USN-1357-1: OpenSSL vulnerabilities

It was discovered that the elliptic curve cryptography ECC subsystem in OpenSSL, when using the Elliptic Curve Digital Signature Algorithm ECDSA for the ECDHEECDSA cipher suite, did not properly implement curves over binary fields. This could allow an attacker to determine private keys via a timi...

DSA-2390-1 openssl - several

Bulletin has no description...

Mandriva Update for openssl MDVSA-2011:136 (openssl)

Check for the Version of openssl OpenVAS Vulnerability Test Mandriva Update for openssl MDVSA-2011:136 openssl Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

Mandriva Update for openssl MDVSA-2011:137 (openssl)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Mandriva Linux Security Advisory : openssl (MDVSA-2011:137)

Multiple vulnerabilities has been discovered and corrected in openssl : The elliptic curve cryptography ECC subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm ECDSA is used for the ECDHEECDSA cipher suite, does not properly implement curves over binary...

Mandriva Linux Security Advisory : openssl (MDVSA-2011:136)

A vulnerability was discovered and corrected in openssl : The elliptic curve cryptography ECC subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm ECDSA is used for the ECDHEECDSA cipher suite, does not properly implement curves over binary fields, which...

SOL12998 - OpenSSL vulnerability CVE-2011-1945

The elliptic curve cryptography ECC subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm ECDSA is used for the ECDHEECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine...

CVE-2011-1945

The elliptic curve cryptography ECC subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm ECDSA is used for the ECDHEECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine...

CVE-2011-1945

The elliptic curve cryptography ECC subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm ECDSA is used for the ECDHEECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine...

CVE-2011-1945

The CVE-2011-1945 entry concerns the ECC subsystem in OpenSSL 1.0.0d and earlier, where ECDSA used for the ECDHE_ECDSA cipher suite does not properly implement curves over binary fields. This weakness can enable context-dependent attackers to recover private keys via timing attacks and lattice ca...

CVE-2011-1945

The elliptic curve cryptography ECC subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm ECDSA is used for the ECDHEECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine...

CVE-2011-1945

The elliptic curve cryptography ECC subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm ECDSA is used for the ECDHEECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine...

SAP TesContainerAdmin service - Stored XSS

Application: SAP Cfolders included in: SAP SRM, SAP ECC, SAP Knowledge Management and SAP NetWeaver cRooms Vendor URL: Bugs: Multiple Stored XSS Risk: High Exploits: YES Reported: 13.05.2011 Vendor response: 14.05.2011 Date of Public Advisory: 20.01.2012 Reference: SAP Security Note 1591749...

SAP NetWeaver Administrator Panel ECC 6.0 Cross Site Scripting

Digital Security Research Group DSecRG Advisory Application: SAP NetWeaver Administrator panel Versions Affected: SAP NetWeaver Administrator panel from ECC 6.0 Vendor URL: http://SAP.com Bugs: XSS Exploits: YES Reported: 07.09.2009 Vendor response: 08.09.2009 Date of Public Advisory: 09.11.2010...

SAP Netweaver SQL Monitors — Multiple XSS

Application: SAP Netweaver Administrator panel Versions Affected: SAP Netweaver Administrator panel from ECC 6.0 Vendor URL: Bugs: XSS Exploits: YES Reported: 07.09.2009 Vendor response: 08.09.2009 Date of Public Advisory: 09.11.2010 Author: Alexandr Polyakov and Alexey Troshichev Description Ope...

FreeBSD : libtomcrypt -- weak signature scheme with ECC keys (a78299e7-9ef3-11da-b410-000e0c2e438a)

The Secure Science Corporation reports that libtomcrypt is vulnerable to a weak signature scheme. This allows an attacker to create a valid random signature and use that to sign arbitrary messages without requiring the private key. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Secure Science Corporation Advisory CSA-056

Secure Science Corporation Advisory CSA-056 http://www.securescience.net [email protected] 877-570-0455 --------------------------------------------------------- LibTomCrypt version =1.02 contained weak signature scheme used with ECC keys, allowing trivial signature forgeries...

LibTomCrypt cryptography weakness

ECC Elliptic Curve Cryptography signature scheme weakness...

[SA15233] LibTomCrypt Unspecified ECC Signature Scheme Vulnerability

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: LibTomCrypt Unspecified ECC Signature Scheme...

libtomcrypt -- weak signature scheme with ECC keys

The Secure Science Corporation reports that libtomcrypt is vulnerable to a weak signature scheme. This allows an attacker to create a valid random signature and use that to sign arbitrary messages without requiring the private key...