26 matches found
SUSE CVE-2015-2319
The TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORTRSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204...
Security Bulletin:GSKit vulnerable to FREAK - GSKit Ephemeral RSA Vulnerability
Summary GSKit with accept an Ephemeral RSA Key for non export CipherSuites in SSLV3.0 and TLS 1.0 Vulnerability Details CVE ID: CVE-2014-8730 DESCRIPTION: The SSL profiles component in F5 BIG-IP LTM, APM, and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, AAM 11.4.0 through 11.5.1, AFM 11.3...
Security Bulletin: FREAK vulnerability in TLS/SSL affects IBM CICS Transaction Gateway (CVE-2015-0204)
Summary A vulnerability in the OpenSSL ssl3getkeyexchange function could allow a remote downgrade the security of certain TLS connections. An OpenSSL client accepts the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using a...
openssl: only allow ephemeral RSA keys in export ciphersuites (FREAK)
It was discovered that OpenSSL would accept ephemeral RSA keys when using non-export RSA cipher suites. A malicious server could make a TLS/SSL client using OpenSSL use a weaker key exchange method...
Logstash SSL/TLS FREAK Vulnerability CVE-2015-5378
Logstash 1.5.2 and prior versions are vulnerable to a SSL/TLS security issue called the FREAK attack. If you are using the Lumberjack input, FREAK allows an attacker to successfully implement a man in the middle attack, intercepting communication between the Logstash Forwarder agent and Logstash...
JDK: ephemeral RSA keys accepted for non-export SSL/TLS cipher suites (FREAK)
GSKit in IBM Tivoli Directory Server ITDS 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server ISDS 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict T...
JDK: ephemeral RSA keys accepted for non-export SSL/TLS cipher suites (FREAK)
GSKit in IBM Tivoli Directory Server ITDS 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server ISDS 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict T...
openssl: only allow ephemeral RSA keys in export ciphersuites (FREAK)
It was discovered that OpenSSL would accept ephemeral RSA keys when using non-export RSA cipher suites. A malicious server could make a TLS/SSL client using OpenSSL use a weaker key exchange method...
JDK: ephemeral RSA keys accepted for non-export SSL/TLS cipher suites (FREAK)
GSKit in IBM Tivoli Directory Server ITDS 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server ISDS 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict T...
JDK: ephemeral RSA keys accepted for non-export SSL/TLS cipher suites (FREAK)
GSKit in IBM Tivoli Directory Server ITDS 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server ISDS 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict T...
openssl: only allow ephemeral RSA keys in export ciphersuites (FREAK)
It was discovered that OpenSSL would accept ephemeral RSA keys when using non-export RSA cipher suites. A malicious server could make a TLS/SSL client using OpenSSL use a weaker key exchange method...
openssl: only allow ephemeral RSA keys in export ciphersuites (FREAK)
It was discovered that OpenSSL would accept ephemeral RSA keys when using non-export RSA cipher suites. A malicious server could make a TLS/SSL client using OpenSSL use a weaker key exchange method...
FREAK Attack: How to Protect Yourself
The recently disclosed FREAK Factoring attack on RSA Export Keys attack is an SSL/TLS vulnerability that is affecting major browsers, servers and even mobile devices. FREAK vulnerability allows the attacker to intercept HTTPS connections between vulnerable clients and servers and force them to us...
IBM Tivoli Directory Server (ITDS) FREAK Degradation Attack Vulnerability
IBM Tivoli Directory Server is a powerful implementation of LDAP directory services. A security vulnerability exists in IBM Tivoli Directory Server due to the failure of GSKit in this program to properly restrict TLS stateful transmissions. This allows attackers to exploit the vulnerability to...
USN-2547-1 mono vulnerabilities
It was discovered that the Mono TLS implementation was vulnerable to the SKIP-TLS vulnerability. A remote attacker could possibly use this issue to perform client impersonation attacks. CVE-2015-2318 It was discovered that the Mono TLS implementation was vulnerable to the FREAK vulnerability. A...
Apple Safari WebKit Vulnerabilities Patched
Apple on Tuesday pushed out new versions of its Safari browser that address 17 security vulnerabilities in the WebKit engine. Safari 8.04, 7.14 and 6.24 patch multiple memory corruption issues in WebKit, Apple said. “These issues were addressed through improved memory handling,” Apple said in its...
BlackBerry the company's multiple products by FREAK vulnerability-vulnerability warning-the black bar safety net
The BlackBerry company recently issued a notice, saying that its multiple product lines by the FREAK SSL vulnerability, including multiple versions of the BlackBerryoperating system, Enterprise Server and the BlackBerry communication tools. It is worth mentioning that BlackBerry is the initiative...
Splunk Enterprise 6.2.x < 6.2.2 Multiple Vulnerabilities (FREAK)
According to its version number, the Splunk Enterprise hosted on the remote web server is version 6.2.x prior to 6.2.2. It is, therefore, affected by the following vulnerabilities : - A flaw exists with ECDH handshakes when using an ECDSA certificate without a ServerKeyExchange message. This allo...
March 2015 Adobe Flash Player Security Update APSB15-05
Adobe this afternoon pushed out a Flash Player update patching 11 critical security vulnerabilities, most of which lead to remote code execution. None are being publicly exploited, Adobe said. Versions 16.0.0.305 and earlier of the Flash Player Desktop and Flash Player for Google Chrome are...
Microsoft released for the FREAK vulnerability and Stuxnet virus update-vulnerability warning-the black bar safety net
On Tuesday, Microsoft released for the FREAK vulnerability and Stuxnet（earthquake network virus security update. FREAK harm widely The FREAK vulnerability is not only present in the windows, A days ago Apple has also released IOS and OSX on the FREAK updates. Back in March three, Google has also...