Language Selection

English French German Italian Portuguese Spanish

Apache.org hit by targeted XSS attack, passwords compromised

Filed under
Software
Security
Web

Combining a cross-site scripting (XSS) vulnerability with a TinyURL redirect, hackers successfully broke into the infrastructure for the open-source Apache Foundation in what is being described as a “direct, targeted attack.”

The hackers hit the server hosting the software that Apache.org uses to it to track issues and requests and stole passwords from all users. The software was hosted on brutus.apache.org, a machine running Ubuntu Linux 8.04 LTS, the group said.

The passwords were encrypted on the compromised servers (SHA-512 hash) but Apache said the risk to simple passwords based on dictionary words “is quite high” and urged users to immediately rotate their passwords.

More here and here




More in Tux Machines

Contributing to open source software with Ian Varley of Salesforce

With open source, you're expanding the sphere of people who might potentially care a lot about your code. You find others who have similar problems, and who can leverage your work and maybe even extend it. The knowledge that you've helped someone avoid "rebuilding the wheel" is really gratifying, and it's amplified when those people actually start getting so involved that they give you contributions of code or ideas. The project picks up steam, and you might even get unforeseen help tackling those issues you didn't have bandwidth to tackle yourself. Really, it's the gift that keeps on giving. Read more

IPFire 2.19 Core Update 101 Patches Cross-Site-Scripting Vulnerability in Web UI

The development team behind the IPFire software have announced the general availability of the Core Update 101 of the IPFire 2.19 Linux kernel-based firewall distribution. Read more

pfSense 2.3 Open-Source BSD Firewall Gets Patch That Fixes NTP Security Issues

pfSense developer Chris Buechler announced the availability of a small update for the stable pfSense 2.3 open-source firewall platform based on the FreeBSD operating system. Read more

today's leftovers