Erlang/OTP SSH library uses a weak random number generator

Overview The Erlang/OTP SSH library's random number generator is not cryptographically strong because it relies on predictable seed material. Description Geoff Cant's report states:The Erlang/OTP ssh library implements a number of cryptographic operations that depend on cryptographically strong...

Memory corruption in Postfix SMTP server Cyrus SASL support (CVE-2011-1720)

On-line version will be at http://www.postfix.org/CVE-2011-1720.html Summary ======= The Postfix SMTP server has a memory corruption error when the Cyrus SASL library is used with authentication mechanisms other than PLAIN and LOGIN the ANONYMOUS mechanism is unaffected but should not be enabled...

India to Increase Phone Banking Security Starting Next Month !

Starting with January 1st, 2011, Indian banks will require an additional security code in order to authorise phone banking transactions, according to regulatory guidelines issued by the Reserve Bank of India RBI. Known as one-time passwords OTP, these codes are part of what is known as two-factor...

SLES10: Security update for cyrus-sasl

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: cyrus-sasl cyrus-sasl-crammd5 cyrus-sasl-devel cyrus-sasl-digestmd5 cyrus-sasl-gssapi cyrus-sasl-otp cyrus-sasl-plain cyrus-sasl-sqlauxprop More details may...

SLES11: Security update for cyrus-sasl

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: cyrus-sasl cyrus-sasl-crammd5 cyrus-sasl-digestmd5 cyrus-sasl-gssapi cyrus-sasl-otp cyrus-sasl-plain More details may also be found by searching for the SuSE...

SLES9: Security update for cyrus-sasl

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: cyrus-sasl cyrus-sasl-crammd5 cyrus-sasl-devel cyrus-sasl-digestmd5 cyrus-sasl-gssapi cyrus-sasl-otp cyrus-sasl-plain For more information, please visit the...

CVE-2009-1135

Microsoft Internet Security and Acceleration ISA Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication method, which allows remote attackers to gain the privileges of an arbitrary account, and access published web pages, via vectors involving attempted access to...

Design/Logic Flaw

Microsoft Internet Security and Acceleration ISA Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication method, which allows remote attackers to gain the privileges of an arbitrary account, and access published web pages, via vectors involving attempted access to...

CVE-2009-1135

CVE-2009-1135 affects Microsoft ISA Server 2006 (Gold/SP1) when Radius OTP is enabled. The vulnerability stems from ISA Server using HTTP-Basic authentication for Radius OTP-enabled requests, which can let a remote attacker impersonate a valid user and access published web resources behind the IS...

CVE-2009-1135

Microsoft Internet Security and Acceleration ISA Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication method, which allows remote attackers to gain the privileges of an arbitrary account, and access published web pages, via vectors involving attempted access to...

Microsoft ISA Server Privilege Escalation Vulnerability (970953)

This host is missing a critical security update according to Microsoft Bulletin MS09-031. OpenVAS Vulnerability Test $Id: secpodms09-031.nasl 5363 2017-02-20 13:07:22Z cfi $ Microsoft ISA Server Privilege Escalation Vulnerability 970953 Authors: Nikita MR Copyright Copyright c 2009 SecPod,...

Microsoft ISA Server Radius OTP验证绕过漏洞

Bugraq ID: 35631 CVE ID：CVE-2009-1135 Microsoft ISA Server是一款企业防火墙和高性能的Web缓存解决方案。 配置了Radius OTP的ISA Server 2006验证机制存在问题，远程攻击者可以利用漏洞绕过验证访问受限WEB资源。 当使用HTTP-Basic方法验证请求时存在未明错误，可导致访问WEB发布的资源。 成功利用漏洞需要合法管理用户名和ISA服务器配置了Radius一次性密码OTP验证和KCDKerberos Constrained Delegation的验证委托。 Microsoft ISA Server 2006...

Microsoft ISA Server Privilege Escalation Vulnerability (970953)

This host is missing a critical security update according to Microsoft Bulletin MS09-031. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft ISA Server 2006 Radius OTP Bypass (MS09-031; CVE-2009-1135)

ISA Server, originating as Microsoft Proxy Server, is a Firewall & Security product that provides Application-Layer Firewalling, acts as a VPN endpoint, and provides Internet Access for client systems in a Business Networking environment. An elevation of privilege vulnerability exists in Microsof...

MS09-031: Vulnerability in Microsoft ISA Server 2006 Could Cause Elevation of Privilege (970953)

The version of Microsoft Internet Security and Acceleration ISA Server 2006 installed on the remote host may allow an unauthenticated attacker with knowledge of administrator account usernames to gain access to published resources in the context of such a user without having to authenticate with...

OpenOffice Writer DoS

Crash on .otp files parocessing...

Design/Logic Flaw

OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...

CVE-2007-2768

OpenSSH, when using OPIE One-Time Passwords in Everything for PAM, allows remote attackers to determine the existence of certain user accounts, which displays a different response if the user account exists and is configured to use one-time passwords OTP, a similar issue to CVE-2007-2243...

CVE-2007-2768

OpenSSH, when using OPIE (One-Time Passwords in Everything) for PAM, can leak whether a target user exists by returning different responses if the account is configured for OTP. This is described for CVE-2007-2768 (OpenSSH 4.6 and earlier) and is related to CVE-2007-2243 in the IBM bulletin, whic...

Digipass Go3 Token Dumper (at least for 2006)

The initial reverse engineering of Vasco’s Digipass Go3 algorithm follows in C++. I think this implementation is a "rough" approximation, if we take some limitations about 2006 and the calculations made into account. Or I'm just joking… : This generator was able to predict an "otp" collision,...