CVE-2009-0093

MS09-008 fixes multiple DNS/WINS vulnerabilities in Windows servers that could allow remote attackers to spoof WPAD/ISATAP and hijack network traffic. The WPAD vulnerability (CVE-2009-0093) arises when dynamic updates are enabled and WPAD/ISATAP registrations are not restricted in DNS, enabling a...

CVE-2009-0653

OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack, a related issue to CVE-2002-0970...

Sql injection

OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack, a related issue to CVE-2002-0970...

CVE-2009-0653

OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack, a related issue to CVE-2002-0970...

CVE-2009-0653

OpenSSL CA Basic Constraints Validation Vulnerability (CVE-2009-0653). What is affected: OpenSSL, probably the 0.9.6 series. The issue concerns failure to verify the Basic Constraints for an intermediate CA‑signed certificate. Root cause: Basic constraints are not validated for some CA certificat...

Ubuntu: Security Advisory (USN-704-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-704-1: OpenSSL vulnerability

It was discovered that OpenSSL did not properly perform signature verification on DSA and ECDSA keys. If user or automated system connected to a malicious server or a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information...

USN-675-1: Pidgin vulnerabilities

It was discovered that Pidgin did not properly handle certain malformed messages in the MSN protocol handler. A remote attacker could send a specially crafted message and possibly execute arbitrary code with user privileges. CVE-2008-2927 It was discovered that Pidgin did not properly handle file...

CVE-2008-5124

JSCAPE Secure FTP Applet 4.8.0 and earlier does not ask the user to verify a new or mismatched SSH host key, which makes it easier for remote attackers to perform man-in-the-middle attacks...

CVE-2008-3270

yum-rhn-plugin in Red Hat Enterprise Linux RHEL 5 does not verify the SSL certificate for a file download from a Red Hat Network RHN server, which makes it easier for remote man-in-the-middle attackers to cause a denial of service loss of updates or force the download and installation of official...

CVE-2008-3270

CVE-2008-3270 affects yum-rhn-plugin on Red Hat Enterprise Linux 5. The root cause is that the plugin fails to verify the SSL certificate when contacting the Red Hat Network, enabling a man-in-the-middle to potentially cause a denial of service (loss of updates) or force installation of unrequest...

Design/Logic Flaw

Apple iTunes before 10.5.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning...

CVE-2008-3440

CVE-2008-3440 affects Sun Java 1.6.0_03 and earlier (potentially later versions) where updater authenticity is not properly verified, enabling a man-in-the-middle attacker to run arbitrary code via a Trojan horse update (as demonstrated by evilgrade and DNS cache poisoning). The connected sources...

KLA10244 ACE vulnerability in LinkedIn Browser Toolbar

Improper update verification was found in the LinkedIn Browser Toolbar. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a man-in-the-middle attack. Original advisories - Related products LinkedIn-Internet-Explorer-Toolb...

JVN#88676089 Safari installed in iPod touch and iPhone vulnerable in handling server certificates

Safari is a web browser provided by Apple. Safari installed in iPod touch and iPhone accepts a self-signed or invalid server cerficate without the user's explicit concent when connecting via SSL/TLS. According to Apple, "When Safari accesses a website that uses a self-signed or invalid certificat...

CVE-2008-1676

The CVE-2008-1676 issue concerns Red Hat Certificate System’s PKI Common Framework (rhpki-common) used by RHCS and Netscape Certificate Management System. The root cause is that certificate signing request (CSR) processing did not honor Certificate Authority profile constraints on Extensions, ena...

Important: Red Hat Security Advisory: rhpki-common security update

Updated rhpki-common packages that fix a security issue are now available for Red Hat Certificate System 7.2. This update has been rated as having important security impact by the Red Hat Security Response Team. Red Hat Certificate System RHCS is an enterprise software system designed to manage...

Important: Red Hat Security Advisory: rhpki-common security update

An updated rhpki-common package that fixes a security issue is now available for Red Hat Certificate System 7.3. This update has been rated as having important security impact by the Red Hat Security Response Team. Red Hat Certificate System RHCS is an enterprise software system designed to manag...

n.runs-SA-2008.001 - Jscape Secure FTP Applet

n.runs AG http://www.nruns.com/ securityatnruns.com n.runs-SA-2008.001 23-June-2008 Vendor: Jscape, http://www.jscape.com/ Affected Products: Jscape Secure FTP Applet http://www.jscape.com/sftpapplet/index.html Vulnerability: SSH Host key is not verified allowing for Man in the Middle attacks Ris...

Debian and Ubuntu OpenSSL packages contain a predictable random number generator

Overview A vulnerability in the OpenSSL package included with the Debian GNU/Linux operating system and its derivatives may cause weak cryptographic keys to be generated. Description A weakness exists in the random number generator used by the OpenSSL package included with the Debian GNU/Linux...