Posted on

Meltdown and Spectre Vulnerabilities

A recent vulnerability was announced on January 3, 2018, affecting all modern processors. There are two parts to the released vulnerability, and they are as follows:

Meltdown: Allows applications to access operating system memory, providing access to secrets such as passwords. This affects modern Intel chips. There are patches available, however, at this point there seems to be some issues with these patches, causing system instability and slow downs.

Spectre: Breaks the isolation between error-free applications, which allows a malicious application to read memory from another application. This affects all modern chips; Intel, AMD, and ARM.

More information about these vulnerabilities can be found here.… Read the rest

Posted on

WordPress Security: Serious Vulnerability in WordPress Download Manager

There is a serious vulnerability in the WordPress Download Manager plugin that allows a remote attacker to upload malicious scripts to your website, gain administrative access and modify passwords.

The vulnerability exists in versions of WordPress Download Manager older than 2.7.5. The Changelog confirms this has been fixed as of version 2.7.5.

The Problem:

WP Download manager was allowing unauthenticated ajax calls to execute arbitrary functions. This would allow an attacker to upload arbitrary files and perform a variety of other malicious tasks.

What to do:

Upgrade to WordPress Download Manager version 2.7.5 which is the newest version at the time of writing.… Read the rest

Posted on

WordPress Security: Multiple Vulnerabilities in InfiniteWP Admin Panel. Upgrade immediately.

About an hour ago researcher Walter Hop from Slik BV in the Netherlands disclosed multiple serious vulnerabilities in the InfiniteWP Admin Panel on the Full Disclosure and Bugtraq mailing lists. This admin panel is a standalone PHP application that is installed on a website and used as an interface to manage multiple WordPress websites.

The vulnerability includes several issues, the most serious of which appear to allow unauthenticated SQL injection. There is also a file upload vulnerability but only for certain web server configurations.

The issues were initially disclosed on November 26th and InifiniteWP has since released two fixes, the most recent of which were released yesterday, to fix these issues.… Read the rest

Posted on

OpenSSL (Heartbleed) Patched on all MonsterMegs Servers

As of 9:30AM (CST) on April 8, 2014, all MonsterMegs servers vulnerable to CVE-2014-0160 (Heartbleed) OpenSSL security bug have been patched. This security vulnerability is a widespread issue affecting operating systems globally and not an issue specific to MonsterMegs. OpenSSL is a toolkit which implements SSL/TLS protocols as well as general cryptography for various operating systems. This vulnerability can provide a back door for attackers to gain access to confidential information.

CentOS/Cloudlinux released an official OpenSSL patch removing the recently discovered vulnerabilities. OpenSSL was upgraded seamlessly. However, all services linked against the older vulnerable version of OpenSSL had to be restarted to apply the newly patched OpenSSL version.… Read the rest

Posted on

WordPress wp-login.php Brute Force Attack

Over the last couple days a huge threat and nuisance has evolved that is effecting nearly all web hosting providers. This brute force attack is being conducted by a large botnet consisting of thousands of unique IP addresses across the world.  The attacker is brute force attacking the WordPress administrative portals, using the username “admin” and trying thousands of passwords.

One of the concerns of an attack like this is that the attacker is using a relatively weak botnet of home PCs in order to build a much larger botnet of beefy servers in preparation for a future attack. These larger machines can cause much more damage in DDoS attacks because the servers have large network connections and are capable of generating significant amounts of traffic.… Read the rest