CVE-2007-6340

The connected advisory confirms CVE-2007-6340 affects LSrunasE 1.0 and Supercrypt 1.0 and explains the root cause: RC4 is used without a unique initialization vector, deriving a constant keystream across all passwords. This insecure design allows an attacker with local access to break encryption ...

Insecure Use of RC4 in LSrunasE and Supercrypt (CVE-2007-6340)

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: LSrunasE, Supercrypt Vendor: Geert Moernaut Type: Flawed Encryption Risk: Medium Author: Daniel Roethlisberger Date: 2008-01-29 CVE Name: CVE-2007-6340 Introduction ------------ LSrunasE 1 and Supercrypt 2 are utilities used to run commands...

SuSE 10 Security Update : openCryptoki (ZYPP Patch Number 4244)

The openCryptoki crypto framework package has been updated to fix a incorrect crypto initialisation which leads to weak IV initial vectors. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

Design/Logic Flaw

The blowfish mode in DAR before 2.3.4 uses weak Blowfish-CBC cryptography by 1 discarding random bits by the blowfish::makeivec function in libdar/crypto.cpp that results in predictable and repeating IV values, and 2 direct use of a password for keying, which makes it easier for context-dependent...

CVE-2007-3528

The blowfish mode in DAR before 2.3.4 uses weak Blowfish-CBC cryptography by 1 discarding random bits by the blowfish::makeivec function in libdar/crypto.cpp that results in predictable and repeating IV values, and 2 direct use of a password for keying, which makes it easier for context-dependent...

CVE-2007-3528

The blowfish mode in DAR before 2.3.4 uses weak Blowfish-CBC cryptography by 1 discarding random bits by the blowfish::makeivec function in libdar/crypto.cpp that results in predictable and repeating IV values, and 2 direct use of a password for keying, which makes it easier for context-dependent...

CVE-2007-3528

The blowfish mode in DAR before 2.3.4 uses weak Blowfish-CBC cryptography by 1 discarding random bits by the blowfish::makeivec function in libdar/crypto.cpp that results in predictable and repeating IV values, and 2 direct use of a password for keying, which makes it easier for context-dependent...

OpenLDAP kbind remote exploit

No description provided by source. / openldap-kbind-p00f.c - OpenLDAP kbind remote exploit Only works on servers compiled with --enable-kbind enable LDAPv2+ Kerberos IV bind deprecated no by Solar Eclipse [email protected] Shoutouts to LSD for their l33t asm code and to all 0dd people...

OpenLDAP <= 2.4.3 (KBIND) Remote Buffer Overflow Exploit

No description provided by source. / openldap-kbind-p00f.c - OpenLDAP kbind remote exploit Only works on servers compiled with --enable-kbind enable LDAPv2+ Kerberos IV bind deprecated no by Solar Eclipse [email protected] Shoutouts to LSD for their l33t asm code and to all 0dd people...

OpenLDAP 2.4.3 - 'KBIND' Remote Buffer Overflow

/ openldap-kbind-p00f.c - OpenLDAP kbind remote exploit Only works on servers compiled with --enable-kbind enable LDAPv2+ Kerberos IV bind deprecated no by Solar Eclipse Shoutouts to LSD for their l33t asm code and to all 0dd people Private 0dd code. / include include include include include...

OpenLDAP 2.4.3 - KBIND Remote Buffer Overflow

OpenLDAP 2.4.3 - KBIND Remote Buffer Overflow / openldap-kbind-p00f.c - OpenLDAP kbind remote exploit Only works on servers compiled with --enable-kbind enable LDAPv2+ Kerberos IV bind deprecated no by Solar Eclipse Shoutouts to LSD for their l33t asm code and to all 0dd people Private 0dd code. ...

nCipher Advisory #13: CBC-MAC IV misleading programming interface

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 nCipher Security Advisory No. 13 CBC-MAC IV misleading programming interface ------------------------------------------- Note ==== nCipher is publishing three advisories numbered 12, 13 and 14 simultaneously. You are advised to review all three before...

DEBIAN-CVE-2006-0898

Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector IV of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael...

Perl Crypt::CBC module weak cryptography

Invalid Initialization vector generation algorithm for block cyphers with blocks different from 8 bytes Rijndael...

Vulnerability in Crypt::CBC Perl module, versions <= 2.16

Perl Module Security Advisory ------------------------------------------------------------------------------- Title: Crypt::CBC ciphertext weakness when using certain block algorithms Severity: High Versions: All versions = 2.16. Date: 23 February 2006...

UltraVNC w/ DSM Plugin Detection

UltraVNC seems to be running on the remote port. Upon connection, the remote service on this port always sends the same 12 pseudo-random bytes. It is probably UltraVNC with the old DSM encryption plugin. This plugin tunnels the RFB protocol into a RC4-encrypted stream. This old protocol does not...

CVE-2004-2136

The CVE-2004-2136 entry concerns dm-crypt in the Linux kernel (2.6.x) used on certain filesystems with block sizes of 1024 or greater. The underlying issue is an IV computation weakness in the encryption mode that can allow watermarked files to be detected without decrypting the data. The availab...

CVE-2004-2135

Cryptoloop in Linux kernel 2.6.x, when used on file systems with a block size of 1024 or greater, contains IV computation weaknesses that allow watermarked files to be detected without decryption. The documented impact is PARTIAL confidentiality loss. No exploits, specific remediations, or affect...

Linux Kernel Cryptoloop encrypted filesystem weak encryption

Weak IV Initial Vector generation algorithm allows data watermarking, making it possible to detect data in filesystem...

[EXPL] Linux Cryptoloop Watermark Exploit

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...