Canonical has released several patches addressing flaws in the Linux kernel and OpenSSL that left Ubuntu users open to escalation of privilege and denial-of-service (DoS) attacks.
The most serious of the fixes covers a variety of flaws that could be used to gain elevated or administrative privileges on the victim machine.
"A memory corruption issue was discovered in AES decryption when using the Intel AES-NI accelerated code path. A remote attacker could exploit this flaw to cause a DoS (system crash) or potentially escalate privileges on Intel-based machines," read the Ubuntu security advisory.
In my previous article about creating a "mountable" disk image in GNU/Linux, I explained how to create a file that effectively mimics the functionality of a disk: I explained how to create a file which will then be used, in turn, to contain directories and files. In this article I will explain how to make the next natural step: encrypt that file.
After having informed users about the immediate availability of a new kernel update for the Ubuntu 14.04 LTS (Trusty Tahr) operating system, Canonical has also announced that Ubuntu 14.10 (Utopic Unicorn) received an important kernel update.
On June 8, Canonical issued a new Ubuntu Security Notice informing all users of the Ubuntu 14.04 LTS (Trusty Tahr) operating system that a new kernel update is available.
Software security vulnerabilities are a fact of life. So is the subsequent publicity, package updates, and suffering service restarts. Administrators are used to it, and users bear it, and it’s a default and traditional method.
On the other hand, in some circumstances the update & restart methods are unacceptable, leading to the development of online fix facilities like kpatch, where code may be surgically replaced in a running system. There is plenty of potential in these systems, but they are still at an early stage of deployment.
The Docker Bench for Security script is packaged as a Docker container to make it easier to run and test. One of the CIS Benchmark's recommendations is to limit container privileges to only what is needed to run. Somewhat ironically, the Docker Bench for Security script is a very high-privilege container that has broad access to host resources—usually something a container should not be able to do. That said, as a security testing tool, the container does need the broad access to validate host configuration for container deployment properly.
Security researchers have published proof-of-concept code for a major router vulnerability leveraging a popular Linux kernel driver that could be used by hackers to compromise millions of connected devices.
Last year was news about Russia wanting to design its own processors to be less reliant upon Intel and AMD. The initial "Baikal" processor was expected to be based on ARMv8 but it turns out now that it's a MIPS design.
Linux/Moose allows cybercriminals to skim unencrypted information about users' social media accounts that then can be used to sign up those individuals as social media followers for people and businesses that pay for followers, according to James Quin, senior director of content & C-suite communities at CDM Media.