SuSE 11.3 Security Update : glibc (SAT Patch Number 10357)

glibc has ben updated to fix three security issues : - wordexp failed to honour WRDENOCMD bsc906371. CVE-2014-7817 - Fixed invalid file descriptor reuse while sending DNS query bsc915526. CVE-2013-7423 - Fixed buffer overflow in wscanf bsc916222 These non-security issues have been fixed:...

NAT-PMP Security Vulnerability Affects 1.2M Routers

Vulnerabilities in embedded devices, in particular small office and home office routers, have been relentless. Another serious issue was discovered this week that affects more than 1.2 million such devices due to improper NAT-PMP protocol implementations, most of which run counter to the...

SSL 3.0 MITM Attack

A vulnerability affecting most implementations of SSL 3.0 has been discovered that allows an attacker to decrypt some encrypted contents under certain conditions CVE-2014-3566. The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak...

Microsoft Extends SHA-2, TLS Support for Windows

One by one, tech companies have been tossing aside the SHA-1 cryptographic algorithm like the unreliable collision-prone mess that it is. Microsoft was among the first to steer its customers away from SHA-1 and established an internal edict that its developers would no longer use it for...

Cryptography Expert Says, 'PGP Encryption is Fundamentally Broken, Time for PGP to Die'

A Senior cryptography expert has claimed multiple issues with PGP email encryption - an open source end-to-end encryption to secure email. Before continuing, I would like to clarify that covering this topic doesn't mean you should stop using PGP encryption, instead we are bringing to you what...

OpenSSL 0.9.x CBC Error Information Leakage Weakness

No description provided by source. source: http://www.securityfocus.com/bid/6884/info A side-channel attack against implementations of SSL exists that, through analysis of the timing of certain operations, can reveal sensitive information to an active adversary. This information leaked by...

OpenSSL Heartbleed Highlights Crypto Pitfalls

There is no shortage of bad advice online about crypto–or anything else, for that matter. And the recent mess involving the OpenSSL heartbleed vulnerability has brought out plenty of advice on building, implementing and repairing cryptosystems, but experts say that the fundamental truths about ho...

Extended Random Extension Made Cracking BSAFE Trivial

UPDATE: Known theoretical attacks against TLS using the troubled Dual EC random number generator— something an intelligence agency might try its hand at—are in reality a bit more challenging than we’ve been led to believe. The addition of the Extended Random extension to RSA Security’s BSAFE...

[CIAT] Crypto Implementations Analysis Toolkit

.png The Cryptographic Implementations Analysis Toolkit CIAT is compendium of command line and graphical tools whose aim is to help in the detection and analysis of encrypted byte sequences within files executable and non-executable. Download CIAT...

[SECURITY] Fedora 19 Update: hylafax+-5.5.4-1.fc19

HylaFAXtm is a enterprise-strength fax server supporting Class 1 and 2 fax modems on UNIX systems. It provides spooling services and numerous supporting fax management tools. The fax clients may reside on machines different from the server and client implementations exist for a number of platform...

Attack Exploits Weakness in RC4 Cipher to Decrypt User Sessions

It’s been more than 25 years since Ron Rivest invented his RC4 stream cipher, and after all that time it’s still being used widely, which is something of an achievement in the crypto world. However, for more than 15 years researchers have known about a weakness in RC4 that could enable an attacke...

[IPv6 Toolkit v1.3] Security Assessment and Troubleshooting Tool for the IPv6 Protocols

A security assessment and troubleshooting tool for the IPv6 protocols. The SI6 Networks’ IPv6 toolkit is a set of IPv6 security/trouble-shooting tools, that can send arbitrary IPv6-based packets. Supported platforms The following platforms are supported: FreeBSD, NetBSD, OpenBSD, Linux, and Mac O...

[SECURITY] Fedora 17 Update: boost-1.48.0-14.fc17

Boost provides free peer-reviewed portable C++ source libraries. The emphasis is on libraries which work well with the C++ Standard Library, in the hopes of establishing "existing practice" for extensions and providing reference implementations so that the Boost libraries are suitable for eventua...

Cisco IOS multiple security vulnerabilities

Multiple DoS conditions in different protocols implementations...

Scientific Linux Security Update : kernel on SL 5.0-5.4 i386/x86_64

This kernel is already in SL 5.5 This updated contains all the security and bug fixes from the 2.6.18-194.el5 kernel. In additions this update fixes the following security issues : - a flaw was found in the Unidirectional Lightweight Encapsulation ULE implementation. A remote attacker could send ...

Debian Security Advisory DSA 2398-2 (curl)

The remote host is missing an update to curl announced via advisory DSA 2398-2. OpenVAS Vulnerability Test $Id: deb23982.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2398-2 curl Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

Ubuntu Update for openjdk-6 vulnerabilities USN-1079-1

Ubuntu Update for Linux kernel vulnerabilities USN-1079-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN10791.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for openjdk-6 vulnerabilities USN-1079-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH,...

TELUS Security Labs VR - iSCSI target Multiple Implementations iSNS Stack Buffer Overflow

iSCSI target Multiple Implementations iSNS Stack Buffer Overflow TSL ID: FSC20100701-01 1. Affected Software iSCSI Enterprise Project iscsitarget 1.4.20.1 and prior SCST project iscsi-scst 1.0.1.1 and prior tgt project tgt 1.0.5 and prior References: http://iscsitarget.sourceforge.net/...

SSH Brute Force Attacks Resurface

Security experts are warning about a fresh round of attacks against SSH implementations. The attacks are brute-force attempts to authenticate to remote SSH servers, a tactic that has been used quite often in the past in distributed attacks. The attacks, which the handlers at the SANS Internet Sto...

RHEL 5 : kernel (RHSA-2010:0398)

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...