Questions tagged [vulnerability]

Security vulnerabilities are bugs (usually in software) that allow abuse of a program or system.

Filter by
Sorted by
Tagged with
2
votes
0answers
21 views

Another Meltdown / Spectre Question [closed]

I recently tested using mitigations=off in my grub boot parameters, and found that my Celeron N4000 CPU on my thin and light laptop has almost doubled in performance! I can easily see the difference......
2
votes
1answer
85 views

How to check for MDS vulnerability?

I'm running Debian Buster (10.3) on a ThinkPad T420 (i5-2520M), current intel-microcode package is installed. To check for known CPU vulnerabilities I used the spectre-meltdown-checker script (https://...
3
votes
0answers
120 views

Can JTAG vulnerability lead to newer hardware support by coreboot? (bootguard bypass) [closed]

A of couple days ago I've stumbled upon this speech: https://www.youtube.com/watch?v=3CQUNd3oKBM The guy in the video speaks about Intel Mangement Engine, describes in details how it works and that ...
1
vote
1answer
115 views

Can a process send keystrokes or read text to/from a tty that is running su/sudo?

I need some information regarding the possible attack vector on *nix platforms of running su/sudo. Can an malicious process wait for the user to run su or sudo and then exploit that root access ...
5
votes
2answers
3k views

Disable Spectre and Meltdown mitigations

Can I disable Spectre and Meltdown mitigation features in Ubuntu 18.04LTS? I want to test how much more performance I gain when I disable these two features in Linux, and if the performance is big, ...
1
vote
1answer
242 views

L1D unconditional flushing should be enabled to fully mitigate the vulnerability (CVE-2018-3646)

I used the spectre-meltdown-checker, version 0.42, without any option resulting in all-green results. But, in a help page, I found the --paranoid switch, which resulted in about a half of later CVEs ...
6
votes
1answer
2k views

Do I need to take action regarding my Microarchitectural Data Sampling (MDS) status?

My dmesg output contains the following line: [ 0.265021] MDS CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/mds.html for more ...
-2
votes
1answer
103 views

Security patch update [closed]

If applying the latest patch(example : CESA-2019:0679 - Libssh2 Security Update - CentOS 7 x86_64) will cover the previous patch changes or we need to do it separately?
0
votes
2answers
884 views

Update ntp to 4.2.8p13 on CentOS

I have NTP 4.2.6p5 installed on my CentOS 7.5. Due to "Network Time Protocol Multiple Security Vulnerabilities" vulnerability I have to upgrade it to latest NTP 4.2.8p13 version. Now the problem is, ...
6
votes
1answer
333 views

How does the Linux Kernel handle newer chips that patched only against Spectre Variant 1 but not Variant 2?

How will chips patched for Spectre Variant 1 and Meltdown, like Whiskey Lake and Amber Lake, handle Spectre Variant 2? I'm looking to spec out a new laptop. Currently evaluating the Lenovo x390. It's ...
1
vote
0answers
219 views

Bypassing hiding Linux processes?

Hiding Linux Processes Recently, I've followed this tutorial, which detailed how to hide processes from users without root access, by means of setting hidepid=n on /proc/. After following this ...
4
votes
1answer
1k views

Security of bash script involving gpg symmetric encryption

Notice: the very same vulnerability has been discussed in this question, but the different setting of the problem (in my case I don't need to store the passphrase) allows for a different solution (i.e....
7
votes
4answers
2k views

If a CVE database lists my version of OpenSSH as vulnerable, is it possible that it has been patched but retains the version number?

I am using OpenSSH version 7.4p1, in CVE database I found that cpe:/a:openbsd:openssh:7.4:p1 is vulnerable to CVE-2017-15906 https://www.cvedetails.com/cve/CVE-2017-15906/. Does this mean that for ...
1
vote
2answers
605 views

IPTables vs AF_PACKET sockes

I just discovered a security issue, I was reviewing my IP tables rules, and discovered that there was no rule for DHCP traffic (I have DROP-policy for all chains), but I still get IP-address, subnet-...
1
vote
1answer
259 views

Spectre Meltdown on 32-bit x86

I use an older 32-bit Intel Pentium Computer which is not getting any microcode updates. Anyway the PC is working just fine and I want to protect it against spectre/meltdown vulnerabilities. Is there ...
0
votes
1answer
74 views

Is a kernel patch available for 32-bit instances of RHEL 5?

I know RHEL 5 is old, but could someone confirm if there's an Extended Support Meltdown patch available for RHEL 32-bit? I've heard that Red Hat only has a 64-bit kernel fix out now but when I ...
2
votes
1answer
789 views

How to mitigate against Spectre variant 2 on CentOS 6.9?

