Descriptions of the network level attacks.

1. Remote code execution vulnerability in running OpenSSL version.

Severity – Critical
CVE No – CVE-2016-2108
CVSS Score – 10
Vulnerability – Remote code execution vulnerability.

Description – Due to an underflow condition in running version of OpenSSL in the system, there is a vulnerability which gives the attacker right to execute an arbitrary code. After exploiting this vulnerability, attacker can execute any code he likes which is not intended by the original development of the software. That gives the attacker to control the execution of the software, therefore the system, and it can cause to unauthorized access and disclosure of information.

Solution – Upgrade to OpenSSL version 1.0.1o or later.

Reference – https://www.tenable.com/plugins/nessus/90888

2. BACKRONYM, security feature bypass vulnerability in running version of PHP.

Severity – Critical
CVE No – CVE-2015-3152
CVSS Score – 10
Vulnerability – Security feature bypass vulnerability.

Description – 'BACKRONYM' is a security feature bypass vulnerability exists in the running version of PHP. An attacker who exploited this vulnerability can force the system to use an unencrypted connection when connecting to a database. When the database connection is not encrypted, everything is visible to the attacker and he can either get those data or manipulate data as he wants

Solution – Upgrade to PHP version 5.5.27 or later.

Reference – https://www.tenable.com/plugins/nessus/84672

3. Heap buffer overflow condition in running version of PHP.

Severity – Critical
CVE No – CVE-2015-4643
CVSS Score – 10
Vulnerability – Buffer overflow condition.

Description – A heap buffer overflow condition exists in the running version of PHP. Buffer overflow happens when a program overruns its allocated resources in the memory. The reason for that is accessing resources without validating. After executing this vulnerability, attacker can cause to overflow the buffer of the program and make some changes to the program in a way that benefits the attacker. Then he can gain unauthorized access to the system.

Solution – Upgrade to PHP version 5.5.26 or later.

Reference – https://www.tenable.com/plugins/nessus/84363

4. Out-of-bound read error in Apache web server.

Severity – Critical
CVE No – CVE-2017-7668
CVSS Score – 10
Vulnerability – Denial of service attack.

Description – Due to improper handling of header sequence of requests, out-of-bound read error can occur. An attacker who exploit this vulnerability can cause a denial of service attack to the system

Description: This command combines ln and mv into one command....