Server Security - Page 12 - Results from #220

Discover Server Security News

PHP 5.2.12 closes security holes

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

The PHP developers have released version 5.2.12 of their popular programming language, fixing over 60 bugs mainly to increase stability, but also closing some security holes. While PHP 5.3 has been available since mid 2009, backwards compatibility issues with various popular PHP applications have prevented many users from upgrading. Since, as a result, the 5.2 branch is still used on numerous systems, the developers continue to update this branch.

LinuxSecurity.com Team
Dec 18, 2009

Prevent web application hacking with Packt's New ModSecurity Book

Packt is pleased to announce ModSecurity 2.5, a new book that system administrators can use to secure their system by knowing exactly how a hacker would break into it. Written by Magnus Mischel, this book covers in depth details about Mod Security rule language elements such as variables, actions, and request phases.

LinuxSecurity.com Team
Dec 14, 2009

Linux kernel vulnerabilities closed

Several Linux distributors are releasing updated kernel packages to close security holes in the kernel. For instance, very large packets can reportedly be used to remotely provoke a flaw in the TCP/IPv4 stack's ip_defrag() (net/ipv4/ip_fragment.c) function. This can potentially cause null-pointer dereferencing and crash a system.

LinuxSecurity.com Team
Dec 10, 2009

Hypervisor Security Concerns

The basic idea/thesis of this article (and the previous, unfinished draft) is this: hypervisors are getting more and more common, and are growing in deployment in everything from datacenter systems to embedded consumer electronics. But, as their deployment increases, more and more security concerns come into play, including a variety of attack methods and the dire consequences of a compromised hypervisor.

LinuxSecurity.com Team
Dec 03, 2009

Free database firewall protects PostgreSQL and MySQL

Version 1.2 of GreenSQL is now able to protect PostgreSQL as well as MySQL. GreenSQL is designed to protect databases against SQL injection attacks and other unauthorised changes, in a similar fashion to a firewall protecting a network against TCP/IP outside attacks. The new version also provides a graphical user interface for monitoring the database firewall.

LinuxSecurity.com Team
Dec 03, 2009

Root exploit for FreeBSD

An exploit for FreeBSD is in circulation that allows users with restricted access to escalate their privileges to root level. The problem is caused by a flaw in the run-time link editor (rtld) which, in certain circumstances, accepts specially crafted environment variables. According to Kingcope, the developer of the exploit, the flaw is "incredibly easy" to exploit by, for example, setting a path to a specially crafted library for the LD_PRELOAD environment variable and then starting an SUID program like Ping.

LinuxSecurity.com Team
Dec 01, 2009

Total security in a PostgreSQL database

Database security is the single biggest concern with today's Web-based applications. Without control, you risk exposing sensitive information about your company or, worse yet, your valuable customers. In this article, learn about security measures you can take to protect your PostgreSQL database.

LinuxSecurity.com Team
Nov 30, 2009

openSUSE kernels on 1&1 root servers may be out of date

According to a German IT service provider, users running 1&1 servers with openSUSE 11 as their distribution should check the version number of their Linux kernel. In order to guarantee full support for the hardware it uses, for openSUSE, 1&1 installs its own homemade kernel. Unfortunately this kernel disables the YAST auto-update function, with the result that, despite regular updates, the kernel (2.6.27.21) remains several months old

LinuxSecurity.com Team
Nov 27, 2009

Practical Analysis: The Fastest-Growing Security Threat

SQL injections, more than any other exploit, can land your company in trouble. So why aren't you worried about them? Few things make a CIO's eyes glaze over like the mere mention of SQL injections. Unless they cut their teeth in security or SQL programming, chances are that the folks who control the purse strings don't understand these increasingly common attacks. That's a real issue because you're probably making decisions that could exacerbate the problem.

LinuxSecurity.com Team
Nov 11, 2009

Does Wine Make Linux Too Loose?

For those Wine aficionados out there, beware of the remote possibility that your Linux system could be infected by Windows-seeking malware. "WINE running a Windows virus is nothing more than a 'stupid Linux trick' ... for now," said Slashdot blogger hairyfeet. But if the year of the Linux desktop ever arrives, he wonders, can Linux hold up to a "tidal wave of stupidity"?

LinuxSecurity.com Team
Nov 06, 2009

Hole in the Linux kernel allows root access

A null pointer dereference in the Linux kernel can be exploited to access a system at root privilege level. The hole is reportedly contained in pipe.c and can occur in certain circumstances when using the pipe_read_open(), pipe_write_open() or pipe_rdwr_open() functions while releasing a mutex (mutual exclusion) too early

LinuxSecurity.com Team
Nov 04, 2009

Thwarting SQL Injection Threats

New Dark Reading report explores what database developers and database administrators can do about the pervasive SQL injection attack.

LinuxSecurity.com Team
Nov 03, 2009

Email Security: Top 10 E-mail Blunders Of 2009, So Far

E-mail, the Internet's first killer app, can injure companies and individuals when not used with care. In its attempt to document the risks of electronic messaging and to make the case for the value of its services, Proofpoint, an e-mail security company, has assembled a list of what it considers are the "Top 10 Terrifying E-mail Blunders of 2009."

LinuxSecurity.com Team
Oct 30, 2009

WordPress Hardening

Today one of our readers sent an interesting post from the developers of WordPress. It is about a just released version 2.8.5. This version is called as the "Hardening Release", which I thought was quite great! According the post, these were new security features from the new 2.9 series that they decided to backport to the 2.8.x tree.

LinuxSecurity.com Team
Oct 22, 2009

Six Steps Toward Better Database Security Compliance

In a sea of compliance initiatives, database security is often overlooked. But experts say no matter what the regulations say, securing the database is a critical part of any compliance effort.

LinuxSecurity.com Team
Oct 12, 2009

First root server provides a DNSSEC-signed zone as of December 1st

Joe Abley of ICANN and VeriSign manager Matt Larson announced, at the 59th meeting of the "R

LinuxSecurity.com Team
Oct 07, 2009

Databases' Most Serious Vulnerability: Authorized Users

In all of their frenzy to protect sensitive data from hackers and thieves, many organizations overlook the most likely threat to their databases: authorized users.

LinuxSecurity.com Team
Oct 02, 2009

Get network versatility with SSH tunneling and netcat

Vincent Danen explains how to use netcat with SSH tunneling when you need to create a secure connection to a server from a remote location.

LinuxSecurity.com Team
Sep 29, 2009

Websense warns of web-based malware epidemic

The growing threat to businesses from the web was put into sharper focus today, after security vendor Websense reported a whopping 671 per cent rise in the number of malicious sites during the past year.

LinuxSecurity.com Team
Sep 16, 2009

FreeBSD bug grants local root access

A security researcher has uncovered a security bug in the FreeBSD operating system that allows users with limited privileges to take full control of underlying systems.

LinuxSecurity.com Team
Sep 14, 2009

Server Security - Page 12

Securing Your Linux Server: Understanding and Mitigating Modern Threats

Essential Server Security Security Strategies for Administrators

Ensuring Linux Server Security: A Comprehensive Guide