Multiple buffer overflows were discovered in the Ubuntu Linux kernel and can be corrected by upgrading your system to latest kernel version.
The PCRE library did not correctly handle certain in-pattern options. An attacker could cause applications linked against pcre3 to crash, leading to a denial of service.
Updated kernel packages that fix several bugs are now available for Debian Linux v4.0.
An updated Apache package that fixes a bug is now available under FreeBSD operating systems.
CVE-2008-0553: libtk-img – buffer overflow via local / remote arbitrary code execution.
The smaba has a regression where under certain circumstances accessing large files might cause the client to report an invalid packet length error.
Some vulnerabilities have been reported in APR-util, which can be exploited by malicious users and malicious people to cause a DoS (Denial of Service) – CVE-2009-1955, CVE-2009-1956, CVE-2009-0023 fix.
Hackers (read as cracker) attacking on unpatched versions of the Mambo content management system that can be used to build botnets for use in phishing scams and distributed denial of service (DDoS) attacks.
They are using PHP-based CMS mass-exploitation and other vulnerabilities in open source CMS applications. If you are in server, collocation businesses then watch out all these attacks.
Update Mambo as soon as possible. More information available at following sites:
A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target’s system. This is a well known type of attack and is generally not effective against modern networks. It works if a server allocates resources after receiving a SYN, but before it has received the ACK.
if Half-open connections bind resources on the server, it may be possible to take up all these resources by flooding the server with SYN messages. Syn flood is common attack and it can be block with following iptables rules:
iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 3 -j RETURN
All incoming connection are allowed till limit is reached:
- –limit 1/s: Maximum average matching rate in seconds
- –limit-burst 3: Maximum initial number of packets to match
Open our iptables script, add the rules as follows:
# Limit the number of incoming tcp connections
# Interface 0 incoming syn-flood protection
iptables -N syn_flood
iptables -A INPUT -p tcp --syn -j syn_flood
iptables -A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN
iptables -A syn_flood -j DROP
#Limiting the incoming icmp ping request:
iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j ACCEPT
iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix PING-DROP:
iptables -A INPUT -p icmp -j DROP
iptables -A OUTPUT -p icmp -j ACCEPT
First rule will accept ping connections to 1 per second, with an initial burst of 1. If this level crossed it will log the packet with PING-DROP in /var/log/message file. Third rule will drop packet if it tries to cross this limit. Fourth and final rule will allow you to use the continue established ping request of existing connection.
- â€â€limit rate: Maximum average matching rate: specified as a number, with an optional â€˜/secondâ€™, â€˜/minuteâ€™, â€˜/hourâ€™, or â€˜/dayâ€™ suffix; the default is 3/hour.
- â€â€limitâ€burst number: Maximum initial number of packets to match: this number gets recharged by one every time the limit specified above is not reached, up to this number; the default is 5.
You need to adjust the â€“limit-rate and â€“limit-burst according to your network traffic and requirements.
Let us assume that you need to limit incoming connection to ssh server (port 22) no more than 10 connections in a 10 minute:
iptables -I INPUT -p tcp -s 0/0 -d $SERVER_IP --sport 513:65535 --dport 22 -m state --state NEW,ESTABLISHED -m recent --set -j ACCEPT
iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 600 --hitcount 11 -j DROP
iptables -A OUTPUT -p tcp -s $SERVER_IP -d 0/0 --sport 22 --dport 513:65535 -m state --state ESTABLISHED -j ACCEPT
More information on recent patch can be found here