The tag has no wiki summary.

learn more… | top users | synonyms

-1
votes
1answer
31 views

Check my own servers for vulnerabilities

We are a small early stage startup with not so much money to spend. We have less than 3 servers that we want to monitor for security issues. Our website is essentially on one server having: Ubuntu ...
5
votes
2answers
617 views

In response to the OpenSSL Poodle vulnerability should I disable SSLv3?

OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt The workaround is to disable SSLv3. Will ...
1
vote
1answer
28 views

Ways to follow newly discovered vulnerabilities?

I happened to be in a situation where I am in charge for 100+ systems on top of my job as a programmer. Everything we run is Linux (Debian, Ubuntu, Centos) and gladly our sysadmin set everything with ...
0
votes
1answer
70 views

Http 1.1 protocol detected

I have a CentOS server and we had a Retina security scan. I have no idea how to fix this vulnerability. Can you point me in the right direction? We are running nginx.
-1
votes
0answers
39 views

Server Shellshocked, how to find out how? [duplicate]

I have access to one server that is shellshocked and there is injected crontab along with altered ssh init script. Here is gist of file that does all the work Question is how to investigate how ...
3
votes
2answers
2k views

Shellshock - “pkg upgrade bash” doesn't update bash to latest 4.3.25

I'm using FreeBSD-9.1-p5. My security run output: Checking for packages with security vulnerabilities: Database fetched: Wed Sep 24 23:01:24 EDT 2014 bash-4.3.24 pkg info bash: # pkg info bash ...
-1
votes
1answer
84 views

Disinfecting a Supermicro IPMI Board

The IPMI board on one of our servers seems to have become infected - we were hit by the "password in the clear" vulnerability - and it seems to have allowed something to have infected by a bot that ...
1
vote
0answers
48 views

Understanding & Resolving Web Server Exploits

We recently had someone contact our company pointing out that we had numerous security threats that could be used to exploit our systems. They were nice enough to provide a list of these to which we ...
12
votes
4answers
322 views

How to convince my Administrator that Java ON A SERVER is not insecure per se?

The Application We have a small Java application which uses some Camel routes to pick up uploaded files from a webserver, process them and send out some e-mails with the results. The server on which ...
1
vote
1answer
244 views

Remotely Detect Windows Server Service Pack Level

One of our web servers just failed PCI-DSS compliance because the vulnerability scan detected the OS was Windows Server 2003 Service Pack 1 (obviously very outdated!). My question is how did the ...
0
votes
1answer
630 views

Unknown logins in vsftpd - hacked? [duplicate]

I'm running logwatch and there I've seen some strange activity. There are two different ip adresses (I'll call this guy hacker) where it seems they logged in successfully through vsdftpd: hacker's IP ...
4
votes
1answer
2k views

Is apache 2.2.15 vulnerable on CentOS 6.3?

My server has scanned for vulnerabilities and they are asking that upgrade your Apache server but the CentOS repositories does not provide Apache > 2.2.15. If this version is vulnerable then why ...
0
votes
1answer
31 views

Client Side Negotiation

I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache. But still vulnerability report says I am vulnerable to client side negotiation and "This server is ...
2
votes
1answer
543 views

What are these weird request paths on my Apache server? [duplicate]

Possible Duplicate: What are these weird access requests? I'm getting a lot of requests like these in my access.log: 203.186.107.226 - - [16/Oct/2012:07:07:39 +0000] ...
1
vote
2answers
1k views

openVAS - Microsoft RDP Server Private Key Information Disclosure Vulnerability - false Alarm?

I performed a openVAS scan on a Windows Server 2008 R2 and got a report for a high threat level vulnerability called Microsoft RDP Server Private Key Information Disclosure Vulnerability. An remote ...
2
votes
2answers
192 views

Is there any risks by using cat to read a value from a untrusted file

I need to get a variable value by reading from user uploaded text file. I am doing from a system's script: resourceVersion=`cat userFile.txt` mkdir $resourceVersion ... Can the content of this ...
1
vote
1answer
60 views

Check that NLM is patched in Netware 6.5

We need to solve vulnerability CVE-2011-4191 "Stack-based buffer overflow in the xdrDecodeString function in XNFS.NLM in Novell NetWare 6.5 SP8 allows remote attackers to execute arbitrary code or ...
8
votes
5answers
850 views

How to check that a known Windows Vulnerability has been patched?

Is there a way in Windows to check that say Security Bulletin MS**-*** or CVE-****-***** has been patched? e.g. something akin to RedHat's rpm -q --changelog service Windows 2008 R2 SP1
2
votes
2answers
176 views

Are cross-site scripting vulnerabilities the responsibility of the network/systems admin or developer?

