bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Piwik 1.1 closes critical security holes

Summary

In January 2011 the free web analytics software Piwik appeared in version 1.1 with security holes closed. As a precaution, the developers had commissioned Stefan Esser’s company SektionEins with a five-day review of the source code. Its hardening advice was incorporated into the new version.

Ideas

  • A project had its code reviewed before attackers found holes.
  • Besides bugs, an external audit also provides advice on architecture.
  • Five days of review were enough to uncover several holes.

Insights

  • Proactive audits are particularly valuable for self-hosted web applications.
  • Privacy-friendly analytics must also be technically secure.

Facts

  • SektionEins was founded by the security expert Stefan Esser.
  • The review lasted five days.
  • Piwik emerged from the phpMyVisites project and is licensed under the GPL.

References

Critique

  • The report names neither the type nor the severity of the holes found.

Remarks

  • Piwik has been called Matomo since 2018.

Recommendations

  • Always keep self-hosted web analytics such as Matomo up to date.
  • Plan regular external security reviews for your own web applications.

Read the original article

Search the Web Archive

g · 2025

Partly critical router holes endanger industrial networks

In January 2025 the industrial network equipment supplier Moxa warned of two holes in routers and security appliances used, among other places, in energy facilities. CVE-2024-9138 is based on hard-coded credentials and gives authenticated attackers root privileges; the critical CVE-2024-9140 allows system commands to be injected. Firmware updates were available for several model series, while for others there were only workarounds or a referral to support.

g · 2008

Critical security holes in PostgreSQL closed

In January 2008 the PostgreSQL developers closed five critical holes in all maintained versions from 7.3 to 8.2. Via expression indexes and DBLink functions, attackers could gain administrator rights, and via regular expressions they could bring the server down with a denial of service. The holes were found in the project’s own analyses, and no exploits were known.

g · 2025

17,000 Linux servers vulnerable to critical rsync hole

In January 2025 six holes in rsync became known, including the critical CVE-2024-12084, which in combination allows servers with only anonymous read access to be taken over. According to Shadowserver, 17,475 freely reachable rsync servers worldwide were vulnerable on 16 January, with Germany in fifth place with 956. All versions up to 3.3.0 were affected; the fixes came in 3.4.0 and 3.4.1.