PT-2007-1420 · Utimaco · Utimaco Safeguard

Name of the Vulnerable Software and Affected Versions: Utimaco Safeguard affected versions not specified Description: The centralized management feature of Utimaco Safeguard stores hard-coded cryptographic keys in executable programs for encrypted configuration files. This allows attackers to...

PasswordSafe 3.0 weak random number generator allows key recovery attack

Title : PasswordSafe 3.0 weak random number generator allows key recovery attack Date : March 23, 2006 Product : PasswordSafe 3.0 Discovered by : ElcomSoft Co.Ltd. Overview ====================================================================== PasswordSafe is a program originally written by...

CVE-2005-1797

The design of Advanced Encryption Standard AES, aka Rijndael, allows remote attackers to recover AES keys via timing attacks on S-box lookups, which are difficult to perform in constant time in AES implementations...

CVE-2005-1797

The CVE describes a timing-side-channel vulnerability in AES (Rijndael) implementations: S-box lookups are difficult to perform in constant time, potentially allowing remote attackers to recover encryption keys. Documents cite the theoretical possibility of key recovery via timing analysis and re...

SSH Secure-RPC Weak Encrypted Authentication Key Recovery (deprecated)

Binary data 1976.prm...

Fedora Core 1 : gnupg-1.2.3-2 (2003-025)

Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys, when those keys are used both to sign and encrypt data. This vulnerability can be used to trivially recover the private key. While the default behavior of GnuPG when generating keys does not lead to the creation ...

RHEL 2.1 / 3 : gnupg (RHSA-2003:395)

Updated gnupg packages are now available for Red Hat Enterprise Linux. These updates disable the ability to generate ElGamal keys used for both signing and encrypting and disable the ability to use ElGamal public keys for encrypting data. GnuPG is a utility for encrypting data and creating digita...

[Full-Disclosure] Unreal ircd 3.2 clocking subsystem vulnerability

Software name: Unreal ircd Vulnerable versions: 3.2 and probably previous versions Problem nature: Information disclosure Summary: Unreal ircd is a popular irc server. One of the features it provides is called 'ip cloaking'. The purpose of this system is to prevent hostile irc users from getting...

security flaw

GnuPG GPG 1.0.2, and other versions up to 1.2.3, creates ElGamal type 20 sign+encrypt keys using the same key component for encryption as for signing, which allows attackers to determine the private key from a signature...

DEBIAN-CVE-2003-0147

OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on 1 the number of extra reductions during Montgomery reduction, and 2 the use of different integer multiplication algorithms...

Certain implementations of SSH1 may reveal internal cryptologic state

Overview An implementation problem in at least one Secure Shell SSH product and a weakness in the PKCS11.5 public key encryption standard allows attackers to recover plaintext of messages encrypted with SSH. Description A weakness in some SSH products using the SSH1 protocol may allow an attacker...

Security Advisory: Multiple SSH vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Security Advisory: Multiple SSH vulnerabilities Revision 1.0 - INTERIM For public release 2001 June 27 08:00 UTC -0800 Summary Three different Cisco product lines are susceptible to multiple vulnerabilities in the Secure Shell SSH protocol. These issues are...

CVE-2001-0259

ssh-keygen in ssh 1.2.27 - 1.2.30 with Secure-RPC can allow local attackers to recover a SUN-DES-1 magic phrase generated by another user, which the attacker can use to decrypt that user's private key file...