Questions tagged [vulnerabilities]
The vulnerabilities tag has no usage guidance.
86
questions
3
votes
2
answers
1k
views
Tracking Security Vulnerability remediation
I've been looking into this for a little while, but havn't really found anything suitable.
What I am looking for is a system to track security vulnerability remdiation status. Something like "...
0
votes
0
answers
106
views
Repair a forced fsck-ed LUKS volume
In a moment of distraction, I'v managed to run:
# fsck -Ty /dev/sda1, where /dev/sda1* was a LUKS encypted volume.
I don't have a recent backup, so I can't restore. And the backup I have is for the ...
0
votes
1
answer
643
views
Looking for CIS Benchmark script for CentOS 7
I am not sure this is the right place to ask this. I apologize if it is not.
I have few CentOS machines that is running 7.7 version. And I need to do a CIS benchmark for finding any vulnerabilities. I ...
0
votes
0
answers
21
views
How to get the exact IP addresses of the hosts from Tenable.io
I am trying to figure out way to get the exact IP addresses of the hosts from Tenable.io. Is there a way to do it?
2
votes
3
answers
698
views
nmap vulnerability scan reports " smtps on port 465 ssl-dh-params" vulnerability, on Ubuntu 20.04 webserver. How to close the vulnerabilty?
I am running an Ubuntu 20.04 LEMP (Linux, Nginx, MariaDb, PHP) email/web server. I am also doing some nmap vulnerability tests form my MacOS Client machine. On MacOS, I am using Oh My Zsh! with the ...
0
votes
2
answers
538
views
nmap vuln script detects vulnerability "Apache byterange filter DoS http-vuln-cve2011-3192" in Ubuntu Webserver, but apache2 not installed on server
I am running an Ubuntu 20.04 LEMP (Linux, Nginx, MariaDb, PHP) webserver. I am also doing some nmap vulnerability tests form my MacOS Client machine. On MacOS, I am using Oh My Zsh! with the nmap ...
-1
votes
1
answer
27
views
Programs and tool to scan open source software for vulnerabilities?
Since my business uses a lot of open source software I was wondering if there was a way to scan for vulnerabilities in the code before we either compile it, ./configure, make etc...
Or as scripting ...
0
votes
2
answers
5k
views
Should I expect reception of packets in hping3 --flood?
I'm testing a newly purchased VPS for DDoS vulnerability using hping3.
If I do not use --flood, everything goes fine and I see close to 0% packet loss every time. But If I do use --flood, then the ...
0
votes
0
answers
154
views
Can I redirect one specific url in Nginx for WordPress?
I want to redirect one specific url in Nginx to 'not found' or 'hidden'
url: /wp-admin/load-scripts.php?c=1&load[]=jquery-effects-blind
reason: https://hackerone.com/reports/925425
my codes in ...
0
votes
0
answers
110
views
What is best practice for reporting vulnerability scans?
While reading our logs I came across several requests that seems to be scanning for vulnerabilities on our web app.
2021-09-25T17:32:44.164858+00:00 app[web.1]: 54.39.216.121 - - [25/Sep/2021:17:32:44 ...
0
votes
1
answer
86
views
How to fix these vulnerability "" (CVE-2020-2781) ** Upgrade IBM Java to version 7.0.10.65 "" in rhel 7 server
I got this type of vulnerabilities on a rhel server after scan "(CVE-2020-2781) ** Upgrade IBM Java to version 7.0.10.65 Download and apply the upgrade from: https://www.ibm.com/developerworks/...
4
votes
3
answers
10k
views
Why does apache log requests to GET http://www.google.com with code 200?
I was recently asked 'What causes a line like this in our access.log?'
59.56.109.181 - - [22/Feb/2010:16:03:35 -0800] "GET http://www.google.com/ HTTP/1.1" 200 295 "-" "...
0
votes
1
answer
1k
views
How to fix Weak TLS 1.2 Encryption
I have a requirement to disable below weak TLS ciphers in Windows Server 2016. I tried to reasearch and it says "The Microsoft SCHANNEL team does not support directly manipulating the Group ...
0
votes
1
answer
2k
views
Prevent TLS/SSL Birthday attacks on 64-bit block ciphers (SWEET32)
Our recent VA report shows that there are TLS/SSL Birthday attacks on 64-bit block ciphers possible on Kubernetes etcd ports.
Suggested solution is Configure the server to disable support for 3DES ...
0
votes
2
answers
51
views
Cleaning and upgrading legacy infrastructure
I am a fullstack engineer in a small company, and I am responsible for everything related to technology, from infrastructure, to code.
I arrived a few months ago, and quickly realised that there were ...
0
votes
1
answer
38
views
Does the BootHole Vulnerability Effect Grub1 or Only Grub2?
