913 matches found
CVE-2007-4879
CVE-2007-4879 affects Mozilla Firefox up to 2.0.0.12 (prior to 2.0.0.13) and SeaMonkey up to 1.1.8/1.1.9, allowing automatic TLS client certificate installation with minimal user interaction and automatic certificate presentation when requested. This enables cross-domain user tracking via TLS cli...
SOL5857 - Client certificate check vulnerability in Apache - CVE-2005-2700
In the default configuration, BIG-IP and 3-DNS do not require client certificates to connect to the Configuration utility. This vulnerability cannot be exploited without making unsupported changes to the BIG-IP or 3-DNS web server configuration. This problem was tracked as CR53583 and CR53585 and...
SOL6623 - OpenSSL signature vulnerability - CVE-2006-4339
This security advisory describes an OpenSSL signature vulnerability. Forged RSA signatures may be accepted during client certificate validations when the certificates are signed by certain Certificate Authority CA. This flaw could potentially cause F5 products to accept maliciously crafted client...
Critical: Red Hat Security Advisory: seamonkey security update (was mozilla)
Updated seamonkey packages that fix several security bugs in the mozilla package are now available for Red Hat Enterprise Linux 3. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and...
FreeBSD : openvpn -- denial of service: client certificate validation can disconnect unrelated clients (a51ad838-2077-48b2-a136-e888a7db5f8d)
James Yonan reports : DoS attack against server when run with 'verb 0' and without 'tls-auth'. If a client connection to the server fails certificate verification, the OpenSSL error queue is not properly flushed, which can result in another unrelated client instance on the server seeing the error...
CVE-2005-3426
Cisco CSS 11500 Content Services Switch CSS with SSL termination services allows remote attackers to cause a denial of service memory corruption and device reload via a malformed client certificate during SSL session negotiation...
Cisco 11500 Content Services Switch SSL Malformed Client Certificate Vulnerability
...
USN-177-1: Apache 2 vulnerabilities
Apache did not honour the "SSLVerifyClient require" directive within a block if the surrounding block contained a directive "SSLVerifyClient optional". This allowed clients to bypass client certificate validation on servers with the above configuration. CAN-2005-2700 Filip Sneppe discovered a...
Apache Httpd < 2.0.55 : SSLVerifyClient bypass
A flaw in the modssl handling of the "SSLVerifyClient" directive. This flaw would occur if a virtual host has been configured using "SSLVerifyClient optional" and further a directive "SSLVerifyClient required" is set for a specific location. For servers configured in this fashion, an attacker may...
PT-2005-3585 · Apache +2 · Mod Ssl +3
Name of the Vulnerable Software and Affected Versions: mod ssl versions prior to 2.8.24 Description: The issue arises from the improper enforcement of access restrictions in mod ssl when "SSLVerifyClient optional" is set in the global virtual host configuration and "SSLVerifyClient require" is se...
CVE-2005-2534
Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service server crash via simultaneous TCP connections from multiple clients that use the same client certificate...
DEBIAN-CVE-2005-2534
Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service server crash via simultaneous TCP connections from multiple clients that use the same client certificate...
openvpn -- denial of service: client certificate validation can disconnect unrelated clients
James Yonan reports: DoS attack against server when run with "verb 0" and without "tls-auth". If a client connection to the server fails certificate verification, the OpenSSL error queue is not properly flushed, which can result in another unrelated client instance on the server seeing the error...
CVE-2004-2216
Unknown vulnerability in Sun Java System Web Server 6.0 SP7 and earlier and 6.1 SP1 and earlier, and Application Server 7 Update 4 and earlier, allows remote attackers to cause a denial of service crash via a malformed client certificate...
CVE-2004-2216
Unknown vulnerability in Sun Java System Web Server 6.0 SP7 and earlier and 6.1 SP1 and earlier, and Application Server 7 Update 4 and earlier, allows remote attackers to cause a denial of service crash via a malformed client certificate...
Debian DSA-394-1 : openssl095 - ASN.1 parsing vulnerability
Steve Henson of the OpenSSL core team identified and prepared fixes for a number of vulnerabilities in the OpenSSL ASN1 code that were discovered after running a test suite by British National Infrastructure Security Coordination Centre NISCC. A bug in OpenSSLs SSL/TLS protocol was also identifie...
CVE-2004-0009
CVE-2004-0009 affects Apache-SSL: versions 1.3.28+1.52 and earlier are vulnerable when SSLVerifyClient is set to 1 or 3 and SSLFakeBasicAuth is enabled, allowing remote attackers to forge a client certificate using the target user’s one-line DN. Root cause involves SSLVerifyClient/SSLFakeBasicAut...
GLSA-200406-05 : Apache: Buffer overflow in mod_ssl
The remote host is affected by the vulnerability described in GLSA-200406-05 Apache: Buffer overflow in modssl A bug in the function sslutiluuencodebinary in sslutil.c may lead to a remote buffer overflow on a server configured to use FakeBasicAuth that will trust a client certificate with an...
Apache-SSL < 1.3.29 / 1.53 SSLVerifyClient SSLFakeBasicAuth Client Certificate Forgery
Binary data 1167.prm...
Mandrake Linux Security Advisory : mod_ssl (MDKSA-2002:020)
Ed Moyle discovered a buffer overflow in modssl's session caching mechanisms that use shared memory and dbm. This could potentially be triggered by sending a very long client certificate to the server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...