|
Source: keneltrap - Posted by Bill Keys
|
Patches for a much publicized Linux kernel local root exploit were released today as 2.6.24.2, 2.6.23.16, and 2.6.22.18. The latest bug, labeled as CVE-2008-0600, was introduced by the vmsplice() system call and added into the 2.6 kernel in 2.6.17. It is the third in a series of root exploits surrounding the same system call, the two earlier bugs being CVE-2008-0009 and CVE-2008-0010. Easily obtained exploits exist for both the older CVE-2008-0010 which affected the 2.6.23 and 2.6.24 kernels, and the latest CVE-2008-0600, allowing a local non-root user to gain root permissions.
You mostly likely heard about the local root exploit patch which was released a few days ago. Any exploit dealing with the root users can be a serious problem. Have you patched your Linux Kernel yet?Write Comment (1 Comments) |
|
|
Source: Linux.com - Posted by Ryan Berens
|
|
In this review from Linux.com, you get into some of the details on our Open Source tool of the month. The Zenmap front end for Nmap is covered, its new enhancements as well as what to do with the Command Wizard. It also covers some of the basics on port scanners too...
Sometimes criticized for helping the bad guys find opening in the cracks of sites on the Internet, their real value is in allowing network security pros -- and those trying to protect their own machines and networks -- to test their own defenses. They can help ordinary users learn more about networking and network security. Write Comment |
|
|
Source: DarkNet - Posted by Bill Keys
|
|
AntiTamper is an Apache 2.x module that could be used to prevent some sort of url and cookie tampering.
Specifically, AT could stop a lot of those malicious bots that take advantage from search engines. Moreover, attack techniques like HTTP Response Splitting and session hijacking/fixation will be mitigated.
I am interested if anyone has tested out mod_anti_tamper. I like using mod_security but mod_anti_tamper look like it will work well side my side with mod_security increase a web servers security. Write Comment |
|
|
Source: DarkNet - Posted by Bill Keys
|
|
ModSecurity is an open source intrusion detection and prevention engine for web applications (or a web application firewall). Operating as an Apache Web server module or standalone, the purpose of ModSecurity is to increase web application security, protecting web applications from known and unknown attacks.
Anything which helps Web application to be more secure is a very good thing. Have you implemented ModSecurity on your Apache server?
Write Comment |
|
|
Source: Information Week - Posted by Ryan Berens
|
Linux is often known for being a staple of security. Whether its about the kernel itself, the secured applications or in this case viruses, Linux has always been up to the challenge. what happens if the big boys like Symantec or Norton start making A/V for Linux platforms? Would it even be needed...
So what about viruses written specifically to target Linux? Yes, such beasts do indeed exist. That said, the nature of an open-source platform makes it that much easier (and faster) to close over the holes that they exploit. This is as it should be, and right now a big part of the appeal of running Linux on the desktop is that you're not a broad target for malware.Write Comment |
|
|
|
<< Start < Prev 1 2 3 Next > End >>
|
| Results 10 - 18 of 729 |
