[SECURITY] [DLA 1207-1] erlang security update

Package : erlang Version : 15.b.1-dfsg-4+deb7u2 CVE ID : CVE-2017-1000385 An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA, which when exploited, may result in plaintext...

OpenSSL 1.1.0 < 1.1.0h Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.1.0h. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.0h advisory. - Constructed ASN.1 types with a recursive definition such as can be found in PKCS7 could eventually exceed the stack given maliciou...

Ericsson Erlang otp TLS server information disclosure vulnerability

Ericsson Erlang otp TLS server is a TLS Secure Transport Protocol server written in the Erlang language, developed and maintained by Ericsson, Sweden. A security vulnerability exists in the Ericsson Erlang otp TLS server, which originates from the program responding to different alerts for...

How to try to predict the output of Micali-Schnorr Generator (MS-DRBG) knowing the factorization. Part II

See also Part I and Part III of this series tl;dr In the previous article of the same series we tried to predict the output of Micali-Schnorr Generator MS-DRBG knowing the factorization. In this blog post we continue the effort started in part I showing different strategies. If you want to skip a...

The vulnerability of cnPilot R200/201 routers, related to RSA key management errors, allows attackers to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of cnPilot R200/201 routers is related to RSA key management errors. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of data...

openSUSE Security Update : erlang (openSUSE-2017-1358) (ROBOT)

This update for erlang fixes security issues and bugs. The following vulnerabilities were addressed : - CVE-2017-1000385: Harden against the Bleichenbacher attacher against RSA - CVE-2016-10253: Heap overflow through regular expressions bsc1030062 In addition Erlang was updated to version 18.3.4....

Call For Customer Presentations at RSA Conference 2018!

Tell your security story to your peers at RSA Conference 2018 San Francisco! Qualys is looking for customers excited to share their security and DevSecOps successes, best practices and case studies leveraging the use of the Qualys Cloud Platform. Take the stage in the Qualys booth to share your...

CVE-2017-17427

Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack "Bleichenbacher attack". This allows an attacker to decrypt observed traffic that has been encrypted with the RSA cipher and to perform other private key operations...

Code injection

Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a...

CVE-2017-17427

Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack "Bleichenbacher attack". This allows an attacker to decrypt observed traffic that has been encrypted with the RSA cipher and to perform other private key operations...

Code injection

Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack "Bleichenbacher attack". This allows an attacker to decrypt observed traffic that has been encrypted with the RSA cipher and to perform other private key operations...

CVE-2017-17382

Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a...

CVE-2017-17427

Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack "Bleichenbacher attack". This allows an attacker to decrypt observed traffic that has been encrypted with the RSA cipher and to perform other private key operations...

CVE-2017-17427

CVE-2017-17427 concerns Radware Alteon devices with firmware 31.0.0.0–31.0.3.0, vulnerable to a Bleichenbacher adaptive-chosen ciphertext attack on RSA. This could enable decryption of observed RSA-encrypted traffic and conduct other private-key operations. Connected sources corroborate the vulne...

CVE-2017-17382

Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a...

19-Year-Old TLS Vulnerability Weakens Website Crypto

A vulnerability called ROBOT, first identified in 1998, has resurfaced. Impacted are leading websites ranging from Facebook to Paypal, which are vulnerable to attackers that could decrypt encrypted data and sign communications using the sites’ own private encryption key. The vulnerability is foun...

ROBOT Attack

BouncyCastle is vulnerable to the ROBOT attack. An attacker can leverage a variation of the Bleichenbacher chosen-cipher text attack to break confidentiality of TLS when used with RSA...

Design/Logic Flaw

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE Java Cryptography Extension for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable...

Design/Logic Flaw

wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as "ROBOT."...

CVE-2017-13099

wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as "ROBOT."...