Debian OpenSSH/OpenSSL Package Random Number Generator Weakness (SSL check)

The remote x509 certificate on the remote SSL server has been generated on a Debian or Ubuntu system which contains a bug in the random number generator of its OpenSSL library. The problem is due to a Debian packager removing nearly all sources of entropy in the remote version of OpenSSL. An...

How to perform https man in the middle attacks-vulnerability warning-the black bar safety net

First talk about the fake certificate. First use openssl to generate a certificate, I generated here by an example. crt and example. key two, the protection of the password is 1 2 3 4 in. And then connect to the real HTTPS Server, get the real certificate. Re-starting forgery of certificate to be...

DEBIAN-CVE-2006-6170

Buffer overflow in the tlsx509nameoneline function in the modtls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815...

DEBIAN-CVE-2006-5111

The libksba library 0.9.12 and possibly other versions, as used by gpgsm in the newpg package on SUSE LINUX, allows attackers to cause a denial of service application crash via a malformed X.509 certificate in a signature...

security flaw

Double free vulnerability in the getRawDER function for nsIX509Cert in Firefox allows remote attackers to cause a denial of service hang and possibly execute arbitrary code via certain Javascript code...

security flaw

Multiple unspecified vulnerabilities in Ethereal 0.10.x up to 0.10.14 allow remote attackers to cause a denial of service crash from null dereference via 1 multiple vectors in H.248, and the 2 X.509if, 3 SRVLOC, 4 H.245, 5 AIM, and 6 general packet dissectors; and 7 the statistics counter...

security flaw

The KAME IKE Daemon Racoon, when authenticating a peer during Phase 1, validates the X.509 certificate but does not verify the RSA signature authentication, which allows remote attackers to establish unauthorized IP connections or conduct man-in-the-middle attacks using a valid, trusted X.509...

PT-2003-2174 · Oracle · Sdk +4

Name of the Vulnerable Software and Affected Versions: Java Secure Socket Extension JSSE in SDK and JRE versions 1.4.0 through 1.4.0 01 JSSE versions prior to 1.0.3 Java Plug-in SDK and JRE versions 1.3.0 through 1.4.1 Java Web Start versions 1.0 through 1.2 Description: The X509TrustManager in t...

UPDATE: Microsoft Security Bulletin MS02-050: Certificate Validation Flaw Could Enable Identity Spoofing (Q329115)

-----BEGIN PGP SIGNED MESSAGE----- - ---------------------------------------------------------------------- Title: Certificate Validation Flaw Could Enable Identity Spoofing Q329115 Released: 04 September 2002 Revised: 20 November 2002 version 4.0 Software: Microsoft Windows, Microsoft Office for...

x509 cert parsing in web browsers

Hello, While playing with the way SSL-enabled web browsers handle x509 certificates, I found several odd things - none of which is related to the recent issues with forging certs for MSIE, but related to the problems OpenSSL had recently. Due to some unrelated circumstances, I have very limited...