014/q3/650 Reported as CVE-2014-7169 or CVE-2014-6271 ...
1
vote
0answers
77 views

Understanding & Resolving Web Server Exploits

We recently had someone contact our company pointing out that we had numerous security threats that could be used to exploit our systems. They were nice enough to provide a list of these to which we ...
-1
votes
1answer
98 views

how to mitigate hackers trying to find an exploit? [closed]

I have a Rails application running in a webserver inside my company, and now and then I see this messages on log: I, [2014-09-04T06:15:33.057513 #37024] INFO -- : Started GET ...
5
votes
1answer
3k views

How to check if my Supermicro IPMI is compromised with plaintext admin password over the web?

I've some Supermicro servers with IPMI running, and as described in this blog (http://blog.cari.net/carisirt-yet-another-bmc-vulnerability-and-some-added-extras) there's a critical vulnerability to ...
0
votes
1answer
29 views

OpenSSL certificates

Since the recent surfacing of the heartbleed exploit, I have become curious as to how long openssl certificates are usually kept before they are regenerated? Is it days, weeks, months, years? I can't ...
0
votes
1answer
461 views

Ramnode was hacked SolusVM zero day exploit (what should I customer do?) [duplicate]

So, ramnode was compromised, some kid used zero day exploit to gain access and rm -rf. I'm really happy how ramnode team handled situation, finally my VPS was restored and it is back online. I've a ...
1
vote
1answer
556 views

Mysql root password change by some one [duplicate]

Possible Duplicate: How do I deal with a compromised server? I'm confused, i have a server that is accessible to the public, but i've been 3 times i was in the locker mysql root password by ...
2
votes
1answer
447 views

What sort of attack URL is this?

I set up a website with my own custom PHP code. It appears that people from places like Ukraine are trying to hack it. They're trying a bunch of odd accesses, seemingly to detect what PHP files I've ...
2
votes
2answers
197 views

Is there any risks by using cat to read a value from a untrusted file

I need to get a variable value by reading from user uploaded text file. I am doing from a system's script: resourceVersion=`cat userFile.txt` mkdir $resourceVersion ... Can the content of this ...
0
votes
1answer
487 views

Windows Task Scheduler Security Issue [closed]

Using the Windows Task Scheduler allows non-administrator users to gain access to administrative rights. Normally, Windows prevents execute applications which need to have more rights. A message ...
1
vote
1answer
505 views

Plesk Qmail Queue Exploding From Possible Webform Attack

The qmail queue on my server (running Plesk on CentOS 5.2) balloons up to 120,000+ messages in the queue overnight. The messages in the queue are obviously spam. I've cleared them out over the last ...
1
vote
1answer
349 views

Applying memory limits to screen sessions

You can set memory usage limits for standard Linux applications in: /etc/security/limits.conf Unfortunately, I previously thought these limits only apply to user applications and not system services. ...
2
votes
2answers
507 views

Exploit in translators.html of phpMyAdmin

Is there an exploit in the translators.html file of phpMyAdmin? The reason I ask is I have Bad Behavior installed on a server, and that server has a web app that the main index.php ends up handling ...
2
votes
2answers
1k views

Giving other users write access to apache logs can result in root exploit - How does this work?

On http://httpd.apache.org/docs/2.2/logs.html Anyone who can write to the directory where Apache is writing a log file can almost certainly gain access to the uid that the server is started as, ...
-1
votes
1answer
352 views

How do I figure out how the “Pharma Hack” hackers are gaining access to my site?

