CVE-2009-0021

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to...

Input validation

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to...

CVE-2009-0021

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to...

CVE-2009-0021

Removed by vendor...

CVE-2008-5077

OpenSSL 0.9.8i and earlier does not properly check the return value from the EVPVerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys...

CVE-2008-5077

OpenSSL 0.9.8i and earlier are affected: EVP_VerifyFinal return value is not checked, allowing remote attackers to bypass certificate-chain validation for signatures using DSA/ECDSA. The CVE entry is documented with this OpenSSL defect; multiple advisories note this is a similar issue to CVE-2009...

Vulnerability in OpenSSL CVE-2008-5077

The Google Security Team discovered several functions inside OpenSSL incorrectly checked the result after calling the EVPVerifyFinal function, allowing a malformed signature to be treated as a good signature rather than as an error. This issue affected the signature checks on DSA and ECDSA keys...

Подмена подписанного документа в ECDSA

Серьёзная ошибка в ECDSA. В матаппарате новейшего американского стандарта ЭЦП известного как ECDSA DSA для эллиптических кривых 1 cтр. 25-30 существует серьёзная ошибка позволяющая выбрать такое значение секретного ключа, чтобы получить одинаковые подписи для разных документов. Это позволяет...

Signed content spoofing in ECDSA

Standard allows to generate private key in a way it will produce same signature for 2 different documents...

Серьёзная ошибка в новом госте ЭЦП!

Уважаемый 3APA3A Благодарю за публикацию в Вашей рассылке моего прошлого письма. Вот сообщение об ещё одной ошибке. В новом варианте российского стандарта электронной цифровой подписи ГОСТ 34.19-2001 вступающем в силу с августа этого года существует серьёзная ошибка, позволяющая сформировать к...

PT-2009-6710 · Openssl +1 · Openssl +1

Name of the Vulnerable Software and Affected Versions: OpenSSL versions 0.9.8i and earlier Description: The issue allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys. Exploitation of this issue can lead to a violation of...