Language Selection

English French German Italian Portuguese Spanish

Security Leftovers

Filed under
Security
  • Intel's Management Engine is a security hazard, and users need a way to disable it

    Since 2008, most of Intel’s CPUs have contained a tiny homunculus computer called the “Management Engine” (ME). The ME is a largely undocumented master controller for your CPU: it works with system firmware during boot and has direct access to system memory, the screen, keyboard, and network. All of the code inside the ME is secret, signed, and tightly controlled by Intel. Last week, vulnerabilities in the Active Management (AMT) module in some Management Engines have caused lots of machines with Intel CPUs to be disastrously vulnerable to remote and local attackers. While AMT can be disabled, there is presently no way to disable or limit the Management Engine in general. Intel urgently needs to provide one.

    This post will describe the nature of the vulnerabilities (thanks to Matthew Garrett for documenting them well), and the potential for similar bugs in the future. EFF believes that Intel needs to provide a minimum level of transparency and user control of the Management Engines inside our CPUs, in order to prevent this cybersecurity disaster from recurring. Unless that happens, we are concerned that it may not be appropriate to use Intel CPUs in many kinds of critical infrastructure systems.

  • 'Accidental hero' halts ransomware attack and warns: this is not over

    Ransomware is a type of malware that encrypts a user’s data, then demands payment in exchange for unlocking the data. This attack used a piece of malicious software called “WanaCrypt0r 2.0” or WannaCry, that exploits a vulnerability in Windows. Microsoft released a patch (a software update that fixes the problem) for the flaw in March, but computers that have not installed the security update remain vulnerable.

  • Vanilla Forums Open Source Software Vulnerable to RCE, Host Header Injection Vulnerability

    Popular open source forum software suffers from vulnerabilities that could let an attacker gain access to user accounts, carry out web-cache poisoning attacks, and in some instances, execute arbitrary code.

  • Vanilla Forums has a plain-flavoured zero-day

    The popular Vanilla Forums software needs patching against a remote code execution zero-day first reported to the developers in December 2016.

    Published by ExploitBox, the zero-day “can be exploited by unauthenticated remote attackers to execute arbitrary code and fully compromise the target application when combined with Host Header injection vulnerability CVE-2016-10073.”

    The problem arises because Vanilla Forums inherits a bug in PHPMailer. The mailer uses PHP's mail() function as its default transport, as discussed by Legal Hackers here.

  • Google Fuzzing Service Uncovers 1K Bugs in Open-Source Projects

    Today’s topics include Google’s fuzzing service uncovering more than 1,000 bugs in open-source projects in five months, VMware helping Google make Chromebooks better for business; Edward Snowden advocating the need for open source and OpenStack; and Dell EMC aiming servers at data center modernization efforts.

More in Tux Machines

Linux Kernel 4.15 Reached End of Life, Users Urged to Move to Linux 4.16 Now

After a very busy cycle due to the Meltdown and Spectre security vulnerabilities, which were publicly disclosed earlier this year and later discovered to put billions of devices using modern processors at risk of attacks, the Linux 4.15 kernel series was released at the of January heavily redesign against two critical hardware bugs. Now, nearly three months and only eighteen maintenance updates later, the Linux 4.15 kernel series reached end of life and it will no longer receive support. As such, all those using a kernel from the Linux 4.15 branch on their GNU/Linux distributions are urged to upgrade to the latest Linux 4.16 kernel series as soon as possible. Read more

LibreOffice 6.1 Lands Mid August 2018, First Bug Hunting Session Starts April 27

Work on the next big release of the widely-used open-source and cross-platform office suite for GNU/Linux, macOS, and Microsoft Windows operating systems, LibreOffice 6.1, has already begun this week with a focus on revamping the online experience and improving the Writer and Calc components. A first bug hunting session was scheduled for the end of next week, on April 27, 2018, when developers will hack on the first alpha milestone of LibreOffice 6.1, which should be available to download for all supported platforms a few days before the event. During the bug hunting session, devs will try to fix as many bugs as possible. Read more

This Chart Shows How The Radeon RX 580 vs. GeForce GTX 1060 Now Compete Under Linux

It was just last year that open-source RadeonSI/RADV developers were trying to get the Radeon RX 580 "Polaris" GPU to be competitive with the GeForce GTX 1060 as it is under Windows given each GPU's capabilities. We've seen the RX 580 and GTX 1060 dancing under Linux the past few months and yesterday's 20-way GPU comparison with Rise of the Tomb Raider was quite significant -- perhaps most surprising being how well the RX 580 performed. Heck, just one or two years ago it was an accomplishment seeing any official Radeon driver support at-launch for new Linux game releases. So here are some extensive tests looking closer at the GTX 1060 vs. RX 580 battle in this latest Vulkan-powered Linux game port. Read more

Linux 4.9.95

I'm announcing the release of the 4.9.95 kernel. All users of the 4.9 kernel series must upgrade. The updated 4.9.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y and can be browsed at the normal kernel.org git web browser: http://git.kernel.org/?p=linux/kernel/git/stable/linux-st... Read more