According to the Intel microcode update which was released on 2018-03-12 to address Spectre/Meltdown, the microcode is not compatible with CentOS 6. Therefore, systems running CentOS 6 remain ...
2
votes
1answer
11k views

how to check microcode is enabled on my system and how to fix intel cpu firmware package which is causing reboot issues [closed]

Fixes from intel in there cpu firmware package seems to be causing reboot issues I'm using centos 7.3 distribution with 1.14.14 kernel and want to know which package is intel's cpu firmware and ...
2
votes
1answer
3k views

How to verify spectre retpoline feature is enabled on my linux machine with kernel 4.14.14?

I installed latest stable kernel 4.14.14 from ELRepo which seems to have some fix for the Spectre vulnerability. The changelog says there is some CONFIG_RETPOLINE in /boot/config-4.14.14-1.el7.elrepo....
2
votes
0answers
112 views

kernel vulnerabilities

I recently got a single-board computer for which the official support has been discontinued. I'm using a minimal, debootstrapped Debian on that system with a kernel that is taken from one of the ...
9
votes
2answers
3k views

Is AIX/Power safe from Spectre / Meltdown?

Since Intel, AMD and ARM is affected by the Spectre and Meltdown cpu kernel memory leak bugs/flaws, could we say that Power architecture is safe from these?
36
votes
4answers
28k views

How to mitigate the Spectre and Meltdown vulnerabilities on Linux systems?

Security researchers have published on the Project Zero a new vulnerability called Spectre and Meltdown allowing a program to steal information from a memory of others programs. It affects Intel, AMD ...
0
votes
2answers
131 views

Is a package specific to a Linux distribution? How to protect against KRACK

I run multiple distributions of Linux. I am researching how to patch against KRACK. The package that is vulnerable in Linux is 'wpa_supplicant'. According to the Vendor Responses the "Linux patch" ...
19
votes
1answer
5k views

How do I secure Linux systems against the BlueBorne remote attack?

The Armis Lab has discovered a new vector attack affecting all devices with Bluetooth enabled including Linux and IoT systems. BlueBorne attack on Linux Armis has disclosed two vulnerabilities in the ...
0
votes
1answer
116 views

How to understand and mitigate the Evil DNS remote attack under linux systems?

A new vulnerability has discovered on the systemd package called Evil DNS allowing the remote control of a linux machine. From the security-tracker.debian , the debian Stretch , Buster and Sid are ...
2
votes
1answer
315 views

How to mitigate the multiple vulnerability : remote code execution and local privilege escalation on FreeBSD 11?

By checking the state of installed package using the pkg audit -F tool on freeBSD 11 , I have found 4 vulnerability on the installed packages (installed through pkg) : samba ,OpenEXR , kdelibs and ...
26
votes
3answers
6k views

How to detect and mitigate the Intel escalation of privilege vulnerability on a Linux system (CVE-2017-5689)?

According to the Intel security-center post dated May 1, 2017, there is a critical vulnerability on Intel processors which could allow an attacker to gain privilege (escalation of privilege) using AMT,...
2
votes
0answers
481 views

Postgres Vulnerability through public schema?

On Debian 8.5, I'm finding weird processes and files in /tmp: file "cool" is owned by root, group=postgres<br> file "Injection.sh", "zeroteam.so", "zteam" Why do those file exist? How can I ...
0
votes
2answers
77 views

Is there a way to check a web server against all kind of the CVE?

Instead of tracking all of the CVE items from cvedetails or cve.mitre and analyzing/determining if the web server system identified with specific OS version, specific kernel, specific software version,...
-1
votes
1answer
117 views

Whats the latest bash version that can be ran on RHEL3?

I have an older RHEL 3 server that I can't upgrade at the moment. Its running GNU bash, version 2.05b.0(1)-release (i386-redhat-linux-gnu) Yum is broken. My concern is shellshock. Would this: bash-...
9
votes
2answers
1k views

How do I protect my system against the Off-path TCP exploit in Linux?