I've been doing some reading on BootHole to help understand our attack surface and see everything talking about GRUB2, but nothing about GRUB "Legacy" or GRUB1. Wondering if it has tested ...
1
vote
0
answers
46
views
How do I secure my PHP forms that communicate with my MySQL Server? [closed]
They are just the basic forms, they take in $input from the form and then store that directly in to the database, there is another form where it takes $input and searches for a hashed match for it.
...
2
votes
2
answers
11k
views
Can someone explain what this vulnerability means?
I'm having a bit of a problem getting my head round what this vulnerability means, can someone help me understand this?
I'm particularly puzzled by the RESULTS section. Why would source port 25 be ...
0
votes
1
answer
587
views
Sudden unidentified frozen emails with code injection-like recipient
I am suddenly receiving a number of curious "Message frozen" emails from my server (Exim 4.89, Debian stable) :
Message 1hcbPR-0005t1-2r has been frozen (delivery error message).
The sender ...
1
vote
1
answer
102
views
Server infected by recent cryptojacking malware but different (?) entry point
One of my servers has been infected by this cryptojacking malware (reporting to the very same IP than in the article).
It seems known for this malware to propagate through some Confluence ...
0
votes
0
answers
88
views
How can I determine whether I'm vulnerable to SPECTRE/Meltdown/L1TF on Ubuntu
I'm running Ubuntu 18.04, and I have the following linux-image and intel-microcode packages:
ii linux-image-4.18.0-17-generic 4.18.0-17.18~18.04.1 amd64 Signed ...
-1
votes
1
answer
73
views
What does ISIC option "-t" mean?
As I already found out, ISIC tool has an option "-t" only for tcpsic or tcpsic6 and it means percentage of packets with wrong checksum.
In tcpsic case my router works fine.
But when Ive been testing ...
0
votes
1
answer
270
views
Still receiving "Message frozen" warnings after fixing Exim CVE-2019-10149 critical vulnerability
After upgrading Exim4 to an official patched version fixing CVE-2019-10149 vulnerability (i.e. exim4_4.89-2+deb9u4) on my Debian stable server, I still get the "Message frozen" warnings about ...
0
votes
1
answer
93
views
Is it enough to deactivate RDP to avoid RPD exploits?
I just got word about the newest known vulnerability of the RDP service. 2 Days ago microsoft made a blog post about it and delivered updates. OS wise even for windows xp.
From what I understand the ...
0
votes
0
answers
24
views
Cloud server vulnerability analysis [duplicate]
I have multiple Hetzner cloud servers (Ubuntu 18.04) and I have encrypted the home directory with a +128-bit encryption using cryptsetup/LUKS. The server may only be accessed with SSH or Wireguard. ...
0
votes
1
answer
54
views
Windows Services Vulnerable to Tampering Mitigation
I am testing some software with Microsoft's Attack Surface Analyzer. I took a baseline and after installation scan of the software I am testing. When I create a report it shows that a certain service ...
0
votes
1
answer
144
views
KVM, CentOS and CVE-2018-3639
Today news have reached me about specter (https://access.redhat.com/security/cve/cve-2018-3639). I'm running CentOS and kvm infrastructure. Fix is critical and planning to deploy it in few days. I ...
0
votes
1
answer
1k
views
"Critical" vulnerability rating on OpenVAS 9
I'm using OpenVAS 9 and I noticed that all the vulnerabilities ranking from 7.0 to 10.0 are labeled as "High".
Is there a way to change this behavior, so that all the ones ranking from 9.0 to 10.0 ...
2
votes
6
answers
30k
views
PHP eval(gzinflate(base64_decode(..))) hack - how to prevent it from occurring again?
We recently had a website hacked, where some PHP code was injected into the index.php file that looked something like:
eval (gzinflate(base64_decode('s127ezsS/...bA236UA1')));
The code was causing ...
4
votes
6
answers
12k
views
I can't enable the Meltdown/Spectre mitigations in Windows Server 2008 R2
I have installed the patch released today as detailed here and then set the two registry keys as mentioned:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory ...
2
votes
1
answer
1k
views
Metltdown/Spectre Mitigations on Windows 2008 R2 guest on VmWare ESXi5.5
I do see that I can't enable the Meltdown/Spectre mitigations in Windows Server 2008 R2 is a similar question, but I suppose that the environment differences may justify different remedies.
After ...
42
votes
4
answers
20k
views
I updated my CentOS 7 system. Why is Meltdown/Spectre only partially mitigated?
Like many of us, I spent yesterday updating a whole lot of systems to mitigate the Meltdown and Spectre attacks. As I understand it, it is necessary to install two packages and reboot:
kernel-3.10.0-...
12
votes
2
answers
2k
views
Meltdown & Spectre - Does patching the guest kernel of an unpatched hypervisor prevent cross-VM memory leaks?
24 hours after the wide scale release of the vulnerabilities, Rackspace is silent about Spectre and Meltdown. They do not have a plan for patching all of their Xen hypervisors. All their newer ...
1
vote
0
answers
308
views
microcode_ctl vs kernel-firmware
I have read that CPU microcode updates are delivered by the kernel-firmware package and microcode_ctl is obsolete: Source #1 Source #2
But i believe this is not true because at the Red Hat Security ...
0
votes
1
answer
44
views
Same version after patching wpa_supplicant 2.4
Why is the version number of wpa_supplicant not increased, when I look with 'man wpa_supplicant' at the bottom it says 16 October 2017 but with 'wpa_supplicant -v' I see v2.4, which is especially ...
0
votes
1
answer
39
views
Fetch changelogs for multiple Linux distros?
I'm trying to build a service that can take a distro, package, and a version number, and use that information to check if there's an active CVE out for that tuple.
after some searching, I've found ...
0
votes
0
answers
45
views
Which update scheme is better for an unattended Ubuntu server
I'm in a situation where I have to deploy an ubuntu server for a Client (they do not have a Sysadmin), and it will serve as an HTTP API backend for an app.
The catch is that after the deployment they ...
1
vote
1
answer
1k
views
Freebsd: pkg audit spread out in time over different servers
We have several Freebsd servers, where we check daily for vulnerabilities with pkg audit.
Question: Very often, the same vulnerability is reported in some servers only, and then in some others the ...
1
vote
2
answers
69
views
Is omitting a PC password within my Win 8.1 LAN constituting a security risk from the outside world?
In my Windows 8.1 LAN consisting of 14 computers, there are several servers which are dedicated to very specific tasks. (For example is the "Save Server" responsible to run a daily batch script, which ...
3
votes
1
answer
4k
views
Tomcat Virtual Host to prevent Improper-Input-Handling attack
I'm currently on the process of trying fix a site vulnerability, basically it is one type of the "Improper Input Handling" attack.
Let's say my website is www.mywebsite.com
and there is hacker's ...
1
vote
1
answer
2k
views
CONNECT Method Allowed in HTTP Server Or HTTP Proxy Server Vulnerability
My setup details:
OS : RHEL7
Webserver : Apache http server(SSL enabled)
AppContainer : NodeJS
Webserver connects to NodeJS via mod_proxy.
I blocked the connect method in apache ...
0
votes
1
answer
225
views
How to check if Chromium OS vulnerable to Dirty COW?
I'm running some projects on Kubernetes clusters on the Google Compute Engine. The nodes which form the cluster run on Container-VM, a Chromium OS based image specifically designed for nodes on GCE. ...
29
votes
3
answers
9k
views
What kinds of security vulnerabilities does providing DNSSEC expose?
I was planning to sign my DNS zone with DNSSEC. My zone, the registrar and my DNS server (BIND9) all support DNSSEC. The only one who doesn't support DNSSEC is my secondary nameserver provider (namely ...
-1
votes
2
answers
212
views
Risks of not updating an Ubuntu server on a local network?
Through work I recently came across a server that is used by 10-20 users daily as a sort of web server. It is running Ubuntu 12 and it has not been updated for a very long time it seems. Currently ...
0
votes
2
answers
327
views
How do I test my znc's SSL port against various SSL vulnerabilities?
My znc's SSL port is not 443. Various SSL vulnerability tests on the web work only on 443 port.
znc SSL port serves a web server and an IRC bouncer simultaneously.
How can I test whether znc SSL ...
0
votes
1
answer
1k
views
vulnerability issue in ASP.NET
In our vulnerability report there is one vulnerability which I have mentioned below.
"it was found that the Microsoft ASP.NET validate Request filters could allow a remote attacker to bypass it's ...
2
votes
2
answers
538
views
Upgrade SSL/TLS/Openssl?
I have a requirement to upgrade SSL/TLS/OpenSSL. The server is RHEL 6 Enterprise.
In that server I am going to remove apache, which has not been not in use for a long time. After uninstalling ...
8
votes
2
answers
2k
views
In response to the OpenSSL Poodle vulnerability should I disable SSLv3?
OpenSSL just announced another new vulnerability in it's memory routines. You can read all about it here: https://www.openssl.org/news/secadv_20141015.txt
The workaround is to disable SSLv3.
Will ...
2
votes
2
answers
2k
views
Fix logjam vulnerability in courier
The site weakdh.org explains how to fix postfix against the weak Diffie-Hellman attack called "logjam".
But don't I have to fix courier too? Or do I have to migrate to dovecot to be logjam-safe?
5
votes
7
answers
4k
views
Web Application Vulnerability Scanner suggestions? [closed]
I'm looking for a new tool for the ol' admin toolkit and would value some suggestions.
I would like to do some "automated" testing of handful of websites for XSS (cross site scripting) vulns, along ...