4386 matches found
Mozilla Thunderbird < 2.0.0.23 Certificate Authority (CA) Common Null Byte Handling SSL MiTM Weakness
Binary data 801349.prm...
Aruba Advisory ID: AID-020810 TLS Protocol Session Renegotiation Security Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aruba Networks Security Advisory Title: TLS Protocol Session Renegotiation Security Vulnerability Aruba Advisory ID: AID-020810 Revision: 1.0 For Public Release on 02/08/2010 +---------------------------------------------------- SUMMARY This advisory...
Fedora Core 12 FEDORA-2009-12968 (nss-util)
The remote host is missing an update to nss-util announced via advisory FEDORA-2009-12968. OpenVAS Vulnerability Test $Id: fcore200912968.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-12968 nss-util Authors: Thomas Reinke Copyright: Copyright c 20...
Fedora 12 : nss-util-3.12.5-1.fc12.1 (2009-12968)
Update to 3.12.5 This update fixes the following security flaw: CVE-2009-3555 TLS: MITM attacks via session renegotiation Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...
Citrix XenApp Online Plug-in / Receiver Crafted Certificate MitM Spoofing Weakness
The version of Citrix Online Plug-in or ICA Client installed on the remote Windows host is affected by an unspecified man-in-the-middle MitM vulnerability. This issue is related to Microsoft security bulletin MS09-056 and is likely due to a failure to detect null bytes in the common name of a...
TLS / SSLv3 vulnerability explained (New ways to leverage the vulnerability)
Dear List, I updated the whitepaper with a lot of new information, some leveraging the vulnerability in other ways that certainly increase the effectiveness and impact of this vulnerability. A brief warning to those that think they are safe because they don't accept client-side renegotiations...
UBUNTU-CVE-2009-3941
Martin Lambers mpop before 1.0.19, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the 1 subject's Common Name or 2 Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted...
Cisco Security Advisory: Transport Layer Security Renegotiation Vulnerability
No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Transport Layer Security Renegotiation Vulnerability Advisory ID: cisco-sa-20091109-tls http://www.cisco.com/warp/public/707/cisco-sa-20091109-tls.shtml Revision 1.0 For Public Release 2009...
DEBIAN-CVE-2009-3555
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...
SSL MITM Vulnerability
Exploit for unknown platform in category remote exploits ====================== SSL MITM Vulnerability ====================== Title: SSL MITM Vulnerability CVE-ID: OSVDB-ID: Author: Pavel Kankovsky Published: 2009-11-09 Verified: yes view source print? include include include include include...
New TLS/SSL3. 0 middle attack has been published-vulnerability warning-the black bar safety net
Just have the researchers published a method for the TLS/SSL man in the middle attack, the attack 1. exploitable operable relatively strong 2. Currently there is no solution, wait for the manufacturers of the patches. 3. The affected upper-layer protocols including HTTPS,IMAP, SIP, etc. Someone...
wget: incorrect verification of SSL certificate with NUL in name
GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issu...
DEBIAN-CVE-2009-3475
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL...
Fedora Core 10 FEDORA-2009-8794 (neon)
The remote host is missing an update to neon announced via advisory FEDORA-2009-8794. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...
Fedora Core 11 FEDORA-2009-8815 (neon)
The remote host is missing an update to neon announced via advisory FEDORA-2009-8815. OpenVAS Vulnerability Test $Id: fcore20098815.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-8815 neon Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft...
Mozilla Thunderbird < 2.0.0.23 Certificate Authority (CA) Common Name Null Byte Handling SSL MiTM Weakness
The installed version of Thunderbird is earlier than 2.0.0.23. Such versions are potentially affected by the following security issue : - The client can be fooled into trusting a malicious SSL server certificate with a null character in the host name. MFSA 2009-42 C Tenable Network Security, Inc...
curl: incorrect verification of SSL certificate with NUL in name
lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate...
firefox/nss: doesn't handle NULL in Common Name properly
Mozilla Network Security Services NSS before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to...
PT-2009-4834 · Mozilla +1 · Network Security Services +4
Name of the Vulnerable Software and Affected Versions: Mozilla Network Security Services NSS versions prior to 3.12.3 Firefox versions prior to 3.0.13 Thunderbird versions prior to 2.0.0.23 SeaMonkey versions prior to 1.1.18 Description: The issue arises from improper handling of a '0' character ...
Using sslstrip to MiTM attacks(Bypass https)-bug warning-the black bar safety net
Everyone knows, including the network for MiTM attacks can allow an attacker to more efficiently intercepted within the network the user's password and secret information. In BackTrack use EtterCap or ArpSpoof tool. But Ettercap supports the Protocol, only HTTP, FTP, Telnet, SMTP, etc. in clear...