bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Gentoo takes servers offline because of security holes

Summary

In August 2007 Gentoo took several servers offline after a command injection hole had been discovered on packages.gentoo.org. The affected systems were examined forensically; whether any manipulation had taken place was unclear. According to Gentoo, packages and sources could not have been changed at any time, as the server only displayed information from the Portage tree.

Ideas

  • A command injection hole allowed a project server to be manipulated.
  • As a precaution, related servers were also switched off and examined.
  • Information server and package sources were separate, so packages were not affected.

Insights

  • Separating web services and package infrastructure limits the damage of a break-in.
  • Open communication about incidents builds trust, even when details are missing.

Facts

  • The hole was found on 7 August 2007.
  • Shortly before, several Ubuntu community servers had been taken offline after break-ins.

References

Critique

  • The report reproduces the project’s all-clear before the forensic investigation had been completed.

Recommendations

  • Strictly separate a project’s web services from the infrastructure for building and signing packages.
  • Verify packages via signatures so that a compromised server cannot slip in manipulated packages.

Read the original article

Search the Web Archive

hß · 2023

Print management solution: security holes endanger PaperCut servers

In August 2023 PaperCut closed two high-rated holes in its print management software. Via CVE-2023-3486, attackers could upload files without logging in and fill up the hard disk; via CVE-2023-39143 they could view and modify files, and according to Horizon3 even execute code. The Windows hole required the External Device Integration function, which was active by default in PaperCut NG Commercial and MF.

hß · 2026

Palo Alto Networks: numerous security holes in Prisma Browser closed

In August 2026 Palo Alto Networks closed numerous holes, most of them in the Chromium-based enterprise browser Prisma Browser. There, memory bugs could lead to code execution; version 150.49.8.187 was fixed. Further holes affected the GlobalProtect VPN client on Android, macOS and Windows, including a privilege escalation (CVE-2026-0299).

hß · 2026

iX workshop: hardening Linux servers with encryption and access control

In 2026 heise again advertised the five-day iX workshop “Hardening Linux servers” with Florian Winkler of B1 Systems, this time with dates in September and November. Topics range from physical security through encryption, two-factor authentication and SELinux/AppArmor to logging, monitoring and intrusion detection. The target group is Linux administrators and security officers who want to secure their servers systematically.