ALPINE-CVE-2016-6515

The authpassword function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service crypt CPU consumption via a long string...

CVE-2016-6515

The authpassword function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service crypt CPU consumption via a long string...

CVE-2016-6515

The authpassword function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service crypt CPU consumption via a long string...

[slackware-security] openssh

New openssh packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/openssh-7.3p1-i586-1slack14.2.txz: Upgraded. This is primarily a bugfix release, and also addresses...

openssh: information leakage

Mitigate timing differences in password authentication that could be used to discern valid from invalid account names when long passwords were sent and particular password hashing algorithms are in use on the server. Reported by EddieEzra.Harari at verint.com...

openssh -- sshd -- remote valid user discovery and PAM /bin/login attack

The OpenSSH project reports: sshd8: Mitigate timing differences in password authentication that could be used to discern valid from invalid account names when long passwords were sent and particular password hashing algorithms are in use on the server. CVE-2016-6210, reported by EddieEzra.Harari ...

Debian Security Advisory DSA 3613-1 (libvirt - security update)

Vivian Zhang and Christoph Anton Mitterer discovered that setting an empty VNC password does not work as documented in Libvirt, a virtualisation abstraction library. When the password on a VNC server is set to the empty string, authentication on the VNC server will be disabled, allowing any user ...

The vulnerability of the Cisco Identity Services Engine, a platform for managing network policies, allows a perpetrator to trigger a service failure.

The vulnerability of the Active Directory Integration component of the Cisco Identity Services Engine management platform relates to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to cause service interruptions through a specially crafted...

CVE-2016-1402

The Active Directory AD integration component in Cisco Identity Service Engine ISE before 1.2.0.899 patch 7, when AD group-membership authorization is enabled, allows remote attackers to cause a denial of service authentication outage via a crafted Password Authentication Protocol PAP...

Cisco Identity Services Engine Active Directory integration component denial of service vulnerability

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A security vulnerability...

The vulnerability of the microprogramming software of Schneider Electric’s Modicon M340 allows a intruder to execute any desired code.

The vulnerability of the microprogrammed logic controller Schneider Electric Modicon M340 arises from buffer overflow in the stack. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code through a long password in HTTP Basic Authentication...

GRUB2 the zero-day vulnerability affecting Linux users, Ubuntu, RHEL patch now available-vulnerability warning-the black bar safety net

Canonical's latest Ubuntu Security Notice displayed in GRUB2GNU GRand Unified Bootloader in the presence of a zero-day security vulnerability, it will affect to GRUB version 2. 0 2 Beta of the GNU/Linux distribution. The security vulnerability is Ismael Ripoll and Hector Marco found that when the...

Redis unauthorized access can lead to a Remote Access Server Permissions-bug warning-the black bar safety net

Recently, the Rubik's Cube security team monitoring for Redis unauthorized access of a new type of attack, under certain conditions, may be the remote cause the server to fall, the Rubik's Cube Safety team in a timely manner to the attacks carried out research and threat assessment, and by the cu...

OpenSSH -- PermitRootLogin may allow password connections with 'without-password'

OpenSSH 7.0 contained a logic error in PermitRootLogin= prohibit-password/without-password that could, depending on compile-time configuration, permit password authentication to root while preventing other forms of authentication. This problem was reported by Mantas Mikulenas...

[SECURITY] [DSA 3192-1] checkpw security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3192-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso March 17, 2015 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3192-1] checkpw security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3192-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso March 17, 2015 http://www.debian.org/security/faq -...

checkpw vulnerable to denial-of-service (DoS)

Overview checkpw is a password authentication program. checkpw contains a denial-of-service DoS vulnerability due to a flaw in processing account names CWE-400. Hiroya Ito of GMO Pepabo, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

Juniper Junos JPPP Daemon Remote Denial of Service Vulnerability

Juniper Networks JUNOS is an operating system that runs on Juniper Networks' line of border routers and more. A vulnerability in the Juniper Networks JUNOS PPP backend program when using PPP authentication specially crafted for PAP authentication requests allows an attacker to exploit the...

[SECURITY] Fedora 19 Update: curl-7.29.0-27.fc19

curl is a command line tool for transferring data with URL syntax, supporti ng FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, I MAP, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

MDaemon SMTP Server 5.0.5 Null Password Authentication Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8382/info A vulnerability has been reported to affect the MDaemon SMTP authentication handler. It has been reported that any valid username or account can be used in conjunction with a null password, to access the MDaemon...