Medium: gnupg

Issue Overview: GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload. Affected Packages: gnupg Issue Correction: Run yum update gnu...

Medium: libgcrypt

Issue Overview: GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload. Affected Packages: libgcrypt Issue Correction: Run yum update...

CVE-2013-4242

GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload...

DEBIAN-CVE-2013-4208

The rsaverify function in PuTTY before 0.63 1 does not clear sensitive process memory after use and 2 does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys...

CVE-2013-4242

GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload...

Microsoft discontinues MD5 crypto for digital certificates to improve RDP Authentication

This week Microsoft has released several advisories to help their users update from weak crypto. Microsoft is beginning the process of discontinuing support for digital certificates that use the MD5 hashing algorithm and to improve the network-level authentication for the Remote Desktop Protocol...

DEBIAN-CVE-2013-2054

Buffer overflow in the atodn function in strongSwan 2.0.0 through 4.3.4, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service pluto IKE daemon crash and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this...

Important: Red Hat Security Advisory: openswan security update

Updated openswan packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

Openswan: remote buffer overflow in atodn()

Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service pluto IKE daemon crash and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be...

GitHub Search Down After Some Credentials and Crypto Keys Exposed

GitHub’s search capability remains dark Friday after it was discovered that the code-sharing site’s search feature could be used to dredge up passwords, private crypto keys, and other credentials developers use in their projects. GitHub is a popular collaboration site for open source software...

MS KB2661254: Update For Minimum Certificate Key Length

The remote host is missing Microsoft KB2661254. This update restricts the use of RSA keys less than 1024 bits in length. Keys of shorter lengths are more susceptible to brute-force attacks, which could allow a man-in-the-middle attacker to intercept and/or modify data encrypted over SSL/TLS. C...

CVE-2012-2187

IBM Remote Supervisor Adapter II firmware for System x3650, x3850 M2, and x3950 M2 1.13 and earlier generates weak RSA keys, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors...

CVE-2012-2187

CVE-2012-2187 affects IBM Remote Supervisor Adapter II firmware for System x3650, x3850 M2, and x3950 M2 (versions 1.13 and earlier). The root cause is weak RSA key generation in the firmware, which may allow an attacker to remotely compromise the corresponding private key when using secure proto...

openssl: asn1_d2i_read_bio integer errors leading to buffer overflow

The asn1d2ireadbio function in crypto/asn1/ad2ifp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service memory corruption or possibly have...

Microsoft Ships Two Bulletins in September Security Update

The Microsoft security team shipped just two bulletins – resolving as many holes – in the September, 2012 edition of Patch Tuesday. The patches will supply fixes for two ‘important’ rated bugs, one in Microsoft Developer Tools and the other in Micrososft Server Software. If unpatched, both could...

[SECURITY] Fedora 17 Update: trousers-0.3.9-1.fc17

TrouSerS is an implementation of the Trusted Computing Group's Software Sta ck TSS specification. You can use TrouSerS to write applications that make u se of your TPM hardware. TPM hardware can create, store and use RSA keys securely without ever being exposed in memory, verify a platform's soft...

Microsoft Windows Minimum Certificate Key Length Spoofing Vulnerability (2661254)

The host is installed with Microsoft Windows operating system and is prone to digital certificate key length spoofing vulnerability. OpenVAS Vulnerability Test $Id: gbmscertificatekeylengthspoofingvuln.nasl 5346 2017-02-19 08:43:11Z cfi $ Microsoft Windows Minimum Certificate Key Length Spoofing...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64

CVE-2009-0590 openssl: ASN1 printing crash CVE-2009-1377 OpenSSL: DTLS epoch record buffer memory DoS CVE-2009-1378 OpenSSL: DTLS fragment handling memory DoS CVE-2009-1379 OpenSSL: DTLS pointer use-after-free flaw DoS CVE-2009-1386 openssl: DTLS NULL deref crash on early ChangeCipherSpec request...

SSL Certificate Chain Contains Weak RSA Keys

At least one of the X.509 certificates sent by the remote host has a key that is shorter than 1024 bits. Such keys are considered weak due to advances in available computing power decreasing the time required to factor cryptographic keys. Some SSL implementations, notably Microsoft's, may conside...

Microsoft Releases Automatic Updater for Certificate Revocation Lists, Plans to Invalidate Short RSA Keys

As part of its response to the Flame malware and its usage of a forged Microsoft certificate to sign malicious files, Microsoft has changed the way that Windows handles certificates, releasing an automatic updater function that will recognize and flag untrusted certificates. The new functionality...