413 matches found
UBUNTU-CVE-2017-15116
The rngapireset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service NULL pointer dereference...
CVE-2017-15116
The rngapireset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service NULL pointer dereference...
Attack on Old ANSI Random Number Generator
Almost 20 years ago, I wrote a paper that pointed to a potential flaw in the ANSI X9.17 RNG standard. Now, new research has found that the flaw exists in some implementations of the RNG standard. Here's the research paper, the website -- complete with cute logo -- for the attack, and Matthew...
DUHK Attack Lets Hackers Recover Encryption Key Used in VPNs & Web Sessions
DUHK — Don't Use Hard-coded Keys — is a new 'non-trivial' cryptographic implementation vulnerability that could allow attackers to recover encryption keys that secure VPN connections and web browsing sessions. DUHK is the third crypto-related vulnerability reported this month after KRACK Wi-Fi...
Hacking Slot Machines by Reverse-Engineering the Random Number Generators
Interesting story: The venture is built on Alex's talent for reverse engineering the algorithms -- known as pseudorandom number generators, or PRNGs -- that govern how slot machine games behave. Armed with this knowledge, he can predict when certain games are likeliest to spit out moneyinsight...
CVE-2017-11519
passwdrecovery.lua on the TP-Link Archer C9UNV2160517 allows an attacker to reset the admin password by leveraging a predictable random number generator seed. This is fixed in C9UNV2170511...
Portable Virtual Private Network: goSecure
Portable Virtual Private Network goSecure is an easy to use and portable Virtual Private Network VPN solution. The system consists of a single server and one or many clients. strongSwan is used to establish a Suite B IPsec tunnel with pre-shared keys between the server and clients. The core crypt...
SUSE SLES11 Security Update : MozillaFirefox, mozilla-nss, mozilla-nspr (SUSE-SU-2017:1175-1)
Mozilla Firefox was updated to the Firefox ESR release 45.9. Mozilla NSS was updated to support TLS 1.3 close to release draft and various new ciphers, PRFs, Diffie Hellman key agreement and support for more hashes. Security issues fixed in Firefox bsc1035082 - MFSA 2017-11/CVE-2017-5469: Potenti...
openSUSE Security Update : mozilla-nss (openSUSE-2017-504)
Mozilla-nss was updated to 3.28.4 to fix the following issues : Security issues : - CVE-2016-9574: Allow use of session tickets when there is no ticket wrapping key boo1015499, bmo1320695 Non security issues : - A rare crash when initializing an SSL socket fails has been fixed bmo1342358 - Rare...
Spoofing
Huawei home gateways WS318 with software V100R001C01B022 and earlier versions are affected by the PIN offline brute force cracking vulnerability of the WPS protocol because the random number generator RNG used in the supplier's solution is not random enough. As a result, brute force cracking the...
CVE-2014-9690
Huawei home gateways WS318 with software V100R001C01B022 and earlier versions are affected by the PIN offline brute force cracking vulnerability of the WPS protocol because the random number generator RNG used in the supplier's solution is not random enough. As a result, brute force cracking the...
CVE-2014-9690
CVE-2014-9690 affects Huawei WS318 home gateways (software versions including V100R001C01B022 and earlier). The underlying issue is an insufficiently random RNG used by the vendor’s WPS implementation, enabling offline PIN brute-forcing. Exploitation allows an attacker to crack the WPS PIN and ga...
CVE-2016-8492
The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption...
CVE-2016-8492
The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption...
CVE-2016-8492
The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption...
CVE-2016-8492
CVE-2016-8492 describes an information-disclosure vulnerability in Fortinet FortiGate/FortiOS where the ANSI X9.31 RNG is used in long‑lived security channels (IPSec/TLS), potentially allowing unauthorized read access to data. Connected sources confirm this relates to DUHK-style weaknesses in RNG...
CVE-2016-8492
The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption...
GLSA-201612-01 : GnuPG: RNG output is predictable
The remote host is affected by the vulnerability described in GLSA-201612-01 GnuPG: RNG output is predictable A long standing bug since 1998 in Libgcrypt see GLSA 201610-04 below and GnuPG allows an attacker to predict the output from the standard RNG. Please review the Entropy Loss and Output...
GnuPG: RNG output is predictable
Background The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite of cryptographic software. Description A long standing bug since 1998 in Libgcrypt see “GLSA 201610-04” below and GnuPG allows an attacker to predict the output from the standard RNG. Please review the “Entropy Loss...
DUHK Attack against Fortinet Products
When devices use ANSI X9.31 RNG which was removed from the list of FIPS-approved random number generation algorithms in January 2016 to generate cryptographic key under a static seed and under use with long-lived security tunnels like SSL/TLS/SSH/IPSec, such devices are vulnerable to the DUHK...