According to cve.mitre.org, the Linux kernel before 4.7 is vulnerable to “Off-path” TCP exploits Description net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine ...
2
votes
1answer
298 views

Check service for vulnerabilities [closed]

I need to write some kind of bash script that would check conf files of services (commonly used as nginx apache mongodb cassandra ssh etc) and search for patterns (i.e. check if mongod.conf has ...
1
vote
0answers
34 views

Looking for a tool similar to the Security Advisor plugin for WHM that can run on CentOS 7 without WHM

The startup I'm working at is setting up some new CentOS 7 servers that will host a mobile application, and some of the data is sensitive, thus, the servers need to be secured to the best of our ...
1
vote
0answers
158 views

Help with installing/configuring Samba 2.2.3a on Ubuntu 14.04

I am having trouble installing and configuring an old version of on Ubuntu 14.04. I am configuring this specific versionson purpose to be vulnerable for penetration testing. However, after ...
1
vote
2answers
3k views

GRUB2 security vulnerability: pressing backspace 28 times: What are my risks? What should I do? [closed]

There have been reports yesterday about a new security vulnerablity: Lucian Constantin (2015-12-16). Vulnerability in popular bootloader puts locked-down Linux computers at risk. CSO Online. Patrick ...
0
votes
1answer
321 views

Inconsistent shellshock exploitation

I am trying to demonstrate the shellshock vulnerability according to the commands posted here. I have taken two systems under consideration: the first one has a vulnerable bash in $PATH; the other ...
-1
votes
1answer
324 views

Bash Code Injection Vulnerability On Linux

Found a bug in Linux, a bash code injection vulnerability. The solution to this is the update the bash package. yum update bash My Question is "do I need to reboot the system"? We have 4000 ...
1
vote
1answer
56 views

Does CVE 2006-7098 require access (being a logged in) to the vulnerable Debian?

I'm studying the vulnerabilities of an old version of Apache, the 1.3.34. And I don't quite understand in what exact situation the CVE 2006-7098 vulnerability can be exploited. The README included in ...
2
votes
2answers
122 views

Ghost vulnerability - recompile C/C++ programs?

I've CentOS 6.0 server with glibc-2.12-1.7.el6.x86_64 running many open source services and some of my own C programs. To fix ghost vulnerability, I need to update it to glibc-2.12-1.149.el6_6.5. ...
13
votes
1answer
7k views

Ghost Vulnerability - CVE-2015-0235

Does the Ghost Vulnerability require access (as in being a logged in user) to the effected OS in question? Can someone clarify the 'remote attacker that is able to make an application call'? I only ...
4
votes
2answers
81 views

Protecting my server from its own users

Are there any tools to check my server's file system for permission vulnerabilities? My server is a low-security web and email server running our local email and website. Anyone in my organization ...
1
vote
0answers
157 views

KDE4 PolicyKit backdoor(misconfiguration) (tested on FBSD10x,PCBSD, probably will work on linux)

recently found subj on FreeBSD 10.x out of the box (with KDE4): [user@fbsd10] /home/user% su Password: su: Sorry [user@fbsd10] /home/user% sudo csh Password: Sorry, user user is not allowed to ...
1
vote
2answers
2k views

Nmap script execution to detect heartbleed is failing

Wanting to setup Nmap on my Ubuntu 14.04 LTS system to detect HeartBleed vulnerability. I followed the instructions here: http://cyberarms.wordpress.com/2014/04/20/detecting-openssl-heartbleed-with-...
19
votes
1answer
752 views

How was the Shellshock Bash vulnerability found?

Since this bug affects so many platforms, we might learn something from the process by which this vulnerability was found: was it an εὕρηκα (eureka) moment or the result of a security check? Since we ...
8
votes
1answer
17k views

How do I disable SSLv3 in an OpenSSH SSH server to avoid POODLE?

In wake of the newly-discovered POODLE vulnerability, I'd like to disable SSLv3 on all of my SSH servers. How do I achieve this with OpenSSH?
0
votes
1answer
140 views

Is there any need to take further action over ShellShock [closed]

The question on this site: "When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?" explains how the vulnerability has been cured, but does not, as far ...
4
votes
2answers
8k views

Bash vulnerability CVE-2014-6271 (Shellshock) fix on Debian 6.0 (Squeeze) [duplicate]

I upgraded my old Debian 6.0 (Squeeze) server, but still the vulnerability seems to be there: $ env x='() { :;}; echo vulnerable' bash -c 'echo hello' vulnerable hello How do I upgrade Bash to ...
2
votes
0answers
2k views

How to test shellshock against remote machine using a simple script [closed]

I am interested in testing for shellshock vulnerable machines that I don't have shell access to on my LAN's and WAN's such as IPMI cards and Internet of Things devices. What is the best way to ...
245
votes
5answers
111k views

What does env x='() { :;}; command' bash do and why is it insecure?

There is apparently a vulnerability (CVE-2014-6271) in bash: Bash specially crafted environment variables code injection attack I am trying to figure out what is happening, but I'm not entirely sure ...