One of my sites has been the continuous target of the "Pharma Hack" - but it's using Drupal instead of Wordpress or Joomla. It is version 6, but it's updated to the latest version, and so are all of ...
0
votes
2answers
2k views

Apache/PHP root exploit

Because of insecure handling of uploaded files, an attacker was able to run php code on my server (CentOS 5.4) That issue has been fixed, but while he was connected he appears to have modified a file ...
7
votes
1answer
3k views

Safest ciphers to use with the BEAST? (TLS 1.0 exploit) I've read that RC4 is immune

Now that the BEAST is public knowledge, TLS 1.0 is NOT safe to use (nor is SSL 3.0). I have seen reports that the RC4 cipher is unaffected (and is widely supported). Is that true? I know that TLS 1.1 ...
4
votes
1answer
4k views

Apache - disable range requests - disadvantages?

As there is a working exploit against Apache's byte range implementation (CVE-2011-3192, see here), I'd like to disable it until official patches are shipped with my distros (Debian, Ubuntu). The ...
2
votes
2answers
635 views

Simple working example of a Man-in-the-Middle attack?

I'm trying to research and patch a TLS renegotiation exploit which makes a website vulnerable to Man-in-the-Middle attacks. However, I don't understand how the attack occurs exactly and feel like a ...
4
votes
2answers
285 views

Is my Exim vulnerable to the recent remote exploit (CVE-2011-1764)?

CentOS using yum to update Exim. Exim is configured to not allow remote connections using the local_interfaces config option. My old version was 4.63-5.el5_5.2 and after using: yum update exim it ...
0
votes
1answer
135 views

Protect against silent1.pl Perl Script

I operate a small shared hosting area. While I notice that people are unable/struggle to exploit with PHP I have found a small minority of people using Perl in order to obtain server information. So, ...
0
votes
3answers
378 views

Any user in the apache user group can view others home directorys and edit files

Okay, Just recently uncovered a very large exploit in my server. Any hosting account that was set up through the Kloxo controll panel is automatically part of the "Apache" user group. This means if ...
2
votes
2answers
1k views

Ubuntu Server hack

I looked at netstat and I noticed that someone besides me is connected to the server by ssh. I looked after this because my user has the only one ssh access. I found this in an ftp user .bash_history ...
0
votes
1answer
243 views

Apache trailing slash added to files problem

I am having a problem with Apache. What it does is this: Take /index.php file containing an code with src set to relative path myimg.jpg, both in the root of my server. So, www.mysite.com would show ...
2
votes
1answer
415 views

What is the EGG environment variable?

A user on our (openSuSE) linux systems attempted to run sudo, and triggered an alert. He has the environment variable EGG set - EGG=UH211åH1ÒH»ÿ/bin/shHÁSH211çH1ÀPWH211æ°;^O^Ej^A_j<X^O^EÉÃÿ ...
0
votes
1answer
261 views

grsecurity effieffectiveness test with latest proftpd remote exploit

i just tested grsecurity. i installed debian and a vulnerable version of proftpd. i launched an exploit. worked. patched the latest kernel with grsec. and now the exploit doesnt work anymore. BUT . ...
1
vote
3answers
343 views

What exploit is this?

Our company site just went live and the very first entry in access.log looks like a tentative exploit :) Any idea on which one it could be? Here's the relevant line: 79.168.7.121 - - ...
5
votes
3answers
919 views

Weird set of shell commands in root's .bash_history

I have probably just detected that a user on a server of mine has rooted my server, but that's not what I'm asking. Has anyone ever seen command like these: echo _EoT_0.249348813417008_; id; echo ...
0
votes
2answers
68 views

images security

How I can check all my images on server, they don't prepared with maulicious code ? I mean for example Gif PHP exploits and so on...
1
vote
1answer
594 views

exploit.so dmesg errors

A server (which has since been pulled offline and is scheduled to be wiped) was compromised through ssh brute force. No root/su/sudo access was gained but I started observing these errors (pasted ...
0
votes
1answer
94 views

Has my Apache server been exploited?

