Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 8 articles for you...
74
security advisoryDoSdesign flawIEEE 802.11 Flaw: Critical Threat to Linux And Android Devices
A group of academics from Northeastern University and KU Leuven has disclosed a fundamental design flaw in the IEEE 802.11 Wi-Fi protocol standard, impacting a wide range of devices running Linux, FreeBSD, Android, and iOS. . Successful exploitation of the shortcoming could be abused to hijack TCP connections or intercept client and web traffic, researchers Domien Schepers, Aanjhan Ranganathan, and Mathy Vanhoef said in a paper published this week. The approach exploits power-save mechanisms in endpoint devices to trick access points into leaking data frames in plaintext, or encrypt them using an all-zero key . "The unprotected nature of the power-save bit in a frame's header [...] also allows an adversary to force queue frames intended for a specific client resulting in its disconnection and trivially executing a denial-of-service attack," the researchers noted. In other words, the goal is to leak frames from the access point destined to a victim client station by taking advantage of the fact that most Wi-Fi stacks do not adequately dequeue or purge their transmit queues when the security context changes. The link for this article located at The Hacker News is no longer available. . A newfound vulnerability in the Bluetooth standard threatens security on Windows, macOS, and Android, exposing them to data theft and denial-of-service risks. Wi-Fi Exploitation, Linux Protocol Flaw, Device Security Risk. . Brittany Day
Mar 31, 2023
•
Network Security
210
security advisorysecurity issuedesign flawLinux Kernel: New Side-Channel Risk for DNS Cache Poisoning Attack
A recent research paper by a team at University of California, Riverside, shows the existence of previously overlooked side channels in the Linux kernels that can be exploited to attack DNS servers . According to the researchers, the issue with DNS roots in its design, that never really took security as a key concern and that made it extremely hard to retrofit strong security features into it. . While DNS security features are available, including DNSSEC and DNS cookies, they are not widely deployed due to backward compatibility, say the researchers. Instead, the only approach to make DNS more secure has been the randomization of UDP ports, known as ephemeral ports, with the aim to makes it harder for an attacker to discover them. As a result of this, several attacks to DNS have been discovered in the past, including the recent SAD DNS , a variant of DNS cache poisoning that allows an attacker to inject malicious DNS records into a DNS cache, thus redirecting any traffic to their own server and becoming a man-in-the-middle (MITM). . Investigating an emerging side-channel vulnerability within the Linux kernel that facilitates DNS cache contamination exploits.. DNS Poisoning, Linux Kernel Security, Side-Channel Threat, DNS Security Issues, Network Attack Methods. . Brittany Day
Nov 30, 2021
•
Security Vulnerabilities
210
security advisoryexploitdata exchangeApple M1RACLES Covert Channel Flaw: Discovery and Implications
Hector Martin, a hacker who is porting Linux to Apple Silicon Macs through Asahi Linux, has discovered a novel covert channel vulnerability on the M1 chip, calling it ‘M1RACLES’ and tracked as CVE-2021-30747. The flaw lies in the design of the chip itself, allowing any two applications running under an OS to covertly exchange data between them without using memory, sockets, files, or any other features that are meant to be used for data exchange. "While this shouldn’t be allowed as it bypasses OS security layers, it is nothing to worry about in practice." . This problem applies even if the two intercommunicating processes belong to different users and run on different privilege levels. Because this vulnerability is bound to the chip itself, it doesn’t matter if the user is running macOS, or Linux, or OpenBSD, or anything else on it. Every M1 device is affected by M1RACLES, and the only mitigation that can address the issue is to run the entire OS as a virtual machine. Obviously, this would impact the performance greatly, but would it be worth it? Is M1RACLES that serious to call for such a drastic measure? . SHADOWLINK, a hidden vulnerability on Apple M2, enables apps to share information discreetly, impacting various operating systems.. M1RACLES, Apple Silicon exploit, covert channel security flaw, Hector Martin discovery, Linux on M1. . Brittany Day
May 26, 2021
•
Security Vulnerabilities
77
security advisorymoderatelocal accessAstaro Security Linux 2.016 Advisory Moderate Design Flaws
Several serious theoretical and practical security vulnerabilities, alleged GPL license violations, and more were found in Astaro "secure" Linux. Joerg Luebbert writes, "Some of the vulnerabilities might be local and some might argue about that Astaro Security Linux is a Firewall and no server... but as it uses SSHD it could always be that the "loginuser" account might have been compromised and shell access granted.". . .. Several serious theoretical and practical security vulnerabilities, alleged GPL license violations, and more were found in Astaro "secure" Linux. Joerg Luebbert writes, "Some of the vulnerabilities might be local and some might argue about that Astaro Security Linux is a Firewall and no server... but as it uses SSHD it could always be that the "loginuser" account might have been compromised and shell access granted." Date: Sat, 02 Feb 2002 19:40:08 +0100 From: "[ISO-8859-1] Jörg Lübbert" To: bugtraq@ Subject: Vulnerabilities in Astaro Security Linux 2.016 Preamble: Product: Astaro Security Linux Version: 2.016 Vendor: Astaro AG Vendor URL: Vendor status and reply: Vendor has been contacted with posting of this message Description: Astaro develops and distributes the firewall solution Astaro Security Linux. Astaro Security Linux offers extensive protection for local networks against hackers, viruses and other risks of connecting to the Internet. Astaro Security Linux is distributed by a worldwide network of partners who offer local support regarding installation and maintenance. Introduction: Dear BugTraq readers. I've taken a short glimpse on Astaro Security Linux and found out some points of interest that are mostly design flaws. Please note that I am theorising (based on a 1 1/2 hour research only) about the impacts and have not proven their concepts on Astaro Security Linux yet even though most can be proved easily. Some of the vulnerabilities might be local and some might argue about that Astaro Security Linux is a Firewall and no server... butas it uses SSHD it could always be that the "loginuser" account might have been compromised and shell access granted. Vulnerabilities: Summary: 5 Design flaws 2 Completely theorised design flaws 1 Possible design flaw 1 Licensing violation 1 Software bug Category 1: Design flaw Problem 1: Astaro Security Linux chroots various daemons like snmpd and named in an insecure manner. The proc filesystem is mounted within their chroot jails. Furthermore the chroot jail entitled chroot-ipsec provides the proc file system, a bash, ls, cat and most notably mount. Impact 1: Arbitrary users could cause severe damage by breaking the named or snmpd remotely and by misusing the proc file system to reconfigure certain parts of the system configuration under proc/sys. Furthermore proc/kcore could be read to obtain information stored in memory which could lead to system administrator privileges. These could for instance be DES encrypted passwords which leads to another design flaw Exploit 1: None provided Category 2: Design flaw Problem 2: Astaro Security Linux uses the DES algorithm as standard hashing scheme. DES has turned very old and is known to be easily crackable with modern processing power. Impact 2: Arbitrary users who obtain encrypted passwords (see 1) could retreive a 6 letter clear-text password within just some hours using modern processing power and use it to compromise the system. Exploit 2: None provided Category 3: Design flaw Problem 3: Astaro Security Linux runs most of its daemons with UID 0 privileges. Affected daemons are: named or snmpd. These daemons run in a chroot jail. Impact 3: Arbitrary users could remotely crack one of the affected daemons and use UID 0 powers to compromise the whole file system even if these daemons run in a chroot jail. Additional note 3-1: The main design flaw lies within that these daemons run UID 0 within a chroot jail. The daemons itself are not the design flaw (even though BIND 8.2.3 can be considered old). Additional note3-2: Other daemons with UID 0 are syslogd, klogd, mdw_daemon.pl, cron, aua and sshd. VPN subsystem, SQUID and others haven't been checked by me. Exploit 3: None provided Category 4: Possible design flaw Problem 4: OpenSSL PRNG Internal State Disclosure Vulnerability Impact 4: Please see: Exploit 4: None provided Additional note 4: It was NOT tested if the version of OpenSSL (0.9.6) used in Astaro Security Linux is a security-patched version of OpenSSL 0.9.6 since no sources were provided (5) Category 5: Licensing violation Problem 5: Astaro AG releases software packages without providing their sources and modifications to them as required in §3 of the GNU GPL and neither seems to offer distribution of GPL sources for free within a 3 year period in a written form. Additional note 5: I have not checked every available documentation for a written form of an offer as described in GNU GPL §3 b but only their license (which should normally contain just that) and CD-ROM contents. Category 6: Design flaw Problem 6: Astaro Security Linux has a default limit for simultaneously processes of 8190 soft and 8912 hard and its default cpu-time is "unlimited". Impact 6: Arbitrary users with local access (loginuser) can easily launch fork bombs to consume 100% CPU power and stop the system from operating. Exploit 6: None provided Category 7: Completely theorised design flaw Problem 7: Astaro Security Linux uses a very old version of PAM (0.70 dated 09.10.1999) which maybe contains vulnerabilities. Category 8: Design flaw Problem 8: /proc/version indicates "Linux version 2.4.8-asl-0.010815.0", which indicates the 2.4.8 version of the Linux kernel that contains some security vulnerabilities. Additional information on possible vulnerabilities can be found here: Impact 8: Various, see above URLs. Exploit 8: None provided Additional note 8: Due to absence of source code it could not be proved if this kernel is patched against the security issues mentionedabove. Category 9: Completely theorised design flaw Problem 9: Astaro Security Linux seems to rely on an old version of glibc according to ls -l /lib/libc*. Output: -rwxr-xr-x 1 root root 1080268 Sep 15 2000 libc.so.6 If my assumption is correct and the version used was not patched, it could be possible that the system is vulnerable to a "glibc file globbing heap corruption vulnerability". For more information please see: Impact 9: See URL above Exploit 9: None provided Category 10: Software bug (OT for Bugtraq, still included;) Problem 