HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability (BEAST)

A vulnerability exists in SSL 3.0 and TLS 1.0 that could allow information disclosure if an attacker intercepts encrypted traffic served from an affected system. TLS 1.1, TLS 1.2, and all cipher suites that do not use CBC mode are not affected. This plugin tries to establish an SSL/TLS remote...

[SECURITY] [DSA 2398-2] curl regression

------------------------------------------------------------------------- Debian Security Advisory DSA-2398-2 [email protected] http://www.debian.org/security/ Florian Weimer March 31, 2012 http://www.debian.org/security/faq -...

SOL13400 - SSL 3.0/TLS 1.0 BEAST vulnerability CVE-2011-3389 and TLS protocol vulnerability CVE-2012-1870

If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version in the column, the...

HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

Debian Security Advisory DSA 2398-1 (curl)

The remote host is missing an update to curl announced via advisory DSA 2398-1. OpenVAS Vulnerability Test $Id: deb23981.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2398-1 curl Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Debian Security Advisory DSA 2398-1 (curl)

The remote host is missing an update to curl announced via advisory DSA 2398-1. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Apple Ships Huge Set of Patches for OS X

Apple has released a massive set of patches for a wide range of security vulnerabilities in a number of its products and components, including OSX Lion and QuickTime. The patches, which are rolled up in OS X 10.7.3, fix a slew of serious bugs, many of which can be used to execute remote code on...

Mac OS X Multiple Vulnerabilities (Security Update 2012-001) (BEAST)

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-001 applied. This update contains multiple security-related fixes for the following components : - Apache - ATS - ColorSync - CoreAudio - CoreMedia - CoreText - curl - Data Security - dovecot - filecmds ...

Debian DSA-2398-2 : curl - several vulnerabilities (BEAST)

Several vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-3389 This update enables OpenSSL workarounds against the 'BEAST' attack. Additional information can be found in the cURL...

SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 7908) (BEAST)

IBM Java 1.4.2 SR13 FP11 has been released and contains various security fixes. http://www.ibm.com/developerworks/java/jdk/alerts/ http://www.mozilla.org/en-US/firefox/10.0/releasenotes/ CVEs fixed: CVE-2011-3547 / CVE-2011-3548 / CVE-2011-3549 / CVE-2011-3552 / CVE-2011-3545 / CVE-2011-3556 /...

SSL CBC IV vulnerability

curl is vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL for the SSL/TLS layer. This vulnerability has been identified CVE-2011-3389 aka the "BEAST" attack and is addressed by OpenSSL already as they have made a workaround to mitigate the problem. When doing so, they figured out...

CURL-CVE-2011-3389 SSL CBC IV vulnerability

curl is vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL for the SSL/TLS layer. This vulnerability has been identified CVE-2011-3389 aka the "BEAST" attack and is addressed by OpenSSL already as they have made a workaround to mitigate the problem. When doing so, they figured out...

SuSE 10 Security Update : IBM Java (ZYPP Patch Number 7926) (BEAST)

IBM Java 1.6.0 SR10 has been released fixing the following CVE's : - CVE-2011-3389 - CVE-2011-3516 - CVE-2011-3521 - CVE-2011-3544 - CVE-2011-3545 - CVE-2011-3546 - CVE-2011-3547 - CVE-2011-3548 - CVE-2011-3549 - CVE-2011-3550 - CVE-2011-3551 - CVE-2011-3552 - CVE-2011-3553 - CVE-2011-3554 -...

WS-2012-0019

In php-src, php-5.3.1RC1 to php-5.4.0beta2 there is a vulnerability which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack BCBA on an HTTPS session, in conjunction with JavaScript code that uses 1 the HTML5 WebSocket API 2 the Java...

RHEL 6 : java-1.6.0-ibm (RHSA-2012:0034)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0034 advisory. The IBM Java SE version 6 release includes the IBM Java 6 Runtime Environment and the IBM Java 6 Software Development Kit. This update fixes...

HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

Debian DSA-2358-1 : openjdk-6 - several vulnerabilities (BEAST)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Java platform. This combines the two previous openjdk-6 advisories, DSA-2311-1 and DSA-2356-1. - CVE-2011-0862 Integer overflow errors in the JPEG and font parser allow untrusted code including applets to elevate it...

Debian DSA-2368-1 : lighttpd - multiple vulnerabilities (BEAST)

Several vulnerabilities have been discovered in lighttpd, a small and fast webserver with minimal memory footprint. - CVE-2011-4362 Xi Wang discovered that the base64 decoding routine which is used to decode user input during an HTTP authentication, suffers of a signedness issue when processing...

Microsoft Fixes BEAST SSL Bug in January Patch Tuesday

Microsoft on Tuesday patched the vulnerability in Windows that was exploited by the BEAST SSL attack tool developed by Juliano Rizzo and Thai Duong last year. The patch is one of several rated important that was issued by Microsoft in January’s Patch Tuesday release, and there also was a critical...