OpenSSH 6.0p1 Backdoor Patch 1.2 Vulnerability 0day

This patch is for openssh-6.0p1 source which combines a known openssh backdoor and Sebastian Krahmer's openssh.reverse capabilities. Telnet to target openssh server and issue udcgamaimagic string for getting reverse openssh connection. $id: udc-hackssh-v3bajaulaut-v1, 2012/10/28 05:00:50 slash...

Fortigate UTM appliances share the same default CA certificate

Overview Fortigate UTM appliances that support SSL/TLS deep packet inspection share the same self-signed Fortigate CA certificate and associated private key across all devices. The private key, which has been compromised, allows attackers to create and sign fake certificates. Description Fortigat...

RuggedCom RuggedOS Known Hardcoded SSL RSA Private Key

Binary data scadaruggedosknownsslprivatekey.nbin...

CVE-2012-3037

The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web server by using this key to create a forged certificate...

CVE-2012-3037

The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web server by using this key to create a forged certificate...

CVE-2012-3037

The CVE-2012-3037 vul nerability affects Siemens SIMATIC S7-1200 PLCs (2.x) where the private key of the SIMATIC CONTROLLER Certification Authority certificate is not protected in HTTPS storage. This allows remote attackers to forge a certificate and spoof the S7-1200 web server. Affected product...

PT-2012-4454

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1200 version 2.x Description The issue concerns the Siemens SIMATIC S7-1200 PLC, where the private key of the SIMATIC CONTROLLER Certification Authority certificate is not properly protected. This allows remote attackers to...

Siemens SIMATIC S7-1200 SSL Private Key Reuse Spoofing Vulnerability (SSA-240718)

Siemens SIMATIC S7-1200 devices are prone to a security vulnerability that may allow attackers to spoof SSL certificates. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2012-3582

Symantec PGP Universal Server 3.2.x before 3.2.1 MP2 does not properly manage sessions that include key search requests, which might allow remote attackers to read a private key in opportunistic circumstances by making a request near the end of a user's session...

Design/Logic Flaw

Symantec PGP Universal Server 3.2.x before 3.2.1 MP2 does not properly manage sessions that include key search requests, which might allow remote attackers to read a private key in opportunistic circumstances by making a request near the end of a user's session...

PT-2012-4828

Name of the Vulnerable Software and Affected Versions Symantec PGP Universal Server versions 3.2.x through 3.2.1 MP1 Description The issue arises from improper session management, specifically with key search requests. This could potentially allow remote attackers to read a private key under...

CVE-2012-3582: Undefined Security Weakness

Symantec PGP Universal Server 3.2.x before 3.2.1 MP2 does not properly manage sessions that include key search requests, which might allow remote attackers to read a private key in opportunistic circumstances by making a request near the end of a user's session...

PGP Universal Server Unauthorized Key Exposure

SUMMARY Symantecs PGP Universal Server, under specific circumstances, may inadvertently expose a PGP clients private key. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- PGP Universal Server | 3.2.x | PGP Universal Server 3.2.1 MP2 ISSUES CVSS2 Base Score | Impact | Exploitability |...

CVE-2012-3864: Exposure of Sensitive Information to an Unauthorized Actor

Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request...

Design/Logic Flaw

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not...

Deep Packet Inspection Firm Cyberoam Issues Fix Following Private Key Leak

Network security firm Cyberoam issued an over the air update for all of its Deep Packet Inspection DPI devices today after a decrypted version of the company’s universal private key was leaked online over the weekend. The New Jersey-based company pushed the hotfix after an anonymous commenter...

CVE-2012-3372

The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the CyberoamSSLCA...

Default configuration

DISPUTED The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the CyberoamSSLC...

CVE-2012-3372

The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the CyberoamSSLCA...

CVE-2012-3372

The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the CyberoamSSLCA...