Ubuntu: Security Advisory (USN-3301-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS : strongSwan vulnerabilities (USN-3301-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3301-1 advisory. It was discovered that the strongSwan gmp plugin incorrectly validated RSA public keys. A remote attacker could use this issue to cause...

Debian DSA-3866-1 : strongswan - security update

Two denial of service vulnerabilities were identified in strongSwan, an IKE/IPsec suite, using Google's OSS-Fuzz fuzzing project. - CVE-2017-9022 RSA public keys passed to the gmp plugin aren't validated sufficiently before attempting signature verification, so that invalid input might lead to a...

USN-3301-1 strongswan vulnerabilities

It was discovered that the strongSwan gmp plugin incorrectly validated RSA public keys. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service. CVE-2017-9022 It was discovered that strongSwan incorrectly parsed ASN.1 CHOICE types. A remote attacker...

USN-3301-1: strongSwan vulnerabilities

It was discovered that the strongSwan gmp plugin incorrectly validated RSA public keys. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service. CVE-2017-9022 It was discovered that strongSwan incorrectly parsed ASN.1 CHOICE types. A remote attacker...

[SECURITY] [DSA 3866-1] strongswan security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3866-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez May 30, 2017 https://www.debian.org/security/faq -...

CVE-2017-9022

The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpzpowmsec, which allows remote peers to cause a denial of service floating point exception and process crash via a crafted certificate...

PT-2017-18649

Name of the Vulnerable Software and Affected Versions strongSwan versions prior to 5.5.3 Description The issue is related to the improper validation of RSA public keys in the gmp plugin, which can lead to a denial of service. This occurs when remote peers send crafted certificates, causing a...

Debian Security Advisory DSA 3866-1 (strongswan - security update)

Two denial of service vulnerabilities were identified in strongSwan, an IKE/IPsec suite, using Google OpenVAS Vulnerability Test $Id: deb3866.nasl 6607 2017-07-07 12:04:25Z cfischer $ Auto-generated from advisory DSA 3866-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright...

strongswan -- multiple vulnerabilities

strongSwan security team reports: RSA public keys passed to the gmp plugin aren't validated sufficiently before attempting signature verification, so that invalid input might lead to a floating point exception. CVE-2017-9022 ASN.1 CHOICE types are not correctly handled by the ASN.1 parser when...

Android Overlay and Accessibility Features Leave Millions at Risk

University researchers are warning that two features, not flaws, core to Google’s Android mobile operating system can be used together to launch clickjacking attacks to gain control of a target’s phone. The discovery was made by researchers at Georgia Institute of Technology, who call the researc...

Cross site scripting

EMC RSA Adaptive Authentication On-Premise versions prior to 7.3 P2 exclusive contains a fix for a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system...

CVE-2017-4978

EMC RSA Adaptive Authentication On-Premise versions prior to 7.3 P2 exclusive contains a fix for a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system...

CVE-2017-4978

EMC RSA Adaptive Authentication On-Premise versions prior to 7.3 P2 exclusive contains a fix for a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system...

CVE-2017-4978

EMC RSA Adaptive Authentication (On-Premise) contains a cross-site scripting vulnerability in versions prior to 7.3 P2. The issue affects the product’s web interface, enabling an attacker to potentially access a user’s cookies (including authentication cookies) and compromise the target user sess...

CVE-2017-4978

EMC RSA Adaptive Authentication On-Premise versions prior to 7.3 P2 exclusive contains a fix for a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system...

community.rsa.com Open Redirect vulnerability

Vulnerable URL: https://community.rsa.com/external-link.jspa?url=http://openbugbounty%E3%80%82org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.08.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...

F5 Networks BIG-IP : OpenSSL vulnerability (K23196136) (DROWN)

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by...

Business Email Compromise Losses Up 2,370 Percent Since 2015

Business Email Compromise BEC schemes, where executives are scammed via social engineering and phishing compromises that ultimately lead to fraudulent wire transfers, grew at a jaw-dropping rate of 2,370 percent in the last two years. The FBI yesterday published its latest statistics on these...

CVE-2016-7055

There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is...