Twitter Implements Perfect Forward Secrecy

Twitter took another step toward not only securing the privacy of its users’ communication over the social network, but in warding off the prying eyes of government surveillance with the implementation of Perfect Forward Secrecy. The technology thwarts the efforts of anyone who may be collecting...

Updated firefox, rootcerts, nspr & nss packages fix security vulnerabilities

Updated nspr and nss packages fix security vulnerabilities: Potentially exploitable buffer overflow in NSS before 3.15.3 that allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets CVE-2013-5605. The CERTVerifyCert function in...

[security bulletin] HPSBMU02902 rev.1 - HP Integrated Lights-Out iLO3, iLO4 IPMI Cipher Suite 0 Authentication Bypass Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03844348 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03844348 Version: 1 HPSBMU02902 rev....

IPMI Cipher Suite Zero Authentication Bypass

Binary data ipmicipher0authbypass.nbin...

Oracle Linux 6 : openldap (ELSA-2012-1151)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1151 advisory. - CVE-2012-2668 825875 cipher suite selection by name can be ignored default cipher suite is always selected Tenable has extracted the preceding description blo...

CVE-2013-4784

The HP Integrated Lights-Out iLO BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...

Authentication flaw

The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...

Authentication flaw

The HP Integrated Lights-Out iLO BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...

CVE-2013-4783

The CVE-2013-4783 entry documents an authentication bypass in Dell iDRAC6/7: iDRAC6 firmware 1.x before 1.92, 2.x, and 3.x before 3.42, and iDRAC7 firmware before 1.23.23, allow remote attackers to bypass authentication and run arbitrary IPMI commands by using cipher suite 0 (cipher zero) with an...

CVE-2013-4782

The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 aka cipher zero and an arbitrary password...

CVE-2013-4784

The CVE-2013-4784 vulnerability affects HP iLO BMC implementations and enables remote attackers to bypass authentication and execute arbitrary IPMI commands by triggering cipher suite 0 (cipher zero) with any password. The issue is a cipher-zero authentication bypass over IPMI, allowing network-a...

CVE-2013-4782

CVE-2013-4782 affects Supermicro BMC/IPMI: authentication bypass via IPMI 2.0 cipher suite 0 (cipher zero) allows remote execution of arbitrary IPMI commands. Affected component is the BMC’s IPMI implementation; the root cause is cipher-zero authentication bypass. Impact stated across sources inc...

New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions

There is a feature supported by the SSL/TLS encryption standard and used by most of the major browsers that leaks enough information about encrypted sessions to enable attackers decrypt users’ supposedly protected cookies and hijack their sessions. The researchers who developed the attack that...

Low: openldap

Issue Overview: It was found that the OpenLDAP server daemon ignored olcTLSCipherSuite settings. This resulted in the default cipher suite always being used, which could lead to weaker than expected ciphers being accepted during Transport Layer Security TLS negotiation with OpenLDAP clients...

CentOS 6 : openldap (CESA-2012:1151)

Updated openldap packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

CentOS Update for openldap CESA-2012:1151 centos6

Check for the Version of openldap OpenVAS Vulnerability Test CentOS Update for openldap CESA-2012:1151 centos6 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

RedHat Update for openldap RHSA-2012:1151-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

RedHat Update for openldap RHSA-2012:1151-01

Check for the Version of openldap OpenVAS Vulnerability Test RedHat Update for openldap RHSA-2012:1151-01 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Scientific Linux Security Update : openldap on SL6.x i386/x86_64 (20120808)

It was found that the OpenLDAP server daemon ignored olcTLSCipherSuite settings. This resulted in the default cipher suite always being used, which could lead to weaker than expected ciphers being accepted during Transport Layer Security TLS negotiation with OpenLDAP clients. CVE-2012-2668 This...

openldap: does not honor TLSCipherSuite settings

libraries/libldap/tlsm.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive...