Skip to main content

Questions tagged [vulnerability]

Security vulnerabilities are bugs (usually in software) that allow abuse of a program or system.

Filter by
Sorted by
Tagged with
6 votes
1 answer
458 views

How can I confirm for sure that a CVE has been mitigated on a RHEL system?

I have this problem, I'm trying to see if a group of servers are vulnerable to the CVE CVE-2024-1086 so what I do in the server is rpm -qa --changelog kernel | grep 2024-1086, and I get this as output:...
VaTo's user avatar
  • 3,181
6 votes
2 answers
13k views

How do you mitigate the Terrapin SSH attack?

The Terrapin Attack on SSH details a "prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the ...
KJ7LNW's user avatar
  • 495
2 votes
1 answer
2k views

Are all Debian 11 systems automatically vulnerable to CVE-2023-38408?

I really really hope I'm wrong here, but it seems that Debian 11 has a vulnerable version of OpenSSH. My OpenSSH banner reports my OpenSSH version is: 8.4p1 Debian 5+deb11u1 I checked with sshd and it ...
Sir Muffington's user avatar
0 votes
0 answers
141 views

Cannot change or remove a file as root

This is driving me nuts... There's a lot of info over the place and I've spent quite some hours already without any success. A customer of mine haves a website compromised with some japanese SEO spam (...
nnimis's user avatar
  • 101
22 votes
3 answers
2k views

rsync the file `a`b

Yeah, I know what you are thinking: "Who on earth names their file `a`b?" But let us assume you do have a file called `a`b (possibly made by a crazy Mac user - obviously not by you), and you ...
Ole Tange's user avatar
  • 35.8k
0 votes
1 answer
281 views

Is there any advantage to staying on very old linux kernels?

When I visit https://www.kernel.org/ I see a variety of kernel versions. At the time of writing there is one mainline, two stables, and a whopping six longterms. The oldest is 4.9. Is there a reason ...
nsum938's user avatar
0 votes
1 answer
129 views

Do we have any command to get security update for ubuntu?

In Redhat/CentOS/OL there is direct command yum updateinfo list sec or yum updateinfo list cve to get security update from the repo, am searching the same for ubuntu as well. do we have any command ...
Bandhala Raja Selvam's user avatar
2 votes
1 answer
833 views

Which 32-bit features are still vulnerable to "Retbleed" in the Linux kernel?

I'm updating my kernel to protect my system against the "Retbleed" exploit, and I know that affected 32-bit things haven't received the necessary mitigations. I'm wondering which 32-bit ...
ATLief's user avatar
  • 318
-4 votes
1 answer
3k views

Step by step Red Hat Update for OpenSSL [closed]

How to update Red Hat Update for Open Secure Sockets Layer (OpenSSL) (RHSA-2022:1066) Red Hat Update for java-11-openjdk security (RHSA-2022:1440) Please guide me step by step, because I have no ...
Lintang Gilang Pratama's user avatar
0 votes
2 answers
325 views

How to fix CVE-2018-364 vulnerability

I have found a log in my /log/messages showing a CVE-2018-3646 error with the following link, (https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html). I have accessed the mentioned file-...
Mel's user avatar
  • 1
0 votes
0 answers
81 views

Clarification regarding CVE-2020-25717

We use CentOS 7 and have only samba-client in our deployment. (We do not have samba server in our deployment.) Does the CVE-2020-25717 affect our deployment?
Michael's user avatar
  • 101
-1 votes
1 answer
956 views

Which Linux distribution is the latest openVAS available on?

It has been removed from the latest Alpine and their solution is to downgrade your system from 3.11 to 3.10. It's no longer available on Debian, their solution is to build it from source. Is there any ...
freebie's user avatar
0 votes
0 answers
196 views

Is it really true that no RedHat fix exists for this High/Important 3-month old glib issue?

