Server Security

Discover Server Security News

BIND bug opens domain name servers to attack

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

A flaw in BIND, a widely used software for locating Internet servers, could allow hackers to take companies' Web sites offline. Researchers have discovered a flaw in widely used software for locating Internet servers, which could allow the software to . . .

LinuxSecurity.com Team
Jun 05, 2002

BIND glitches could trigger DoS attacks

Security organizations have issued an alert about a BIND vulnerability which could see companies face denial-of-service attacks. The vulnerability is found in version 9 of the Internet Software Consortium's BIND (Berkeley Internet Name Domain) server. If it's exploited by an . . .

LinuxSecurity.com Team
Jun 05, 2002

Writing PAM Modules, Part Three

PAM stands for Pluggable Authentication Modules and is a system for providing application independence for authentication. A PAM-enabled application calls a stack of PAM modules to run authentication, open and close sessions, and check account validity.. . .

LinuxSecurity.com Team
Jun 03, 2002

New security attack identified: Denial of Responsibility (DoR)

A recent report from the National Association for Security and Trust Evaluation warns of an increase in serious security breaches known as Denial of Responsibility (DoR) attacks. "Each attack is much more dangerous than traditional security flaws," says Warren N. Veighn of the Association, "because the extent of the vulnerabilities is so great, the time they affect deployed systems can stretch out to decades, and getting the source of the problem to react appropriately is by definition very difficult." . . .

LinuxSecurity.com Team
Jun 03, 2002

Systrace - Interactive Policy Generation for System Calls

Systrace enforces system call policies for applications. The policy can be generated interactively. Systrace can constrain the access that an application gets to the system. Operations not covered by the policy raise an alarm and allow an user to refine the currently configured policy.. . .

LinuxSecurity.com Team
May 31, 2002

Linux.Simile: Windows Virus that affects Linux Too?

{Win32,Linux}/Simile.D is a very complex virus that uses entry-point obscuring, metamorphism, and polymorphic decryption. It is the first known polymorphic metamorphic virus to infect under both Windows and Linux. The virus contains no destructive payload, but infected files may display messages . . .

LinuxSecurity.com Team
May 31, 2002

PerlMx Provides New Email Security for Enterprises

ActiveState has released a new enterprise version of PerlMx 2.0, our email security and filtering software for sendmail. PerlMx operates at the gateway and is over 98 percent effective in identifying spam. It now has virus, spam, and corporate communications compliance . . .

LinuxSecurity.com Team
May 28, 2002

SQL Injection Walkthrough

When a machine has only port 80 opened, your most trusted vulnerability scanner cannot return anything useful, and you know that the admin always patch his server, we have to turn to web hacking. SQL injection is one of type of . . .

LinuxSecurity.com Team
May 28, 2002

File Locking Local Denial of Service: Impact on Sendmail

This article discuss how sendmail currently handles file locking and how it will change in future versions. "Any application which uses either flock() or fcntl() style locking or other APIs that use one of these locking methods (such as open() with O_EXLOCK and O_SHLOCK) on files readable by other local untrusted users may be susceptible to local denial of service attacks.". . .

LinuxSecurity.com Team
May 24, 2002

Comment: Web sites insecure as ever

Most, if not all, of corporate web sites are fundamentally insecure. And this insecurity can allow attackers to access databases, delete or change information, and cause absolute chaos with very little effort or technical know how. . . .

LinuxSecurity.com Team
May 22, 2002

How Can You Defend Against a Superworm?

Give an exploit to script kiddies, and they'll hit every vulnerable host in weeks. Build a worm with it, and it could take days. How long would a superworm take? Try 30 seconds. Brandon Wiley explains superworms and some possible self-defense . . .

LinuxSecurity.com Team
May 15, 2002

Tips on basic Linux server security

If you just put your Apache web server online, and are thinking into making the first step in your system security, this brief article will help you do that. By having your own server, you must understand the responsibility behind it. . . .

LinuxSecurity.com Team
May 14, 2002

Network Forensics: Tapping the Internet

During the Gulf War, computer hackers in Europe broke into a UNIX computer aboard a warship in the Persian Gulf. The hackers thought they were being tremendously clever -- and they were -- but they were also being watched. . . .

LinuxSecurity.com Team
May 02, 2002

XP Updates Start to P.O. Users

As many as three times a week, on average, XP users see a little window pop-up at the bottom of their computer screens announcing the availability of another new update for their system. This plethora of patches has left many users wondering whether their hard drives are big enough to handle "Trustworthy Computing.". . .

LinuxSecurity.com Team
Apr 29, 2002

Multiple vulnerabilities in stack smashing protection technologies

"Stack shielding" software have been developed on the promise of preventing exploitation of buffer overflow vulnerabilities that make use of the stack smashing techniques. We discovered that all of them present basic design limitations as well as some implementation flaws.. . .

LinuxSecurity.com Team
Apr 24, 2002

Cookies Take A Bite Out Of Security

As if IT managers didn't have enough security headaches, the rise of Web site-based intrusions has risen over the last year, with aggressive cookies and pop-up-spawned spyware leading the charge. Products like the Gator password manager utility are reported to include a Web-user monitoring component, which may even cause Web browsers to crash or behave erratically.. . .

LinuxSecurity.com Team
Apr 17, 2002

Potential Vulnerability in LIDS 1.1.1

There is a possibility to use a capability from LIDS protected binaries for arbitrary users. For example if some binary has the CAP_SETUID capability granted, a general user can execute this binary under a arbitrary user ( could be the root ).. . .

LinuxSecurity.com Team
Apr 10, 2002

Denial-of-service attacks still a threat

Denial-of-service (DOS) attacks continue to present a significant security threat to corporations two years after a spate of incidents brought down several high-profile sites, including those of Yahoo Inc. and eBay Inc., users and analysts report. Since then, several technologies . . .

LinuxSecurity.com Team
Apr 10, 2002

Server port 80 plagues Internet security

THE INTERNET HAS become a riskier place for businesses since the fall of 2001 and doesn't look to be any more secure in the near future, according to security firm Internet Security Systems, which released its security incident figures for the first quarter of 2002 Wednesday. . . .

LinuxSecurity.com Team
Apr 04, 2002

How to set up IMAP on the cheap, Part 2

This is the second in a series of articles about how to install and configure the Cyrus IMAP mail server, Postfix SMTP, and Procmail for server-side mail filtering. Last week, we covered the installation and basic configuration for Cyrus IMAP.. . .

LinuxSecurity.com Team
Apr 02, 2002

Magnet Goblin Hackers Exploit One-Day Flaws to Deploy Custom Linux Malware

New Bifrost Malware Evades Detection, Threatens Linux Server Security

Cryptocurrency Mining Migo Malware Attacks Linux Redis Servers