Updated polarssl package fixes security vulnerabilities

The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in PolarSSL before 1.2.6, does not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and...

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : pyopenssl vulnerability (USN-1965-1)

It was discovered that pyOpenSSL did not properly handle certificates with NULL characters in the Subject Alternative Name field. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. Note that Tenable Network Securit...

Ubuntu: Security Advisory (USN-1965-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Authentication flaw

The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks...

CVE-2013-1431

CVE-2013-1431 affects the Wocky submodule in telepathy-gabble (Gabble) prior to 0.16.6 and 0.17.x prior to 0.17.4 when connecting to legacy Jabber servers. The flaw allows bypassing WockyConnector:tls-required and TLS verification, enabling MITM attacks. Fixes are provided in patches and updated ...

CVE-2012-4072

The KVM subsystem in Cisco Unified Computing System UCS relies on a hardcoded X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers, and read keyboard and mouse events, by leveraging knowledge of this certificate's private key, aka Bug ID CSCte90327...

CVE-2012-4072

The CVE-2012-4072 issue affects Cisco Unified Computing System (UCS) KVM. The root cause is a hardcoded X.509 certificate in the KVM subsystem, enabling a remote attacker to perform MITM on KVM connections, spoof SSL servers, and read keyboard/mouse events by using knowledge of the private key. E...

BEAST Cryptographic Attack Mitigations Overturned

The BEAST cryptographic attack, once thought to be largely mitigated, has two things conspiring against it to make breaches potentially possible again. Not only has a server-side mitigation essentially been rendered moot by recent research into the RC4 cryptographic protocol, but Apple has yet to...

Code injection

repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

Ubuntu Update for python-httplib2 USN-1948-1

Check for the Version of python-httplib2 OpenVAS Vulnerability Test $Id: gbubuntuUSN19481.nasl 8494 2018-01-23 06:57:55Z teissa $ Ubuntu Update for python-httplib2 USN-1948-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program...

Ubuntu: Security Advisory (USN-1948-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-1948-1: httplib2 vulnerability

It was discovered that httplib2 only validated SSL certificates on the first request to a connection, and didn't report validation failures on subsequent requests. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could possibly be exploited in certain scenarios ...

Cisco IP Communicator Certificate Trust List Manipulation

The version of Cisco IP Communicator is 8.61. Such versions are potentially affected by a data modification vulnerability. By performing a Man-in-the-Middle attack, a remote, unauthenticated attacker could replace the original Certificate Trust List with a modified one. C Tenable Network Security...

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : php5 vulnerability (USN-1937-1)

It was discovered that PHP did not properly handle certificates with NULL characters in the Subject Alternative Name field. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. Note that Tenable Network Security has...

USN-1937-1: PHP vulnerability

It was discovered that PHP did not properly handle certificates with NULL characters in the Subject Alternative Name field. An attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications...

MGASA-2013-0264 Updated php packages fix CVE-2013-4248 and prevent the two gd packages being installed at once

Updated php packages fix security vulnerability: The opensslx509parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows...

[Wi-fEye] Automated Network Testing Tool

Wi-fEye is an automated wirelress penetration testing tool written in python , its designed to simplify common attacks that can be performed on wifi networks so that they can be executed quickly and easily. Wifi has three main menus : 1. Cracking menu: contains attacks that could allow us to crac...

PHP SSL Module "subjectAltNames"空字节处理安全绕过漏洞

Bugtraq ID:61776 PHP是一种HTML内嵌式的脚本语言 PHP SSL模块不正确处理服务器SSL证书中"subjectAltNames"通用名中的空字节，允许攻击者利用漏洞进行中间人攻击，获取敏感信息 0 PHP 5.3.27 PHP 5.4.17 PHP 5.5.1 厂商解决方案 用户可参考如下厂商提供的安全补丁以修复该漏洞： http://git.php.net/?p=php-src.git;a=commit;h=dcea4ec698dcae39b7bba6f6aa08933cbfee6755...

JVN#68156832: Yafuoku! contains an issue where it fails to verify SSL server certificates

Yafuoku! provided by Yahoo Japan Corporation contains an issue where it fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to the informati...

CVE-2013-4238

The ssl.matchhostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate...