2014: A Specious Odyssey

The wonderful and terrifying thing about the security world is that things never stay calm for long. As soon as you think you have a chance to catch your breath, someone breaks something and it’s time to scramble again. In 2014, those small moments of downtime were hard to come by. There was a...

[ MDVSA-2014:252 ] nss

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:252 http://www.mandriva.com/en/support/security/ Package : nss Date : December 15, 2014 Affected: Business Server 1.0 Problem Description: Updated nss packages fix security vulnerabilities: In the QuickDER...

X (Formerly Twitter): POODLE Bug: 199.16.156.44, 199.16.156.108, mx4.twitter.com

Hi! Looks like there is SSLv3 Padding Oracle vuln on: 199.16.156.44, 199.16.156.108, mx4.twitter.com...

Two Cisco Products Vulnerable to POODLE Attack on TLS

Two of Cisco’s products are vulnerable to the POODLE attack via the TLS implementation in those products. The vulnerability affects Cisco’s Adaptive Security Appliance software and its Application Control Engine module. The POODLE attack was disclosed in October by researchers from Google, who...

nss: signature forgery

The definitelengthdecoder function in lib/util/quickder.c in Mozilla Network Security Services NSS does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as...

Mandriva Linux Security Advisory : nss (MDVSA-2014:252)

Updated nss packages fix security vulnerabilities : In the QuickDER decoder in NSS before 3.17.3, ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data CVE-2014-1569. This update adds support for the TLS Fallback Signaling Cipher Suite Value...

Fedora 21 : libuv-0.10.29-1.fc21 / nodejs-0.10.33-1.fc21 (2014-15411) (POODLE)

This release handles the recent POODLE vulnerability by disabling SSLv2/SSLv3 by default for the most predominate uses of TLS in Node.js. It took longer than expected to get this release accomplished in a way that would provide appropriate default security settings, while minimizing the surface...

Fedora 20 : libuv-0.10.29-1.fc20 / nodejs-0.10.33-1.fc20 (2014-15379) (POODLE)

This release handles the recent POODLE vulnerability by disabling SSLv2/SSLv3 by default for the most predominate uses of TLS in Node.js. It took longer than expected to get this release accomplished in a way that would provide appropriate default security settings, while minimizing the surface...

Security Advisory-SSLv3 POODLE Vulnerability in Huawei Products

The SSLv3 protocol supported by some Huawei products has the so-called Padding Oracle On Downgraded Legacy Encryption POODLE vulnerability. The attacker can launch a man-in-the-middle attack to manipulate the TLS negotiation process so that the communication parties use SSLv3, which has informati...

Fedora 19 : libuv-0.10.29-1.fc19 / nodejs-0.10.33-1.fc19 (2014-15390) (POODLE)

This release handles the recent POODLE vulnerability by disabling SSLv2/SSLv3 by default for the most predominate uses of TLS in Node.js. It took longer than expected to get this release accomplished in a way that would provide appropriate default security settings, while minimizing the surface...

SSL-TLS Implementations Cipher Block Chaining Padding Information Disclosure Vulnerability

A vulnerability in certain implementations of the TLSv1 protocol could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to improper block cipher padding implemented in TLSv1 when using Cipher Block Chaining CBC mode. An attacker could exploit the...

POODLE vulnerability comeback, the impact of the TLS secure transmission protocols-vulnerability warning-the black bar safety net

! The Google security team in October found that a high-risk SSL vulnerability POODLE, now it a comeback, this time it is SSL upgrade version-the TLS Protocol. POODLE（Padding Oracle On Downgraded Legacy Encryption）vulnerabilities that had affected the most widely used Encryption Standard-SSL v3. ...

IE Removes SSL 3.0 Fallback Used in POODLE Attacks

Yesterday’s Internet Explorer security bulletin, in addition to patching 14 vulnerabilities, also affords Windows admins the ability to disable SSL 3.0 in IE 11 for Protected Mode sites. Doing so eliminates exposure to POODLE SSL attacks. Microsoft said the change is off by default for now, but...

Researchers Say POODLE Attack Affects Some TLS Implementations

The POODLE attack against SSLv3 that researchers from Google revealed earlier this year also affects some implementations of TLS and vendors now are scrambling to release patches for gear affected by the vulnerability. Soon after the POODLE attack was disclosed in October, researchers began looki...

POODLE SSL Vulnerability Now Attacking TLS Security Protocol

POODLE, a critical SSL flaw discovered in October that was patched and fixed by webmasters around the world after Google alerted software and hardware vendors, has again made its way and this time the vulnerability affects implementations of the newer Transport Layer Security TLS protocol. Yes, t...

Certain TLS Implementations Vulnerable to POODLE Attacks

A new variant of the POODLE attack may affect some TLS implementations on account of an issue similar to one present in SSL 3.0. Successful exploitation may enable actors to derive plaintext from encrypted communications. US-CERT encourages users and administrators to review TA14-290A for...

OpenSSL multiple security vulnerabilities

Poodle attack. Protocol version downgrade to SSL 3.0. Memory leaks in SRTP and session tickets. Insufficient no-ssl3 protection. Data leakage via padding attack...

[oss-security] CVE question: Return of POODLE

Hi All, Before i ask my question: It seems some TLS implementations may be vulnerable to POODLE like attack if they use SSL 3.0 type padding and the padding bytes are not checked by the implementation. https://www.imperialviolet.org/2014/12/08/poodleagain.html...

SuSE 11.3 Security Update : pure-ftpd (SAT Patch Number 10004)

pure-ftpd was updated to fix one security issue and two non-security bugs : - SSLv2 and SSLv3 have been disabled to avoid the attack named POODLE. CVE-2014-3566, bnc902229 - Added the disableascii option. bnc828469 - Fixed wait on TLS handshake. bnc856424 %NASLMINLEVEL 70300 C Tenable Network...

Scientific Linux Security Update : nss, nss-util, and nss-softokn on SL5.x, SL6.x, SL7.x i386/x86_64 (20141202) (POODLE)

This update adds support for the TLS Fallback Signaling Cipher Suite Value TLSFALLBACKSCSV, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol...