The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
700 views

How To Fix Padding Oracle (CVE-2016-2107) On Ubuntu/Apache/PHP

I am trying to fix CVE-2016-2107. I consulted several sites, which do not seem to provide a clear answer for all cases: I use Apache2 2.4.12 with PHP 5.5.26. I ran: apt-get install openssl libssl-...
2
votes
2answers
254 views

Upgrade SSL/TLS/Openssl?

I have a requirement to upgrade SSL/TLS/OpenSSL. The server is RHEL 6 Enterprise. In that server I am going to remove apache, which has not been not in use for a long time. After uninstalling ...
1
vote
1answer
1k views

how to block all requests from URLs with MSDOS device name using isapi filter cve 2007-2897

I recently had an audit report on my windows server 2008 R2 and it failed with the error/vulnerability: Microsoft asp.net ms-dos device name DoS www (443/tcp). I have not been able to find any ...
48
votes
3answers
42k views

How to fix 'logjam' vulnerability in Apache (httpd)

Recently, a new vulnerability in Diffie-Hellman, informally referred to as 'logjam' has been published, for which this page has been put together suggesting how to counter the vulnerability: We ...
0
votes
1answer
308 views

Apache Httpd and Weblogic configured for SSL

I have an Apache Httpd running as my RPS in front of some Weblogic and Coherence servers. I have the rps configured for ssl, and to deny SSLv3 and SSLv2 requests. So when I got to the specific url (...
-1
votes
1answer
39 views

web application audit task require my remote IP to be allowed on application network firewall [closed]

I want to audit a web application which is hosted on a web server sitting behind a cyberoam firewall. My task is to run a scan from my remote machine which has ISP MTNL broadband. My machine gets a ...
-2
votes
1answer
67 views

Is Arbitrary code execution vulnerability in Firefox a myth? [closed]

Have you ever seen a live demo of one of those critical vulnerabilities that Firefox publishes? Is it possible to run a program (i.e. Notepad) or download/install a new one, without user intervention, ...
8
votes
5answers
5k views

How to patch CVE-2015-0235 (GHOST) on debian 7 (wheezy)?

This vulnerability was found in glibc, see this hacker news post for more info. As described in the debian bug tracker, the vulnerability was already patched in testing and unstable. I'd like to ...
0
votes
1answer
468 views

segfault error with bash on CentOS 6

I updated bash as soon as both patches were available, and using the test script at https://shellshocker.net, I am showing fixed on all vulnerabilities except for segfault. OS: cat /etc/*release* ...
8
votes
1answer
3k views

How can I test for BadUSB vulnerability?

There are news that an unpatchable and unfixable USB firmware exploit is "out there". This could seem unrelated to servers but since the affected hardware from Phison is not disclosed there is a ...
1
vote
1answer
379 views

CentOS fails to update Bash

I'm trying to patch my server against the Shellshock vulnerability issue. However, I'm unable to update Bash to a safe version, these are the results I'm getting: # yum update bash Loaded plugins: ...
0
votes
1answer
345 views

Is there vulnerability in the following listening ports?

I've just installed new ubuntu server and issue netstat -nlpcommand and get the following result: Active UNIX domain sockets (only servers) Proto RefCnt Flags Type State I-Node ...
1
vote
1answer
1k views

HP iLO 4 & OpenSSL 'ChangeCipherSpec' MiTM Vulnerability

The Nessus scanner is flagging 'High risk with sig 74326' after the latest rule updates to all HP iLO cards. This is specifically about the OpenSSL 'ChangeCipherSpec' MiTM Vulnerability. It appears ...
4
votes
1answer
273 views

CVE-2014-0196 Vulnerability for CentOS

Trying to patch CVE-2014-0196 Vulnerability but yum can't find packages updates CentOS 6.5 (Final) Panel version: 11.0.9 Update #61 # uname -r 2.6.32-358.11.1.el6.x86_64 # yum update kernel Loaded ...
0
votes
1answer
265 views

How to expose securely a Node.js/Express server into the real world?

Essentially I would like to know what the title suggests. Node.js/Express is nice. However, node is a fairly recent thing and hence there may be security risks by exposing the server to the real world....
4
votes
1answer
3k views

Chown in sudoers file : Safe or not?

Is it safe to add this command in sudoers file? mike ALL= NOPASSWD:/bin/chown -R www-data\:www-data /var/www and this is the only command that I want to run $mike@ubuntu: sudo chown -R www-data:...
-2
votes
2answers
84 views

How do I report vulnerability in sudo? [closed]

I have found a vulnerability in sudo and I was able to reproduce it on multiple instances of xubuntu. It didn't seem to work on debian. How do I report it properly? I have read so much about ...
2
votes
1answer
603 views

Is this a DNS vulnerability or exploit?

Our server (windows 2008 R2 server, fully patched) this morning was a bit slow. Checking network activity I found several DNS sessions using quite a lot of bandwidth (10MB/sec per session). This was ...
-1
votes
1answer
1k views

Stealing internet by changing MAC address? [closed]

OK - I have a static IP - and I have been on the same provider for years - its a wired network (a cable goes directly to my network card) - and the cable is connected to a switch on a pole in the ...
1
vote
1answer
85 views

Check that NLM is patched in Netware 6.5

We need to solve vulnerability CVE-2011-4191 "Stack-based buffer overflow in the xdrDecodeString function in XNFS.NLM in Novell NetWare 6.5 SP8 allows remote attackers to execute arbitrary code or ...
3
votes
4answers
2k views

Tomcat denial of service

The last two days our Tomcat 5.5 Linux-based webserver has been broken down within minutes by starting thousands of downloads and stopping them. Some request paths in the access log end with a "?...
6
votes
2answers
725 views

Finding Webserver Vulnerability

We operate a webserver farm hosting around 300 websites. Yesterday morning a script placed .htaccess files owned by www-data (the apache user) in every directory under the document_root of most (but ...
1
vote
3answers
227 views

how to protect our server from hacker

our website server was frequently gotten hacked recently.how can i protect it
0
votes
4answers
558 views

How to find systems with vulnerability which may later become agent for DDoS?

How to determine the systems with vulnerability, which scanning tool is best. The system should be identified so that it can be used as agent for DDoS. In a test bed environment I want to check this....