Ubuntu 4.10 / 5.04 : openssl weak default configuration (USN-179-1)

The current default algorithm for creating 'message digests' electronic signatures for certificates created by openssl is MD5. However, this algorithm is not deemed secure any more, and some practical attacks have been demonstrated which could allow an attacker to forge certificates with a valid...

Using the MD5 transform algorithm to the anti-exhaustive(collision)to decipher a password-vulnerability warning-the black bar safety net

MD5 in Web applications in the most commonly used password encryption algorithm. Since MD5 is irreversible, and thus through the MD5 calculated after the ciphertext, not through the reverse algorithm to get the original. Review in Web applications to use the MD5 encrypted text of the password of...

Clever break Tegoweb-vulnerability warning-the black bar safety net

Tegoweb this software in the X-Files have been introduced, so its features have a certain understanding, just recently need to use this software, so it from the disc will drag it out, install it, feeling pretty good, so he decided to go to the Internet to find a finished version, after all we are...

“Cat and mouse”contest software crack large unmasked(multi-map)-vulnerability warning-the black bar safety net

As a programmer, since I have written a fewsoftwareare often peoplecrack, so the common software crack way more attention. In this article, I took a variety of software crack the way to a clean sweep, as shown in algorithm KeyGen, memory crack method, a patch to crack the law and file a...

CVE-2005-3800: Undefined Security Weakness

Macromedia Contribute Publishing Server CPS before 1.11 uses a weak algorithm to encrypt user password in connection keys that use shared FTP login credentials, which allows attackers to obtain sensitive information...

Schneier's PasswordSafe password validation flaw

Title : Schneier's PasswordSafe password validation flaw Date : November 16, 2005 Product : PasswordSafe 1.x, 2.x Discovered by : ElcomSoft Co.Ltd. Overview ====================================================================== PasswordSafe is a program originally written by security expert Bruce...

OpenSSL Version Rollback and Weak Cryptographic Algorithm Vulnerabilities

OpenSSL contains vulnerabilities that could allow an unauthenticated, remote attacker to bypass security restrictions. The first vulnerability CVE-2005-2969 affects any application using a SL/TLS server implementation provided by OpenSSL versions 0.9.7g and prior. If these implementations have...

PT-2005-3792 · Openssl +1 · Openssl +2

Name of the Vulnerable Software and Affected Versions: OpenSSL versions prior to 0.9.8 Description: The issue is related to the default configuration of OpenSSL, which uses MD5 for creating message digests. This makes it easier for remote attackers to forge certificates with a valid certificate...

CVE-2005-2946: Use of a Broken or Risky Cryptographic Algorithm

The default configuration on OpenSSL before 0.9.8 uses MD5 for creating message digests instead of a more cryptographically strong algorithm, which makes it easier for remote attackers to forge certificates with a valid certificate authority signature...

Mozilla Firefox cleartext password leak

Weak authentication algorithm may be choosen by browser even if stronger one is supported by server...

[NEWS] Default Configuration Information Disclosure in Lotus Domino (Including Password Hashes)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

CVE-2005-2359

The AES-XCBC-MAC algorithm in IPsec in FreeBSD 5.3 and 5.4, when used for authentication without other encryption, uses a constant key instead of the one that was assigned by the system administrator, which can allow remote attackers to spoof packets to establish an IPsec session...

FreeBSD IPSec authentication bypass

Static key is used for AES-XCBC-MAC algorithm...

FreeBSD Security Advisory FreeBSD-SA-05:19.ipsec

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:19.ipsec Security Advisory The FreeBSD Project Topic: Incorrect key usage in AES-XCBC-MAC Category: core Module: netinet6 Announced: 2005-07-27 Credits: Yukiyo...

FreeBSD Security Advisory FreeBSD-SA-05:15.tcp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:15.tcp Security Advisory The FreeBSD Project Topic: TCP connection stall denial of service Category: core Module: inet Announced: 2005-06-29 Credits: Noritoshi...

FreeBSD-SA-05:15.tcp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:15.tcp Security Advisory The FreeBSD Project Topic: TCP connection stall denial of service Category: core Module: inet Announced: 2005-06-29 Credits: Noritoshi...

CVE-2002-1910

CVE-2002-1910 affects Click2Learn Ingenium Learning Management System, versions 5.1–6.1. The root cause is the use of weak, reversible password encryption, enabling attackers to obtain passwords. Public sources confirm the affected products/versions and the vulnerability description across NVD/Re...

CVE-2002-1910: Inadequate Encryption Strength

Click2Learn Ingenium Learning Management System 5.1 and 6.1 uses weak encryption for passwords reversible algorithm, which allows attackers to obtain passwords...

CVE-2002-1739

Alt-N Technologies Mdaemon versions 5.0–5.0.6 store user passwords with a weak encryption algorithm, enabling local users to crack them. Local access is required; confidentiality impact is indicated. Remediation: upgrade to a version that uses stronger password encryption. The connected PT-securi...

CVE-2002-1697

Electronic Code Book ECB mode in VTun 2.0 through 2.5 uses a weak encryption algorithm that produces the same ciphertext from the same plaintext blocks, which could allow remote attackers to gain sensitive information...