Debian DSA-1650-1 : openldap2.3 - denial of service

Cameron Hotchkies discovered that the OpenLDAP server slapd, a free implementation of the Lightweight Directory Access Protocol, could be crashed by sending malformed ASN1 requests. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Important: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise MRG 1.0. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux...

CVE-2008-1673: Improper Restriction of Operations within the Bounds of a Memory Buffer

The asn1 implementation in a the Linux kernel 2.4 before 2.4.36.6 and 2.6 before 2.6.25.5, as used in the cifs and ipnatsnmpbasic modules; and b the gxsnmp package; does not properly validate length values during decoding of ASN.1 BER data, which allows remote attackers to cause a denial of servi...

Debian Security Advisory DSA 394-1 (openssl095)

The remote host is missing an update to openssl095 announced via advisory DSA 394-1. OpenVAS Vulnerability Test $Id: deb3941.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 394-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

SUSE-SA:2006:058: openssl

The remote host is missing the patch for the advisory SUSE-SA:2006:058 openssl. Several security problems were found and fixed in the OpenSSL cryptographic library. CVE-2006-3738/VU547300: A Google security audit found a buffer overflow condition within the SSLgetsharedciphers function which has...

Mandrake Linux Security Advisory : openssl (MDKSA-2006:172-1)

Dr S N Henson of the OpenSSL core team and Open Network Security recently developed an ASN1 test suite for NISCC www.niscc.gov.uk. When the test suite was run against OpenSSL two denial of service vulnerabilities were discovered. During the parsing of certain invalid ASN1 structures an error...

Debian DSA-1195-1 : openssl096 - denial of service (multiple)

Multiple vulnerabilities have been discovered in the OpenSSL cryptographic software package that could allow an attacker to launch a denial of service attack by exhausting system resources or crashing processes on a victim's computer. - CVE-2006-3738 Tavis Ormandy and Will Drewry of the Google...

Debian DSA-1185-2 : openssl - denial of service

The fix used to correct CVE-2006-2940 introduced code that could lead to the use of uninitialized memory. Such use is likely to cause the application using the openssl library to crash, and has the potential to allow an attacker to cause the execution of arbitrary code. For reference please find...

OpenSSL -- Multiple problems in crypto(3)

Problem Description: Several problems have been found in OpenSSL: During the parsing of certain invalid ASN1 structures an error condition is mishandled, possibly resulting in an infinite loop. A buffer overflow exists in the SSLgetsharedciphers function. A NULL pointer may be dereferenced in the...

Security fix for the ALT Linux 9 package openssl10 version 0.9.7g-alt5

Sept. 27, 2006 Dmitry V. Levin 0.9.7g-alt5 - Applied upstream fixes for DoS bugs in ASN1 parser CVE-2006-2937, CVE-2006-2940. - Applied fix for buffer overflow in SSLgetsharedciphers, discovery and patch from Tavis Ormandy and Will Drewry of the Google Security Team CVE-2006-3738. - Applied fix f...

Security fix for the ALT Linux 8 package openssl10 version 0.9.7g-alt5

Sept. 27, 2006 Dmitry V. Levin 0.9.7g-alt5 - Applied upstream fixes for DoS bugs in ASN1 parser CVE-2006-2937, CVE-2006-2940. - Applied fix for buffer overflow in SSLgetsharedciphers, discovery and patch from Tavis Ormandy and Will Drewry of the Google Security Team CVE-2006-3738. - Applied fix f...

security flaw

Multiple unspecified vulnerabilities in Ethereal 0.9.x up to 0.10.14 allow remote attackers to cause a denial of service crash from null dereference via 1 an invalid display filter, or the 2 GSM SMS, 3 ASN.1-based, 4 DCERPC NT, 5 PER, 6 RPC, 7 DCERPC, and 8 ASN.1 dissectors...

Mandrake Linux Security Advisory : squid (MDKSA-2004:112)

iDEFENSE discovered a Denial of Service vulnerability in squid version 2.5.STABLE6 and previous. The problem is due to an ASN1 parsing error where certain header length combinations can slip through the validations performed by the ASN1 parser, leading to the server assuming there is heap...

CVE-2004-0918

CVE-2004-0918: Squid’s SNMP parser (asn_parse_header in asn1.c) before 2.4.STABLE7 allows remote attackers to cause a denial of service (server restart) by sending SNMP packets with negative length fields that trigger a memory allocation error. The issue yields a partial availability impact and i...

[Full-Disclosure] iDEFENSE Security Advisory 10.11.04: Squid Web Proxy Cache Remote Denial of Service Vulnerability

Squid Web Proxy Cache Remote Denial of Service Vulnerability iDEFENSE Security Advisory 10.11.04: www.idefense.com/application/poi/display?id=152&type=vulnerabilities October 11, 2004 I. BACKGROUND Squid Web Proxy Cache is a full-featured web proxy cache designed to run on Unix systems. It suppor...

CVE-2004-0849: Undefined Security Weakness

Integer overflow in the asndecodestring function defined in asn1.c in radiusd for GNU Radius 1.1 and 1.2 before 1.2.94, when compiled with the --enable-snmp option, allows remote attackers to cause a denial of service daemon crash via certain SNMP requests...

security flaw

The asn1bufskiptail function in the ASN.1 decoder library for MIT Kerberos 5 krb5 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service infinite loop via a certain BER encoding...

Mandrake Linux Security Advisory : openssl (MDKSA-2002:046-1)

An audit of the OpenSSL code by A.L. Digital Ltd and The Bunker, under the DARPA program CHATS, discovered a number of vulnerabilities in the OpenSSL code that are all potentially remotely exploitable. From the OpenSSL advisory : 1. The client master key in SSL2 could be oversized and overrun a...

CVE-2003-0544

OpenSSL 0.9.6 and 0.9.7 does not properly track the number of characters in certain ASN.1 inputs, which allows remote attackers to cause a denial of service crash via an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used...

CVE-2003-0545

Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via an SSL client certificate with a certain invalid ASN.1 encoding...