Eucalyptus Walrus REST Interface Key Verification Authentication Bypass (ESA-03)

The version of Eucalyptus Walrus hosted on the remote web server contains a flaw in the 'WalrusComponentLoginModule' class's 'authenticate' method that allows a remote, unauthenticated attacker to create, read, and write to buckets as an administrator. When an affected Walrus instance receives a...

U.S. Still Tops at Hosting Phishing Sites

There are a lot of things that the United States is no longer so good at doing: eating vegetables or winning major marathons, for example. But one thing that the U.S. still does really well is provide comfortable hosting platforms for phishing sites. In fact, about 60 percent of all phishing site...

Scientific Linux Security Update : ecryptfs-utils on SL5.x i386/x86_64

These updated ecryptfs-utils packages have been upgraded to upstream version 75, which provides a number of bug fixes and enhancements over the previous version. In addition, these packages provide a graphical program to help configure and use eCryptfs. To start this program, run the command :...

Scientific Linux Security Update : fence on SL4.x i386/x86_64

Insecure temporary file use flaws were found in fenceegenera, fenceapc, and fenceapcsnmp. A local attacker could use these flaws to overwrite an arbitrary file writable by the victim running those utilities via a symbolic link attack. CVE-2008-4192, CVE-2008-4579 This update also fixes the...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64

CVE-2009-0590 openssl: ASN1 printing crash CVE-2009-1377 OpenSSL: DTLS epoch record buffer memory DoS CVE-2009-1378 OpenSSL: DTLS fragment handling memory DoS CVE-2009-1379 OpenSSL: DTLS pointer use-after-free flaw DoS CVE-2009-1386 openssl: DTLS NULL deref crash on early ChangeCipherSpec request...

Scientific Linux Security Update : openssl on SL3.x i386/x86_64

A flaw was found in the SSLgetsharedciphers utility function. An attacker could send a list of ciphers to an application that used this function and overrun a buffer with a single byte CVE-2007-5135. Few applications make use of this vulnerable function and generally it is used only when...

Scientific Linux Security Update : openssl on SL5.x i386/x86_64

OpenSSL is a toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols as well as a full-strength general purpose cryptography library. Datagram TLS DTLS is a protocol based on TLS that is capable of securing datagram transport UDP for instance. The...

SSL Certificate Chain Contains Weak RSA Keys

At least one of the X.509 certificates sent by the remote host has a key that is shorter than 1024 bits. Such keys are considered weak due to advances in available computing power decreasing the time required to factor cryptographic keys. Some SSL implementations, notably Microsoft's, may conside...

Mac OS X Admin Group User List

Using the supplied credentials, Nessus was able to extract the member list of the 'Admin' and 'Wheel' groups. Members of these groups have administrative access to the remote system. TRUSTED...

EMC RSA Authentication Manager multiple security vulnerabilities

Crossite scripting, open redirection...

ESA-2012-023: RSA Authentication Manager Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-023: RSA® Authentication Manager Multiple Vulnerabilities EMC Identifier: ESA-2012-023 CVE Identifier: CVE-2012-2278, CVE-2012-2279, CVE-2012-2280 Severity Rating: See below for scores for individual issues Affected Products: RSA Authenticati...

CVE-2012-2279

Open redirect vulnerability in the Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2012-2280

EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 do not properly use frames, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "Cross frame scripting vulnerability."...

CVE-2012-2278

Multiple cross-site scripting XSS vulnerabilities in the 1 Self-Service Console and 2 Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the 1 Self-Service Console and 2 Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 do not properly use frames, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "Cross frame scripting vulnerability."...

Open redirect

Open redirect vulnerability in the Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2012-2278

Multiple cross-site scripting XSS vulnerabilities in the 1 Self-Service Console and 2 Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2279

Open redirect vulnerability in the Security Console in EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2012-2280

EMC RSA Authentication Manager 7.1 before SP4 P14 and RSA SecurID Appliance 3.0 before SP4 P14 do not properly use frames, which allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "Cross frame scripting vulnerability."...