ConeXware PowerArchiver弱加密漏洞

Bugtraq ID:66174 CVE ID:CVE-2014-2319 ConeXware PowerArchiver是一款压缩工具。 如果在GUI中用户选择AES加密，ConeXware PowerArchiver会以不安全加密方法来创建文件。如选择"AES 256-bit"进行加密软件会使用PKZIP加密来代替。 0 ConeXware PowerArchiver 14.02.03 ConeXware PowerArchiver 14.02.05已经修复该漏洞，建议用户下载更新： http://www.powerarchiver.com...

CVE-2014-2319

The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen, which makes it easier for context-dependent attackers to obtain sensitive information via a known-plaintext attack...

CVE-2014-2319

The Encrypt Files feature in ConeXware PowerArchiver before 14.02.05 uses legacy ZIP encryption even if the AES 256-bit selection is chosen, which makes it easier for context-dependent attackers to obtain sensitive information via a known-plaintext attack...

CVE-2014-2319

PowerArchiver (ConeXware) 14.02.03 vulnerable: Encrypt Files feature uses legacy PKZIP encryption even when AES 256-bit is selected, enabling a known-plaintext exposure. Root cause is insecure encryption usage in the AES path. Affected version(s) include 14.02.03; vendor released 14.02.05 to fix ...

IBM AIX/Virtual I/O Server OpenSSH AES-GCM密文特权提升漏洞

CVE ID:CVE-2013-4548 IBM AIX是一款商业性质的操作系统。 IBM AIX / Virtual I/O Server包含的OpenSSH存在安全漏洞密钥交换过程中选择AES-GCM密文存在错误，允许恶意本地用户利用漏洞提升权限。 0 IBM AIX 5.x IBM AIX 6.x IBM AIX 7.x IBM Virtual I/O Server VIOS 1.x IBM Virtual I/O Server VIOS 2.x 厂商补丁： IBM ----- 用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞：...

Facebook releases 'Conceal' API for Android developers to Encrypt data on Disk

Many Smartphone applications support, installation or app data storage to an external SD Card, that can be helpful in saving space on the internal memory, but also vulnerable to hackers. Typically, an app that has permission to read and write data from an SD card has the permission to read all da...

Facebook Conceal Java Crypto LIbrary Open Sourced

Facebook has released to open source its Conceal Java crypto libraries for Android devices. Conceal, according to Facebook, offers developers a lightweight and efficient crypto library. The social media giant developed Conceal to handle encryption of storage on removable SD cards, something that...

Google Chrome to encrypt Stored Cookies by default to enhance browser security

When you visit a website, it stores some information on your system through a web browser for later use i.e. Login information, so you do not have to re-login to your website every time you visit the same website on the same browser. Cookies are usually stored as plain text or in the database by...

PrisonLocker Ransomware Emerges From Criminal Underground

Security researchers from Malware Must Die uncovered new ransomware called PrisonLocker, and said the malware author is either a legitimate security researcher or is posing as one via a personal blog and Twitter handle. Malware Must Die has monitored PrisonLocker’s development since spotting it f...

Use of 3DES to Encrypt Stolen Target PIN Data Invites Worry

Target Corp.’s admission that encrypted PIN data was stolen in the Black Friday breach was bad news for consumers. For security experts, especially cryptographers, particular exception was taken to the retail giant’s use of Triple DES 3DES encryption to keep the PIN data safe. With all crypto...

Fedora 20 : libreswan-3.7-1.fc20 (2013-23250)

Security fix for CVE-2013-4564, extended AES-GCM and AES-CCM Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Fedora 18 : libreswan-3.7-1.fc18 (2013-23299)

Security fix for CVE-2013-4564, extended AES-GCM and AES-CCM Improved Cisco interop, IKEv2 improvements, bugfixes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it...

Fedora 19 : libreswan-3.7-1.fc19 (2013-23315)

Security fix for CVE-2013-4564, extended AES-GCM and AES-CCM support Improved Cisco interop, IKEv2 improvements, bugfixes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

OpenSSH memory corruption

Memory corruption in AES-GCM implementation...

FreeBSD Security Advisory FreeBSD-SA-13:14.openssh

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:14.openssh Security Advisory The FreeBSD Project Topic: OpenSSH AES-GCM memory corruption vulnerability Category: contrib Module: openssh Announced: 2013-11-19...

[slackware-security] openssh

New openssh packages are available for Slackware 14.1 and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/openssh-6.4p1-i486-1slack14.1.txz: Upgraded. sshd8: fix a memory corruption problem triggered during rekeying when an AES-GCM cipher...

FreeBSD-SA-13:14.openssh

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-13:14.openssh Security Advisory The FreeBSD Project Topic: OpenSSH AES-GCM memory corruption vulnerability Category: contrib Module: openssh Announced:...

openssh: security fix for remote code execution with AES-GCM (important)

openssh was updated to fix a memory corruption when AES-GCM is used which could lead to remote code execution after successful authentication. CVE-2013-4548...

Ubuntu: Security Advisory (USN-2014-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SuSE 11.2 / 11.3 Security Update : Mozilla NSS (SAT Patch Numbers 8484 / 8485)

"Mozilla NSS has been updated to 3.15.2 bnc847708 bringing various features and bugfixes : The main feature is TLS 1.2 support and its dependent algorithms. - Support for AES-GCM ciphersuites that use the SHA-256 PRF - MD2, MD4, and MD5 signatures are no longer accepted for OCSP or CRLs - Add...