Short version Red Hat Customer Portal lists CVE-2021-27219 as having a 9.8 out of 10 RedHat CVSS score, that it was published February 4, 2021, more than 3 months ago and that it affects RHEL 8, the ...
Peter V. Mørch's user avatar
4 votes
2 answers
767 views

Heap-based buffer overflow in Sudo vulnerability - sudo version impacted?

I have some servers running Ubuntu 18.04.5 LTS In last update of sudo package I can see that sudo:amd64 1.8.21p2-3ubuntu1.4 has been installed on 26/01/2021 (the same day that Heap-based buffer ...
Zumo de Vidrio's user avatar
0 votes
1 answer
2k views

How to patch sudo vulnerabilities on debian leading to a local privilege escalation CVE-2021-23239 and CVE-2021-3156 (aka Baron Samedit)?

On Linux Mint 20.1 Ulyssa, I have received a security update to patch tow security flaws leading to a local privilege escalation without password for all unpatched sudo version before 1.9.5 version ...
GAD3R's user avatar
  • 67.4k
0 votes
1 answer
81 views

SQLi vulnerability vs SELinux

Assume an SQLi vulnerable web app running on a Linux system, SELinux in enforcing mode. The MariaDB is running as a non-root user, say db_user. Assume we are trying to take advantage of the SQLi ...
cyzczy's user avatar
  • 376
2 votes
0 answers
256 views

Another Meltdown / Spectre Question [closed]

I recently tested using mitigations=off in my grub boot parameters, and found that my Celeron N4000 CPU on my thin and light laptop has almost doubled in performance! I can easily see the difference......
PowerOverwhelming...shell's user avatar
2 votes
1 answer
726 views

How to check for MDS vulnerability?

I'm running Debian Buster (10.3) on a ThinkPad T420 (i5-2520M), current intel-microcode package is installed. To check for known CPU vulnerabilities I used the spectre-meltdown-checker script (https://...
Simon's user avatar
  • 227
3 votes
0 answers
351 views

Can JTAG vulnerability lead to newer hardware support by coreboot? (bootguard bypass) [closed]

A of couple days ago I've stumbled upon this speech: https://www.youtube.com/watch?v=3CQUNd3oKBM The guy in the video speaks about Intel Mangement Engine, describes in details how it works and that ...
user398271's user avatar
1 vote
1 answer
1k views

Can a process send keystrokes or read text to/from a tty that is running su/sudo?

I need some information regarding the possible attack vector on *nix platforms of running su/sudo. Can an malicious process wait for the user to run su or sudo and then exploit that root access ...
Gerardo Grignoli's user avatar
58 votes
3 answers
72k views

Disable Spectre and Meltdown mitigations

Can I disable Spectre and Meltdown mitigation features in Ubuntu 18.04LTS? I want to test how much more performance I gain when I disable these two features in Linux, and if the performance is big, ...
pioupiou's user avatar
  • 856
2 votes
1 answer
1k views

L1D unconditional flushing should be enabled to fully mitigate the vulnerability (CVE-2018-3646)

I used the spectre-meltdown-checker, version 0.42, without any option resulting in all-green results. But, in a help page, I found the --paranoid switch, which resulted in about a half of later CVEs ...
Vlastimil Burián's user avatar
10 votes
1 answer
4k views

Do I need to take action regarding my Microarchitectural Data Sampling (MDS) status?

My dmesg output contains the following line: [ 0.265021] MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more ...
5am's user avatar
  • 323
-2 votes
1 answer
126 views

Security patch update [closed]

If applying the latest patch(example : CESA-2019:0679 - Libssh2 Security Update - CentOS 7 x86_64) will cover the previous patch changes or we need to do it separately?
Srikanth R's user avatar
0 votes
2 answers
2k views

Update ntp to 4.2.8p13 on CentOS

I have NTP 4.2.6p5 installed on my CentOS 7.5. Due to "Network Time Protocol Multiple Security Vulnerabilities" vulnerability I have to upgrade it to latest NTP 4.2.8p13 version. Now the problem is, ...
Juned's user avatar
  • 515
6 votes
1 answer
453 views

How does the Linux Kernel handle newer chips that patched only against Spectre Variant 1 but not Variant 2?

