CVE-2014-9294

CVE-2014-9294 concerns ntp-keygen generating weak MD5 keys due to a non-cryptographic RNG seed in ntp-keygen before 4.2.7p230. The IBM AIX advisory confirms this weak RNG seed and lists fixes for both NTPv3 and NTPv4, with interim and packaged updates available (e.g., specific AIX fixes and downl...

CVE-2014-9294

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack...

CVE-2014-9294

Removed by vendor...

CVE-2014-9293

The configauth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack...

CVE-2014-9293

Removed by vendor...

UBUNTU-CVE-2014-9294

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack...

CVE-2014-9294

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack...

UBUNTU-CVE-2014-9293

The configauth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack...

Information disclosure

The Configuration Patterns component in IBM Flex System Manager FSM 1.2.0.x, 1.2.1.x, 1.3.0.x, and 1.3.1.x uses a weak algorithm in an encryption step during Chassis Management Module CMM account creation, which makes it easier for remote authenticated users to defeat cryptographic protection...

Code injection

IBM WebSphere DataPower SOA appliances through 4.0.2.15, 5.x through 5.0.0.17, 6.0.0.x through 6.0.0.9, and 6.0.1.x through 6.0.1.5 make it easier for remote attackers to obtain a PreMasterSecret value and defeat cryptographic protection mechanisms by sending a large number of requests in an...

Oracle Traffic Director Multiple Vulnerabilities (July 2014 CPU)

The remote host is running an unpatched version of Oracle Traffic Director that is affected by the following vulnerabilities : - The implementation of Network Security Services NSS does not ensure that data structures are initialized, which could result in a denial of service or disclosure of...

AIX Java Advisory : java_apr2014_advisory.asc

The version of Java SDK installed on the remote host is potentially affected by the following vulnerabilities : - There is an information disclosure flaw in libjpeg and libjpeg-turbo allowing remote attackers access to uninitialized memory via crafted JPEG images. CVE-2013-6629 - A vulnerability ...

CVE-2014-2362

OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation...

Design/Logic Flaw

OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation...

CVE-2014-2362

The CVE-2014-2362 entry concerns OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, which rely on the time64() value from the C library as entropy for the site security key. This cryptographic weakness can allow an unauthenticated or remote attacker to predict the site key and po...

CVE-2014-2362 OleumTech WIO Use of Cryptographically Weak Pseudo-Random Number Generator

OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation...

Oracle GlassFish Server Multiple Vulnerabilities (July 2014 CPU)

The version of GlassFish Server running on the remote host is affected by multiple vulnerabilities in the following components : - The implementation of Network Security Services NSS does not ensure that data structures are initialized, which could result in a denial of service or disclosure of...

Oracle iPlanet Web Server 7.0.x < 7.0.20 Multiple Vulnerabilities

According to its self-reported version, the Oracle iPlanet Web Server formerly Sun Java System Web Server running on the remote host is 7.0.x prior to 7.0.20. It is, therefore, affected by the following vulnerabilities in the Network Security Services NSS : - The implementation of NSS does not...

Default configuration

The default configuration of EMC RSA BSAFE Toolkits and RSA Data Protection Manager DPM 20130918 uses the Dual Elliptic Curve Deterministic Random Bit Generation DualECDRBG algorithm, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by leveraging...

CVE-2013-6078

CVE-2013-6078 affects EMC RSA BSAFE Toolkits and RSA Data Protection Manager (DPM) 20130918 family when configured by default to use Dual_EC_DRBG. The issue arises from the use of Dual_EC_DRBG, which can enable context-dependent attackers to defeat cryptographic protections. The description notes...