Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
How can you prevent a "local privilage escalation exploit?"
By lowering chances. Like staying current with updates. Host hardening can help.
Is there certain software you dl or do you need to play around with your OS settings?
Wha?
Or is it more complicated than the "do not run as root" argument?
Yes. Say there is a problem within the running kernel. Say the problem can be triggered by anyone who has a valid and accessable account on the machine. Then you only need two steps (get the code on the system and have it run) to get what you want (a root shell). I was thinking of the kernel 2.4 series do_mremap() exploits. The patches where available but a lot of people just did not care to patch when the fix was out so a lot of boxen got hit. As for host hardening: at the time (2004-ish) the only people who where safe (IIRC and I don't know if it was for all mremap exploits) where those who ran OpenWall or Grsecurity patched kernels, BTW.
I have a question about email address security. I was using firefox in Suse Linux to look at apple's line of systems just out of curiosity and then the next day a spam message about a free apple notebook was in my main inbox of yahoo mail. (Btw, I use gnome.) I get that crap all the time but it is usually in bulk mail. Was that a coincident or perhaps an exploit? Or do attackers have a non-hacking way to read cookies that might store my e-mail address? I then upgraded to firefox 1.5.07 from 1.5.02. Maybe I should use Konqueror or something.
I have a question about email address security. I was using firefox in Suse Linux to look at apple's line of systems just out of curiosity and then the next day a spam message about a free apple notebook was in my main inbox of yahoo mail. (Btw, I use gnome.) I get that crap all the time but it is usually in bulk mail. Was that a coincident or perhaps an exploit? Or do attackers have a non-hacking way to read cookies that might store my e-mail address? I then upgraded to firefox 1.5.07 from 1.5.02. Maybe I should use Konqueror or something.
there really isn't any way to know for sure what happened... might have been a coincidence, or it might have not... either way, it's a good idea to always run the latest firefox version whenever possible... and use noscript if you can...
if you're concerned about some site having taken advantage of a vulnerability in your old firefox version, i would suggest backing-up your documents and then deleting your home folder's contents and starting a new account from scratch... keep in mind this won't help if you got rooted, but it will take care of any user-level malware that you might have gotten hit with... at the very least, it'll give you a little more peace of mind...
I noticed the article about the recent Firefox problem (I posted the article link earlier) seems to focus on Java.
When I go to Firefox "preferences" then "content" I notice two (2) Java related options:
1) Enable Java
2) Enable Javascript
My questions:
a) What is the difference between these two options
b) If I simply "uncheck" one (1) or both of those boxes, and the firefox flaw is indeed Java related, then wouldn't this just be an easy fix? Then all I would have to do is check the box(s) if I run into a website requiring Java. Or is it more complicated than that?
b) If I simply "uncheck" one (1) or both of those boxes, and the firefox flaw is indeed Java related, then wouldn't this just be an easy fix? Then all I would have to do is check the box(s) if I run into a website requiring Java. Or is it more complicated than that?
Thanks!
disabling javascript MIGHT be a work-around... but as has been stated by unSpawn, firefox has some javascript security issues even with javascript disabled...
instead of using the firefox configuration to enable/disable javascript as needed, i would suggest installing the noscript extension, which will let you whitelist sites you wish to allow javascript for (among other things)...
keep in mind that if the firefox code is indeed as messed-up as those two crackers say it is, then none of these approaches is likely to be a *true* workaround - we'll probably just need to wait for the code to get patched...
A pair of presenters at the ToorCon conference in San Diego over the weekend claimed to have knowledge of a series of Javascript vulnerabilities in the open source Firefox browser. On Tuesday, however, the duo admitted that their claims were untrue and meant to be humorous. "I think it's an attempt on their part to grab some of the limelight," said IT-Harvest Chief Research Analyst Richard Stiennon.
So much for Javascript being messed up in Firefox.
For the sake of argument, let us assume that those vulnerabilities are indeed real (i.e., those two crackers did indeed find serious problems).
Will "no script" work in Linux? I was under the distinct impression that all firefox "add-ons" were only valid in the Windows version of firefox.
Also, it is a bit off topic, but how does Opera compare to Firefox? I have heard conflicting information about it. Some say it is open source, others do not. Wiki wasn't much help either.
Is there a forum for Opera questions on this website?
Regarding these two crackers. . .I personally won't feel comfortable until BOTH come forward and admit a hoax, not just one. If it were a hoax, then I would really like to know how they faked the video showing the flaws (supposedly they had a video showing the firefox flaws).
Will "no script" work in Linux? I was under the distinct impression that all firefox "add-ons" were only valid in the Windows version of firefox.
yes, noscript works on linux, as do a great deal of extensions... when you go to the firefox extensions site, there is an indicator for each extension letting you know what platforms it works on... notice how noscript says:
Hi all, seem's to me now it's a question of whether or not you believe they did crack it or they did not crack it.
One could theorize they know of cracks, admitted it because firefox is opensource and they were giving a heads up but wanted to make some money for themselves, only to find too much pressure on them from media, or their local government, so to divert attention, said they lied.
IIRC they had Mozilla people there who saw the demonstration and they were convinced that the claims were justifiable based on the info given them.
This really seems shady to me.
Sounds like these guys 'screamed fire in a movie theatre' but still this whole scenario is awefully suspsicious to me. I hope that mozilla really does fully investigate to put closure on this, otherwise it could really be a PR and credibility issue for them.
I agree. So far as I know, only one (1) of the two (2) supposed hackers admitted it was a hoax. Why is the other hacker being silent? Who knows why, but it is cause for concern.
Also, I remember the original article stated that a video was used to show the supposed Firefox bugs. Has anyone checked that video for authenticity? If the bugs are a hoax, then the video must also be a hoax.
I hope Mozilla keeps looking, just to be sure. Better to be safe than sorry.
Mozilla Firefox and SeaMonkey Multiple Vulnerabilities (Highly Critical)
Quote:
Description:
Some vulnerabilities have been reported in Mozilla Firefox and Mozilla SeaMonkey, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting attacks, and potentially compromise a vulnerable system.
1) The bundled Network Security Services (NSS) library contains an incomplete fix for the RSA signature verification vulnerability reported in MFSA 2006-60.
2) An error exists within the handling of Script objects. This can potentially be exploited to execute arbitrary JavaScript bytecode by modifying already running Script objects.
3) Some unspecified errors in the layout engine and memory corruption errors in the JavaScript engine can be exploited to crash the application and may allow execution of arbitrary code.
4) An unspecified error within XML.prototype.hasOwnProperty can potentially be exploited to execute arbitrary code.
Solution:
Update to Mozilla Firefox 1.5.0.8 and SeaMonkey 1.0.6.
Mozilla Firefox Multiple Vulnerabilities (Highly Critical)
Quote:
Description:
Multiple vulnerabilities have been reported in Mozilla Firefox, which can be exploited by malicious people to gain knowledge of certain information, conduct cross-site scripting attacks, and potentially compromise a user's system.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
...
Mozilla Firefox and SeaMonkey Multiple Vulnerabilities (Highly Critical)