How will chips patched for Spectre Variant 1 and Meltdown, like Whiskey Lake and Amber Lake, handle Spectre Variant 2? I'm looking to spec out a new laptop. Currently evaluating the Lenovo x390. It's ...
Evan Carroll's user avatar
  • 31.7k
2 votes
0 answers
594 views

Bypassing hiding Linux processes?

Hiding Linux Processes Recently, I've followed this tutorial, which detailed how to hide processes from users without root access, by means of setting hidepid=n on /proc/. After following this ...
NerdOfCode's user avatar
7 votes
1 answer
5k views

Security of bash script involving gpg symmetric encryption

Notice: the very same vulnerability has been discussed in this question, but the different setting of the problem (in my case I don't need to store the passphrase) allows for a different solution (i.e....
francescop21's user avatar
7 votes
4 answers
3k views

If a CVE database lists my version of OpenSSH as vulnerable, is it possible that it has been patched but retains the version number?

I am using OpenSSH version 7.4p1, in CVE database I found that cpe:/a:openbsd:openssh:7.4:p1 is vulnerable to CVE-2017-15906 https://www.cvedetails.com/cve/CVE-2017-15906/. Does this mean that for ...
user187205's user avatar
2 votes
2 answers
2k views

IPTables vs AF_PACKET sockes

I just discovered a security issue, I was reviewing my IP tables rules, and discovered that there was no rule for DHCP traffic (I have DROP-policy for all chains), but I still get IP-address, subnet-...
BufferOverflow's user avatar
1 vote
1 answer
331 views

Spectre Meltdown on 32-bit x86

I use an older 32-bit Intel Pentium Computer which is not getting any microcode updates. Anyway the PC is working just fine and I want to protect it against spectre/meltdown vulnerabilities. Is there ...
Bastian's user avatar
  • 29
0 votes
1 answer
79 views

Is a kernel patch available for 32-bit instances of RHEL 5?

I know RHEL 5 is old, but could someone confirm if there's an Extended Support Meltdown patch available for RHEL 32-bit? I've heard that Red Hat only has a 64-bit kernel fix out now but when I ...
Mike B's user avatar
  • 8,980
2 votes
1 answer
896 views

How to mitigate against Spectre variant 2 on CentOS 6.9?

According to the Intel microcode update which was released on 2018-03-12 to address Spectre/Meltdown, the microcode is not compatible with CentOS 6. Therefore, systems running CentOS 6 remain ...
Chris's user avatar
  • 1,157
3 votes
1 answer
19k views

how to check microcode is enabled on my system and how to fix intel cpu firmware package which is causing reboot issues [closed]

Fixes from intel in there cpu firmware package seems to be causing reboot issues I'm using centos 7.3 distribution with 1.14.14 kernel and want to know which package is intel's cpu firmware and ...
mchawre's user avatar
  • 181
3 votes
1 answer
4k views

How to verify spectre retpoline feature is enabled on my linux machine with kernel 4.14.14?

I installed latest stable kernel 4.14.14 from ELRepo which seems to have some fix for the Spectre vulnerability. The changelog says there is some CONFIG_RETPOLINE in /boot/config-4.14.14-1.el7.elrepo....
mchawre's user avatar
  • 181
2 votes
0 answers
134 views

kernel vulnerabilities

I recently got a single-board computer for which the official support has been discontinued. I'm using a minimal, debootstrapped Debian on that system with a kernel that is taken from one of the ...
user236012's user avatar
  • 2,245
8 votes
2 answers
3k views

Is AIX/Power safe from Spectre / Meltdown?

Since Intel, AMD and ARM is affected by the Spectre and Meltdown cpu kernel memory leak bugs/flaws, could we say that Power architecture is safe from these?
Hessnov's user avatar
  • 591
35 votes
4 answers
30k views

How to mitigate the Spectre and Meltdown vulnerabilities on Linux systems?