I'm just curious about this. Say the system was 100% patched up. Should the administrator also be responsible for cross-site scripting issues?
1
vote
4answers
161 views

Convenient source for information on known exploits (not theoretical)

Forgive me if this question has been asked before or is off-topic. The past couple of security patches I've installed have been discovered from reading news articles, which publicly discuss security ...
0
votes
2answers
78 views

Security track record of unix programs [closed]

I'm looking for a database with all the noteworthy unix programs with a timeline of vulnerabilities found in that individual product in some categories (remote/local, DoS, privilege elevation, data ...
0
votes
3answers
330 views

tomcat problems in vulnerability scan

I was hoping someone could point me in the right direction. I have a server which is hosting a client's website and they run a Vulnerability scan every so often to see everything's in working order. ...
1
vote
1answer
596 views

Log all outgoing mail created by php

Hi I have Debian Linux server which serves several PHP sites. Today I received mail from Datacenter where they say my server is sending spam and attached spam message. This was really message from my ...
-1
votes
2answers
295 views

Hardening Apache server [duplicate]

Possible Duplicate: Tips for Securing a LAMP Server. I want to learn about hardening and securing Apache server. Can anybody suggest me very detailed web resource. I also want to learn ...
0
votes
2answers
66 views

images security

How I can check all my images on server, they don't prepared with maulicious code ? I mean for example Gif PHP exploits and so on...
0
votes
2answers
87 views

Post Vulnerability Actions

To protect the guilty I will avoid names... I know of a site that last night went down. Sort of. For about 5 hours all requests to this asp.net site were producing a YSOD. The details that were spit ...
1
vote
5answers
21k views

PHP eval(gzinflate(base64_decode(..))) hack - how to prevent it from occurring again?

We recently had a website hacked, where some PHP code was injected into the index.php file that looked something like: eval (gzinflate(base64_decode('s127ezsS/...bA236UA1'))); The code was causing ...
0
votes
1answer
292 views

Advice on keeping cloud server secure? (linux)

I'm able to take a basic linux distro (stable Ubuntu Server) and install everything I need to get my web apps up and running. (Django, Rails, PHP etc...) But after all of that I would appreciate some ...
3
votes
1answer
234 views

Tracking Security Vulnerability remediation

I've been looking into this for a little while, but havn't really found anything suitable. What I am looking for is a system to track security vulnerability remdiation status. Something like ...
2
votes
1answer
385 views

Samba - Is my server vulnerable to CVE-2008-1105?

I have a CentOS server that is running Samba and I want to verify the vulnerability addressed by CVE-2008-1105. What scenarios can I build in order to run the exploit that is mentioned in ...
1
vote
3answers
664 views

Does removing admin rights really mitigate 90% of Critical Windows 7 vulnerabilities found to date? as reported by beyondtrust.com

Beyondtrust.com published a report, somewhat recently, claiming among other quite compelling things, "90% of Critical Microsoft Windows 7 Vulnerabilities are Mitigated by Eliminating Admin Rights" ...
3
votes
5answers
217 views

Scanning website for vulnerablities

I have found that the local school's website installed a Perl Calendar - this was years ago, it has not been used for ages, but Google has it indexed (which is how I found it) and it full of Viagra ...
6
votes
8answers
1k views

(200 ok) ACCEPTED - Is this a hacking attempt?

I assume this is some type of hacking attempt. I've try to Google it but all I get are sites that look like they have been exploited already. I'm seeing requests to one of my pages that looks like ...
0
votes
2answers
95 views

Prevent malicious vulnerability scan increasing load on a server

this week we have been suffering some malicious vulnerability scans to our servers, increasing the load on them, making them nearly unusable. The attack is easy to defend, just blocking the ...
2
votes
2answers
3k views

Why does apache log requests to GET http://www.google.com with code 200?

I was recently asked 'What causes a line like this in our access.log?' 59.56.109.181 - - [22/Feb/2010:16:03:35 -0800] "GET http://www.google.com/ HTTP/1.1" 200 295 "-" "Mozilla/5.0 (compatible; MSIE ...
1
vote
1answer
1k views

Can someone explain what this vulnerability means?

I'm having a bit of a problem getting my head round what this vulnerability means, can someone help me understand this? I'm particularly puzzled by the RESULTS section. Why would source port 25 be ...
4
votes
4answers
1k views

Preventing vulnerability scripts from scanning apache server

Quick question for you all - fairly frequently in my httpd logs I see things like this: 66.11.122.194 - - [29/Jan/2010:11:06:44 +0000] "GET HTTP/1.1 HTTP/1.1" 400 418 "-" "Toata dragostea mea pentru ...
0
votes
7answers
5k views

Postfix open relay

Greetings, Google says that I'm originating too many emails from my IP. Since I NEVER uses this smtp to originate emails, I suspect my postfix is somewhat misconfigured, so that I have an open relay ...
3
votes
4answers
174 views

Does being the target of a DoS attack imply a vulnerability of my operating system?

Does being the target of a denial of service (DoS) attack imply a vulnerability of my operating system?
4
votes
7answers
3k views

Web Application Vulnerability Scanner suggestions? [closed]

I'm looking for a new tool for the ol' admin toolkit and would value some suggestions. I would like to do some "automated" testing of handful of websites for XSS (cross site scripting) vulns, along ...
10
votes
5answers
4k views

How did Matasano get hacked?

from: http://seclists.org/fulldisclosure/2009/Jul/0388.html If I understand it best from the posts from: http://news.ycombinator.com/item?id=723798 the Matasano guys left sshd internet accessible - ...