10: During installation one can choose to install OpenSource software only or OpenSource software and the so called Astaro Security Enterprise Toolkit. When only "OpenSource" was chosen, the installer locks up after entry of the last password (I think this was for lilo). If my assumption is right (that a lilo password is asked for) then no lilo password will be set even though the Enterprise Toolkit was selected and the installation finished successfully. Additional note 10: System tested on was 800MHZ Duron, 128MB RAM, 20GB Maxtor HD, 52X CD-ROM, 3X RTL 8139. Final words: Conclusion, a final word to the Astaro AG: So much about a "Security Linux"... You may have done the firewalling and the configuration interface of your product real good... but you should also read some articles on what could be considered more internal security and work on your products some more. Disclaimer: None of the information provided are meant to aid any destructive purposes. I will furthermore take no responsibility for that anyone will use the information provided for his or her own malicious purposes. This information is intended to aid in improving the current state of Astaro Security Linux, warn companies and individuals who run Astaro Security Linux and should help other designers of Linux distributions to avoid flaws like the ones elaborated on above. Please also not that I am in no way affiliated with Astaro AG or any of their 3rd party affiliates or wantto harm Astaro AG and/or their customers. - Jörg Lübbert (aka Kaladis) -- Kaladix Linux - The Secure Linux Distribution URL: . Numerous practical security weaknesses and design flaws are highlighted in Astaro Security Linux, indicating critical issues.. Astaro Security Linux, design flaws, security weaknesses, GPL violations, access control. . LinuxSecurity.com Team
Jun 02, 2019
•
Server Security
83
security advisorymalwarerootkitSecurity Flaw in Intel x86 Architecture Enables Undetectable Rootkits
A design flaw in the x86 processor architecture dating back almost two decades could allow attackers to install a rootkit in the low-level firmware of computers, a security researcher said Thursday. Such malware could be undetectable by security products.. The vulnerability stems from a feature first added to the x86 architecture in 1997. It was disclosed Thursday at the Black Hat security conference by Christopher Domas, a security researcher with the Battelle Memorial Institute. The link for this article located at CSO Online is no longer available. . An architectural vulnerability in ARM chips might allow malware to embed itself in hardware, escaping the scrutiny of antivirus programs.. x86 Architecture, Rootkit Risk, Malware Threats. . LinuxSecurity.com Team
Aug 07, 2015
•
Hacks/Cracks
67
data securityinformation securitynetwork protocolExamining Design Flaws In Cryptographic Protocols: ENISA Insights
The cryptographic protocols used to secure data moving across the web are putting users at risk due to design flaws that date back many years. Given the current push to encrypt everything in response to revelations of government surveillance, it's important that the protocols being used to do the job are actually secure.. The problem is that these protocols often aren't up to the task, a problem that researchers at the European Union Agency for Network and Information Security (ENISA) are aiming to remedy. The link for this article located at ZDNet Blogs is no longer available. . The National Cyber Security Centre studies network security models to address vulnerabilities and improve information protection measures.. cryptographic protocols, data security, network risks. . LinuxSecurity.com Team
Nov 24, 2014
•
Cryptography
83
security advisorymobile securitydesign flawGlobal SIM Card Flaw: User Vulnerability Exposed By Karsten Nohl
Renowned German code-breaker Karsten Nohl, who uncovered a design flaw in around 750 million SIM cards around the world leaving them vulnerable to hack attacks, told RT that phone users are helpless against hackers.. The link for this article located at RT is no longer available. . In a recent exposé, cyber expert Sarah Jennings illustrates the vulnerability of smartphone owners amid widespread SIM card infiltration threats.. SIM Card Security, Hack Awareness, Design Flaw Analysis. . LinuxSecurity.com Team
Jul 23, 2013
•
Hacks/Cracks
74
security advisoryfirefoxdesign flawMozilla Firefox 4: Security Advisory on WebSocket Protocol Design Flaw
Due to a vulnerability in the design of the WebSocket protocol, the Mozilla Foundation has decided to disable support for this protocol in the forthcoming Firefox 4 Beta 8 release. The vulnerability in the code for transparent proxies can potentially be exploited to poison the proxy cache and inject manipulated pages.. This could allow attackers to inject a specially crafted JavaScript for Google Analytics into the proxy's cache that will be returned to clients and executed in their browsers after every subsequent request. A group of researchers described the problem on the IETF mailing list in November. In their document, the researchers make suggestions on how to fix the vulnerability. The link for this article located at H Security is no longer available. . Mozilla has turned off WebSocket support in Firefox 4 following the discovery of a design vulnerability that could permit JavaScript injection through manipulation of proxy cache mechanisms.. WebSocket Security, Mozilla Flaw, Proxy Exploit. . Anthony Pell
Dec 09, 2010
•
Network Security
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!