I recently got the following in my server logs: 70.190.xxx.xx - - [26/Sep/2010:19:03:17 -0500] ...
1
vote
1answer
193 views

Linux 64b dangerous kernel exploit

Many of you know the recent and dangerous kernel exploit CVE-2010-3081. See /. What is the actual risk for a server? Do we have to patch urgently all systems? Or, since it seems only a local user ...
7
votes
4answers
292 views

Could/Should you be held liable for server vulnerabilities? [closed]

Is there precedent in North America or elsewhere where a server administrator was held accountable for leaving a server vulnerable? For example, if there is a known exploit in IIS - Microsoft issue ...
4
votes
4answers
2k views

my server was rooted via h00lyshit exploit, any good advice?

So yesterday I found out that my server was rooted via the h00lyshit exploit. So far I deleted all the files that might be asociated with the exploit. I also deleted all the ssh keys in ...
0
votes
1answer
155 views

metasploit confusion

I'm using (Metasploit framework-3.4.0-linux-i686) under Kubuntu, and i'm the only Linux machine connected to my company network, so i was trying to let my boss know that our network is a big mess, and ...
2
votes
1answer
402 views

Samba - Is my server vulnerable to CVE-2008-1105?

I have a CentOS server that is running Samba and I want to verify the vulnerability addressed by CVE-2008-1105. What scenarios can I build in order to run the exploit that is mentioned in ...
0
votes
1answer
398 views

How Do I Secure WordPress Blogs Against Elemento_pcx Exploit?

I have a client who has several WordPress 2.9.2 blogs that he hosts. They are getting a deface kind of hack with the Elemento_pcx exploit somehow. It drops these files in the root folder of the blog: ...
0
votes
3answers
64 views

Does apache/PHP has overflow problem if the developer doesn't tweak it at all?

Is apache/PHP self secured so that developers don't need to care about it?
1
vote
2answers
2k views

CentOS Vulnerabilities - Exploits/Payloads

I'm doing an academic work where I have to find vulnerabilities in CentOS and show how to take advantage of those same vulnerabilities. I'm no hacker and I'm finding this task to be of great ...
3
votes
5answers
217 views

Scanning website for vulnerablities

I have found that the local school's website installed a Perl Calendar - this was years ago, it has not been used for ages, but Google has it indexed (which is how I found it) and it full of Viagra ...
6
votes
8answers
1k views

(200 ok) ACCEPTED - Is this a hacking attempt?

I assume this is some type of hacking attempt. I've try to Google it but all I get are sites that look like they have been exploited already. I'm seeing requests to one of my pages that looks like ...
0
votes
1answer
535 views

Windows Vista, Win7 ASLR in Kernel land

Is ASLR also implemented for kernel land address space addresses? if yes, since which version of microsoft windows exactly? Thanks for your time.
5
votes
2answers
78 views

Find out unfixed exploits count based on application version

In our enviroment we are often required to run old outdated versions of different applications, and im wondering about the security implications on that. So im hoping there is a site that basicly ...
2
votes
4answers
337 views

Website attacked with a hidden iframe (q5x.ru)

A website of mine has recently been infected with some sort of attack that involved injecting a hidden iframe, and it's source was from a site q5x.ru (do not link). A Google search didn't help me in ...
13
votes
9answers
6k views

SSH server zero-day exploit - Suggestions to protect ourselves

According to the Internet Storm Center, there seems to be a SSH zero-day exploit out there. There is some proof of concept code in here and some reference: ...
8
votes
7answers
531 views

Keeping up with security

After some comments made to another question, I wonder how many administrators actually go to websites like Packetstorm? Do you keep up to date with the latest threats coming out? Finally what are the ...
5
votes
8answers
674 views

Identifying changed files on *nix webserver

Looking for some (*nix) software which will build an index of "interesting" files on a server and notify when certain of those files contents are modified, or new files appear. Similar to rkhunter et ...
3
votes
2answers
1k views

Securing Webservers

I was reading an article about a recent website (astalavista.com) that was hacked. The perpetrator wrote down how he did it: http://pastebin.com/f751e9f5b What can we learn from this to better ...