Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

In Ubuntu 10.04 (and perhaps later) there appears to be a serious vulnerability to a brute force dictionary attack on any Apache server that is using MySQL to validate user logins.

This issue means that neither fail2ban nor Apache mod_security detects the attack.

I would prefer not to list the detail here.

Could someone contact me or explain to me how I can report the problem without posting the vulnerability to the whole world?

share|improve this question

1 Answer 1

You'll need to file a bug against the package you're having an issue with. You can use these instructions to report a bug. Once all the data is collected LaunchPad will open a window and you can continue with the bug reporting process.

Alternatively, visit the LaunchPad Ubuntu page (https://bugs.launchpad.net/ubuntu/+source/<PACKAGENAME>) then fill out the details.

Once a summary and duplicate detection have completed, but prior to submitting your report, there will be the following option at the bottom of the page that you will need to select:

enter image description here

Doing so will make this bug hidden and alert the security team.

share|improve this answer
    
I do not want to post the bug to the whole world. I would prefer that someone contacts me on my email. –  paul Jan 31 '12 at 21:23
    
OK now I read the end of your post. I will report it if it is hidden. –  paul Jan 31 '12 at 21:24
1  
@paul It will only be visible to the maintainers and the security team. –  Marco Ceppi Jan 31 '12 at 21:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.