This cross-site scripting vulnerability should be taken very seriously.

A cross-site scripting vulnerability (otherwise known as a XSS attack) could be used to steal sensitive information (like login details) from people who visit your website.  They often do this by injecting a client-side script into your website.

You have two options when it comes to updating WordPress.  You can download the latest version from WordPress’s website and do a manual update or better yet – log into your WordPress administration section and do the update from within WordPress.

Updates during the holiday break are never fun, but this is one security issue you should fix as quickly as possible.
-
Michael Earls

Why is NTP Important?

In a commercial environment, accurate time stamps are essential to everything from maintaining and troubleshooting equipment and forensic analysis of distributed attacks, to resolving disputes among parties contesting a commercially valuable time-sensitive transaction. In a programming environment, time stamps are usually used to determine what bits of code need to be rebuilt as part of a dependency checking process as they relate to other bits of code and the time stamps on them, and without good time stamps your entire development process can be brought to a complete standstill. Within law enforcement, they are essential for correlation of distributed communication events, forensic analysis, and potential evidentiary use in criminal proceedings. In essence, all debugging, security, audit, and authentication is founded on the basis of event correlation (knowing exactly what happened in what order, and on which side), and that depends on good time synchronization.

Another good explanation for this issue comes from Thomas Akin, in chapter 10 of his book Hardening Cisco Routers:

Time is inherently important to the function of routers and networks. It provides the only frame of reference between all devices on the network. This makes synchronized time extremely important. Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. When it comes to security, if you cannot successfully compare logs between each of your routers and all your network servers, you will find it very hard to develop a reliable picture of an incident. Finally, even if you are able to put the pieces together, unsynchronized times, especially between log files, may give an attacker with a good attorney enough wiggle room to escape prosecution.

Additional information on this subject can be found at UC Berkeley, University of Wyoming, in Rik Farrow’s Network Defense columns for Network Magazine , and in the Linux System Administrators Guide at the Linux Documentation Project.

Depending on the operating system NTP can very on the installation guide, please reference your OS type in order to find the correct distribution to install.

Current NTP Version:
http://support.ntp.org/bin/view/Main/SoftwareDownloads

NTP Ports For Windows:
http://support.ntp.org/bin/view/Main/ExternalTimeRelatedLinks
Edit ntp.conf file, an add the following lines
server pool.ntp.org maxpoll 12
server pool.ntp.org maxpoll 12
server pool.ntp.org maxpoll 12

Please check out http://www.pool.ntp.org for a list of different time zone servers.

How to verify that your server is synchronized.
Issue the following command ntpq -p or ntpq -pn (DNS lookup off)

vermeer:~$ ntpq -p
remote refid st t when poll reach delay offset jitter
=========================================================
+daffy.test1.org 193.5.216.14 2 u 68 1024 377 158.995 51.220 50.287
*navobs1.o.net 130.149.17.8 2 u 191 1024 176 79.245 3.589 27.454
-ntp.vermeer.org 131.188.3.222 3 u 766 1024 377 22.302 -2.928 0.508

vermeer:~$ ntpq -pn
remote refid st t when poll reach delay offset jitter
=========================================================
+205.142.198.4 193.5.216.14 2 u 68 1024 377 158.995 51.220 50.287
*198.30.92.2 130.149.17.8 2 u 191 1024 176 79.245 3.589 27.454
-64.44.160.38 131.188.3.222 3 u 766 1024 377 22.302 -2.928 0.508

How to verify that your clients are synchronized.
Issue the following command ntpdc -c monlist or ntpdc -nc monlist ( DNS lookup off ):
ntpq -p
remote address          port local address      count m ver drop   last   first
=========================================================
127.0.0.1              40583 127.0.0.1               53273 7 2      0      0 15483660

router1.vermeer.org   123 10.1.20.10             93542 3 3      0      4 15483164
router2.vermeer.org   123 10.1.30.10             68744 3 3      0      5 15483060
router3.vermeer.org   123 10.1.40.10             56228 3 3      0      5 15483127

vermeer:~$ ntpq -p
remote address          port local address      count m ver drop   last   first
=========================================================
127.0.0.1              40583 127.0.0.1              53273 7 2      0      0 15483660
10.253.40.38             123 10.1.20.10           93542 3 3            4 15483164
10.11.15.4                123 10.1.20.10            68744 3 3      0      5 15483060
10.10.80.16              123 10.1.20.10            56228 3 3      0      5 15483127

What is NBAR?
Network Based Application Recognition is an intelligent classification engine that recognizes applications that are static (which use fixed TCP or UDP port numbers), and stateful (which dynamically assign TCP or UDP port numbers).

The NBAR Protocol Discovery Management Information Base (MIB) expands the capabilities of NBAR Protocol Discovery by providing the following new Protocol Discovery functionalities through SNMP:

What is MRTG?
MRTG consists of a Perl script which uses SNMP to read the traffic counters of your routers and a fast C program which logs the traffic data and creates beautiful graphs representing the traffic on the monitored network connection. These graphs are embedded into webpages which can be viewed from any modern Web-browser.

In addition to a detailed daily view, MRTG also creates visual representations of the traffic seen during the last seven days, the last five weeks and the last twelve months. This is possible because MRTG keeps a log of all the data it has pulled from the router. This log is automatically consolidated so that it does not grow over time, but still contains all the relevant data for all the traffic seen over the last two years. This is all performed in an efficient manner. Therefore you can monitor 200 or more network links from any halfway decent UNIX box.

MRTG is not limited to monitoring traffic, though. It is possible to monitor any SNMP variable you choose. You can even use an external program to gather the data which should be monitored via MRTG. People are using MRTG, to monitor things such as System Load, Login Sessions, Modem availability and more. MRTG even allows you to accumulate two or more data sources into a single graph.

Enable NBAR in IOS:

Test for Supported MIB:

Not Supported MIB in IOS

Examples from the following output:

The nbar-internet.cfg file assumes that you are monitoring FastEthernet 1/0. Change this to refelect the interface you are monitoring.
Change public@isp1 to the correct community string and ip address.

Create New Directory:
Create the following directory under mrtg web files.

Files Created:
The above configuration will create the following files under nbar-internet directory.

MRTG CFG FILE: (nbar-internet.cfg)
Download nbar-internet.cfg

Additional References:
Cisco IOS images that support CISCO-NBAR-PROTOCOL-DISCOVERY-MIB MIB.
[...]

Network-Based Application Recognition and Distributed Network-Based Application Recognition:
[...]

Network-Based Application Recognition Protocol Discovery Management Information Base:
[...]

winscp – www.winscp.net
pdfCreator – www.pdfforge.org/products/pdfcreator
fileZilla – filezilla.sourceforge.net

I also want to thank everyone who has donated to my project phpIP Management http://www.phpip.net/contributers.php, this has really given me the chance to spend the extra hours a night to make my project better.

Thanks again,

-
Michael Earls

This presentation covered topics related to DNS with regards to design, attacks, and security including:

• DNS Reconnaissance
• Cache Poisoning using DNS
• Denial of Service Attack (Query Flooding DNS)
• Man in the Middle Attacks (DNS Hijacking)
• DNS Design Best Practice

-
Michael Earls