Samba servers vulnerable to denial-of-service attacks
642873
Patches released for flaws in software package that lets Windows files and printers be shared by Unix and Linux systems.
643225
A team of analysts has successfully exploited a heap corruption vulnerability on a fully-patched Mac, and users running the Samba file- and printer-sharing application are advised to update the application manually.
23053
The attack was the most significant attack against the root servers since an October 2002 distributed denial of service attack.
427676
Database giant investigates DenyHosts reports Compromised computers at Oracle UK are listed among the 10 worst offenders on the net for launching attacks on servers which run SSH (secure shell) server software.â¦
90388
A distributed multi-protocol load testing tool.
316820
The purpose of this article is to analyze a public exploit in a lab environment, see the alerts generated by an intrusion detection system, and then do some packet analysis of the malicious binary in order to better understand it.
737263
This paper discusses the use of NetFlow, a traffic profile monitoring technology available on many routers, for use in the early detection of worms, spammers, and other abnormal network activity in large enterprise networks and service providers. Part 2 of 2.
449182
Multiple vulnerabilities have been reported in version five of the widely-used Kerberos authentication protocol. The most serious could be exploited by crackers to gain root control to authentication servers.
710855
(InfoWorld) - A security researcher has found a serious vulnerability in an aging yet widely used software program used for the Internet's addressing system, prompting the software's maintainers to retire the affected version. The flaw within Berkeley Internet Name Domain 8 (Bind 8) software could misdirect users to a fraudulent Web site even if a user typed in the correct URL (uniform resource locator), wrote Amit Klein, chief technology officer for security vendor Trusteer. Klein discovered the problem. Users are being advised to upgrade to Bind 9.4, the latest version of the software, which underwent an architectureÂ rewrite to improve security. The software, looked after by the Internet Software Consortium (ISC), is free to download. ISC issued an interim patch, but due to other weaknesses in the software, ISC is also ending support for Bind 8. "It's never easy to retire a product," wrote the organization in an advisory. "The security issues of Bind 8 are many, and seven years after the release of Bind 9, ISC must devote our efforts to maintaining and enhancing the current version." About 14 percent of the DNS servers on the Internet in 2006 were still using Bind 8, according to Infoblox, which conducts an annual survey of DNS servers. "Bind 8 is still a very popular DNS server nowadays, thus this attack applies to a big part of Internet users," Klein wrote. In a research paper, Klein described a weakness in the algorithm Bind 8 uses to generate transaction IDs, apparently random serial numbers that allow it to spot whether someone is trying to supply it with false information in respose to queries. The weakness makes it possible to observe a few queries and then predict the transaction ID in the sequence, Klein wrote. Using that information, an attacker can then send erroneous information to the DNS server, "poisoning" the address stored against a particular domain name in its memory cache. Thus, traffic intended for a certain Web site from users of that DNS server can be diverted to another server containing a fraudulent site, a deception known as "pharming." Although Bind 9 has a better transaction ID algorithm, it could also be vulnerable, Klein wrote. Â
233929
Ziff Davis - Anti-Santy-Worm V4 attempts to patch vulnerable Web forum software but might cause denial-of-service attacks.
547051
The SANS Institute has issued its latest list of the 20 most critical Internet security vulnerabilties. Web servers top the list for Windows-based systems and fall second on the list of Unix and Linux systems.
384130
Hackers could exploit the vulnerabilities to launch DOS attacks and bypass user authentication on the servers.
385776
This article begins a series of three articles dedicated to configuring Apache 2.0 with SSL/TLS support, in order to ensure maximum security and optimal performance of secure web communication. This part introduces key aspects of SSL/TLS and then shows how to compile and configure Apache 2.0 with support for these protocols.
504765
Symantec has announced that several of its firewalls and gateways are vulnerable to denial of service attacks, and has released firmware to fix them.
633181
Gareth Heyes has a new post today talking about one of the vulnerable values in the $_SERVER superglobal - PHP_SELF.   I thought it might be a good idea to gather a few test cases demonstrating the problem. Why PHP allows these URL's is beyond me and it wouldn't take much work to filter out these malicious URL's in the PHP code.   He provides four test cases to show how simple it is to abuse - one using a HTTP header, another pushing XSS through, the third mentions search pages and the fourth a direct code injection.   You can download the code here.
316177
An attack combining malicious codes on Web sites and end-user laziness could compromise millions of routers still configured with their out-of-the-box defaults.
635724
In a new post on his blog, Christian Wenz mentions the latest results of the SANS Institute's Top 20 Internet Security Attack Targets list which both includes a new entry ("Users") and several mentions of PHP and PHP-related applications.   Of course you can debate how such a Top list came together and what the real value behind that is, but there are two specific points in this year's list that I found quite interesting.   There's two targets for the PHP community to worry about - sysadmin/hosting and things developers need to keep in mind. Items on these lists include:  Always test and deploy patches and new versions of PHP as they are released Use Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests. Consider using Apache's mod_security to block known PHP attacks If you use PHP, migrate your application to PHP 5.2 as a matter of urgency. Encode all output using htmlentities() or a similar mechanism to avoid XSS attacks  You can check out the full information over on the SANS Institute website.