Security researchers have published on the Project Zero a new vulnerability called Spectre and Meltdown allowing a program to steal information from a memory of others programs. It affects Intel, AMD ...
GAD3R's user avatar
  • 67.4k
0 votes
2 answers
141 views

Is a package specific to a Linux distribution? How to protect against KRACK

I run multiple distributions of Linux. I am researching how to patch against KRACK. The package that is vulnerable in Linux is 'wpa_supplicant'. According to the Vendor Responses the "Linux patch" ...
n00b's user avatar
  • 135
20 votes
1 answer
6k views

How do I secure Linux systems against the BlueBorne remote attack?

The Armis Lab has discovered a new vector attack affecting all devices with Bluetooth enabled including Linux and IoT systems. BlueBorne attack on Linux Armis has disclosed two vulnerabilities in the ...
GAD3R's user avatar
  • 67.4k
0 votes
1 answer
162 views

How to understand and mitigate the Evil DNS remote attack under linux systems?

A new vulnerability has discovered on the systemd package called Evil DNS allowing the remote control of a linux machine. From the security-tracker.debian , the debian Stretch , Buster and Sid are ...
GAD3R's user avatar
  • 67.4k
2 votes
1 answer
376 views

How to mitigate the multiple vulnerability : remote code execution and local privilege escalation on FreeBSD 11?

By checking the state of installed package using the pkg audit -F tool on freeBSD 11 , I have found 4 vulnerability on the installed packages (installed through pkg) : samba ,OpenEXR , kdelibs and ...
GAD3R's user avatar
  • 67.4k
27 votes
3 answers
7k views

How to detect and mitigate the Intel escalation of privilege vulnerability on a Linux system (CVE-2017-5689)?

According to the Intel security-center post dated May 1, 2017, there is a critical vulnerability on Intel processors which could allow an attacker to gain privilege (escalation of privilege) using AMT,...
GAD3R's user avatar
  • 67.4k
2 votes
0 answers
497 views

Postgres Vulnerability through public schema?

On Debian 8.5, I'm finding weird processes and files in /tmp: file "cool" is owned by root, group=postgres<br> file "Injection.sh", "zeroteam.so", "zteam" Why do those file exist? How can I ...
Rhodarus's user avatar
  • 143
1 vote
2 answers
554 views

Is there a way to check a web server against all kind of the CVE?

Instead of tracking all of the CVE items from cvedetails or cve.mitre and analyzing/determining if the web server system identified with specific OS version, specific kernel, specific software version,...
prosti's user avatar
  • 1,058
-1 votes
1 answer
161 views

Whats the latest bash version that can be ran on RHEL3?

I have an older RHEL 3 server that I can't upgrade at the moment. Its running GNU bash, version 2.05b.0(1)-release (i386-redhat-linux-gnu) Yum is broken. My concern is shellshock. Would this: bash-...
user53029's user avatar
  • 2,843
9 votes
2 answers
1k views

How do I protect my system against the Off-path TCP exploit in Linux?

According to cve.mitre.org, the Linux kernel before 4.7 is vulnerable to “Off-path” TCP exploits Description net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine ...
GAD3R's user avatar
  • 67.4k
2 votes
1 answer
412 views

Check service for vulnerabilities [closed]

I need to write some kind of bash script that would check conf files of services (commonly used as nginx apache mongodb cassandra ssh etc) and search for patterns (i.e. check if mongod.conf has ...
Thomas's user avatar
  • 133
1 vote
0 answers
41 views

Looking for a tool similar to the Security Advisor plugin for WHM that can run on CentOS 7 without WHM

The startup I'm working at is setting up some new CentOS 7 servers that will host a mobile application, and some of the data is sensitive, thus, the servers need to be secured to the best of our ...
Justin's user avatar
  • 495
1 vote
0 answers
210 views

Help with installing/configuring Samba 2.2.3a on Ubuntu 14.04

I am having trouble installing and configuring an old version of on Ubuntu 14.04. I am configuring this specific versionson purpose to be vulnerable for penetration testing. However, after ...
404Cat's user avatar
  • 11