Fedora 29 : libnbd (2019-8107ac4399)

New upstream version 1.0.2. Contains fix for NBD Protocol Downgrade Attack CVE-2019-14842. ---- Add upstream patch to fix nbdsh for nbdkit tests. ---- New stable version 1.0.1. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Fedora 30 : libnbd (2019-749d828945)

New upstream version 1.0.2. Contains fix for NBD Protocol Downgrade Attack CVE-2019-14842. ---- Add upstream patch to fix nbdsh for nbdkit tests. ---- New stable version 1.0.1. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Man-In-The-Middle (MitM)

Samba is vulnerable to Man-In-The-Middle MitM attacks. Mishandling DCERPC connections, allows man-in-the-middle attackers to perform protocol-downgrade attacks as well as to impersonate users by modifying the client-server data stream...

Man-In-The-Middle (MitM)

samba is vulnerable to man-in-the-middle vulnerability. This allows a remote attacker to modify the data sent between a Samba server and a client that causes a LDAP protocol-downgrade...

Denial Of Service (DoS)

samba is vulnerable to denial of service DoS attacks. The vulnerability exists as Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of servi...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect Rational ClearCase (CVE-2014-5139, CVE-2014-3509, CVE-2014-3511)

Summary There are multiple vulnerabilities in OpenSSL that is used by affect Rational ClearCase. These issues were disclosed on August 6, 2014 by the OpenSSL Project. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this li...

Security Bulletin: IBM Tealeaf Customer Experience is affected by a vulnerability in OpenSSL (CVE-2014-3511, CVE-2014-3512)

Summary IBM Tealeaf Customer Experience is affected by a vulnerability in OpenSSL that could cause a protocol downgrade attack or a buffer overrun attack. Vulnerability Details CVEID: CVE-2014-3511 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security restrictions, caused by the...

Design/Logic Flaw

Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-in-the-middle attack, to interact with Mahara on the HTTP protocol rather than HTTPS even when an SSL certificate is present...

Information Disclosure

github.com/docker/docker is vulnerable to information disclosure. Attackers can obtain sensitive information, modify the host and perform protocol downgrade attacks using a docker image. These attacks are possible because github.com/docker/docker uses weak permissions for files in the /proc folde...

The Bank of Tokyo-Mitsubishi UFJ for Android vulnerable to SSL/TLS downgrade attack

Overview The Bank of Tokyo-Mitsubishi UFJ for Android may be exploited by SSL/TLS downgrade attack. The Bank of Tokyo-Mitsubishi UFJ for Android provided by The Bank of Tokyo-Mitsubishi UFJ, Ltd. tries to communicate with a server via TLS v1.2. However, when a response from the server indicates S...

F5 Networks BIG-IP : Samba vulnerabilities (K53313971)

CVE-2016-2110 The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryptio...

Google Adds New Layer of Security to Domain: Adds HSTS

Google is adding HTTP Strict Transport Security or HSTS to the Google.com domain, an extra layer of protection that prevents visitors from using a less secure HTTP connection. By using HSTS, visitors following HTTP links to Google.com will be automatically redirected to the more secure HTTPS...

F5 Networks BIG-IP : Samba vulnerabilities (K37603172) (Badlock)

CVE-2015-5370 Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to perform protocol-downgrade attacks, cause a denial of service application crash or CPU consumption, or possibly execute arbitra...

CVE-2016-2112

The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream...

CVE-2016-2112

The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream...

AZL-44409 CVE-2016-2110 affecting package samba 4.18.3-2

The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as...

CVE-2016-2110

The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as...

CVE-2016-2110

The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as...

Authentication flaw

The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to perform protocol-downgrade attacks by modifying the client-server data stream to remove application-layer flags or encryption settings, as...

Code injection

The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrapping" setting, which allows man-in-the-middle attackers to perform LDAP protocol-downgrade attacks by modifying the client-server data stream...