Dan Farmer Presents Research on IPMI Vulnerabilities

If enterprises are indeed moving services off premises and into the cloud, there are four letters those companies’ IT organizations should be aware of: IPMI. Short for Intelligent Platform Management Interface, these tiny computers live as an embedded Linux system attached to the motherboards of...

CVE-2014-0878

CVE-2014-0878 affects IBMJCE/IBMSecureRandom in IBM SDK Java Technology Edition (various service refresh levels: 5.0 SR16 FP6 and earlier; 6 SR16 and earlier; 6.0.1 SR8; 7 SR7; 7R1 SR1). The vulnerability allows context-dependent attackers to predict the RNG output, undermining cryptographic prot...

CVE-2013-7372

The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNGSecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture JCA in Android before 4.4 and...

Design/Logic Flaw

The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNGSecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture JCA in Android before 4.4 and...

Design/Logic Flaw

Android before 4.4 does not properly arrange for seeding of the OpenSSL PRNG, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging use of the PRNG within multiple applications...

CVE-2013-7372

CVE-2013-7372 affects the SecureRandom implementation in Apache Harmony (SHA1PRNG_SecureRandomImpl) used by JCA in Android up to version 4.3/4.4 boundaries. The engineNextBytes function uses an incorrect offset when no user seed is provided, making the PRNG output more predictable and enabling at...

CVE-2014-0848

The 1 ssl.conf and 2 httpd.conf files in the Apache HTTP Server component in IBM Netezza Performance Portal 2.0 before 2.0.0.4 have weak SSLCipherSuite values, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack...

CVE-2014-0848

CVE-2014-0848 affects IBM Netezza Performance Portal 2.0 (before 2.0.0.4) where the Apache HTTP Server default config uses weak SSLCipherSuite values, enabling a remote attacker to potentially defeat cryptographic protections via brute-force. Vulnerable component: Apache web server in PERFPORTAL ...

CVE-2014-0848

The 1 ssl.conf and 2 httpd.conf files in the Apache HTTP Server component in IBM Netezza Performance Portal 2.0 before 2.0.0.4 have weak SSLCipherSuite values, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack...

CVE-2014-2250

The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than...

Code injection

The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than...

CVE-2014-2250

The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than...

CVE-2014-2250

CVE-2014-2250 concerns Siemens SIMATIC S7-1200 CPUs with firmware before 4.0, where the PRNG has insufficient entropy. This weaknesses can enable remote attackers to defeat cryptographic protections and hijack sessions via unspecified vectors. Public material ties this to the S7-1200 family and n...

CVE-2014-2251

The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors...

Code injection

The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors...

CVE-2014-2251

The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors...

CVE-2014-2251

Siemens SIMATIC S7-1500 CPUs with firmware

Ubuntu 12.04 LTS / 12.10 / 13.10 : thunderbird vulnerabilities (USN-2119-1)

Christian Holler, Terrence Cole, Jesse Ruderman, Gary Kwong, Eric Rescorla, Jonathan Kew, Dan Gohman, Ryan VanderMeulen and Sotaro Ikeda discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker...

Ubuntu: Security Advisory (USN-2119-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2102-2: Firefox regression

USN-2102-1 fixed vulnerabilities in Firefox. The update introduced a regression which could make Firefox crash under some circumstances. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Christian Holler, Terrence Cole, Jesse Ruderman, Gary Kwong, Eric...