ESA-2012-014: RSA enVision Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-014: RSA enVision Multiple Vulnerabilities EMC Identifier:ESA-2012-014 CVE Identifiers: CVE-2012-0399, CVE-2012-0400, CVE-2012-0401, CVE-2012-0402, CVE-2012-0403 Severity Rating: CVSS Base Score: See below for scores for individual...

EMC RSA enVision multiple security vulnerabilities

Crossite scripting, SQL injection, directory traversal, hardcoded accounts, restrictions bypass...

Innominate MGuard Weak HTTPS and SSH Keys

Overview An independent research group comprised of Nadia Heninger, Zakir Durumeric, Eric Wustrow, and J. Alex Halderman identified an insufficient entropy vulnerability in Innominate’s mGuard network appliance product line. By impersonating the device, an attacker can obtain the credentials of...

FreeBSD : OpenSSL -- CMS and S/MIME Bleichenbacher attack (60eb344e-6eb1-11e1-8ad7-00e0815b8da8)

The OpenSSL Team reports : A weakness in the OpenSSL CMS and PKCS 7 code can be exploited using Bleichenbacher's attack on PKCS 1 v1.5 RSA padding also known as the million message attack MMA. Only users of CMS, PKCS 7, or S/MIME decryption operations are affected. A successful attack needs on...

Vulnerability in OpenSSL - CMS and S/MIME Bleichenbacher attack

A weakness in the OpenSSL CMS and PKCS 7 code can be exploited using Bleichenbacher’s attack on PKCS 1 v1.5 RSA padding also known as the million message attack MMA. Only users of CMS, PKCS 7, or S/MIME decryption operations are affected, SSL/TLS applications are not affected by this issue. Found...

OpenSSL -- CMS and S/MIME Bleichenbacher attack

The OpenSSL Team reports: A weakness in the OpenSSL CMS and PKCS 7 code can be exploited using Bleichenbacher's attack on PKCS 1 v1.5 RSA padding also known as the million message attack MMA. Only users of CMS, PKCS 7, or S/MIME decryption operations are affected. A successful attack needs on...

ESA-2012-013: RSA SecurID(r) Software Token Converter buffer overflow vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2012-013: RSA SecurID® Software Token Converter buffer overflow vulnerability Advisories Updated March 2, 2012 Summary: RSA SecurID® Software Token Converter contains a buffer overflow vulnerability that could allow a malicious user to compromise ...

RSA SecurID Software Token Converter buffer overflow

No description provided...

CVE-2012-0397

Buffer overflow in EMC RSA SecurID Software Token Converter before 2.6.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors...

Buffer overflow

Buffer overflow in EMC RSA SecurID Software Token Converter before 2.6.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors...

CVE-2012-0397

Buffer overflow in EMC RSA SecurID Software Token Converter before 2.6.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors...

CVE-2012-0397

The CVE-2012-0397 issue affects RSA SecurID Software Token Converter prior to version 2.6.1. A boundary/buffer overflow in the converter (notably when processing XML-formatted .sdtid strings) can be triggered remotely, potentially causing a denial of service or, in some cases, executing arbitrary...

Paul Judge on Measuring the Hotness of Security

Dennis Fisher talks with Paul Judge of Barracuda Labs about his new project, which uses data on the vendors and products on display at the RSA Conference to determine which topics and technologies are the hottest at the moment. Podcast audio courtesy of sykboy65 Subscribe to the Digital Undergrou...

RSA 2012: Mobile, Cloud, and Intelligent Control

It was good to catch up with our customers and partners at RSA 2012 this week. Much of the buzz this year was around mobile devices and securing the cloud. We were glad to see innovative organizations introducing compliance-validated architectures based on these emerging technologies. One such...

Microsoft RDP Server Private Key Information Disclosure Vulnerability

Remote Desktop Protocol server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

Cryptosystems Showing Signs of 'Wear and Tear'

SAN FRANCISCO– It’s been an interesting year in the cryptography world, with new attacks on several algorithms, continued problems with hash functions and the recent research on weak RSA keys. With all of that as a backdrop, some of the brightest minds in the field, gathered here for the RSA...

RSA: Chaos In the Security World, And the Situation Is Perfect

Right on cue this week, the anarchic hacking collective Anonymous stepped up and grabbed the story line away from the lions of the IT security industry. With the annual RSA Conference set to begin, the whistle blowing site Wikileaks released the first of some five million e-mail messages stolen...

Researchers to Detail WebKit Zero-Day on Android Phones at RSA Conference

Security researchers will be demonstrating an end-to-end phishing attack on Google Android phones that utilizes a zero-day vulnerability in Apple’s WebKit technology at the upcoming RSA Conference. The presentation, slated for Feb. 29, will be a coming-out party of sorts for new security firm...

What You Need to Know About the RSA Key Research

It’s always slightly disorienting and confusing when a story about something as esoteric as weak encryption keys produced by poor random number generators makes its way into the real world and begins scaring the citizens. This can lead to confusion and worry about whether everyone’s online bankin...

Weak RSA Keys Plague Embedded Devices, But Experts Caution Against Panic

If all of the noise about weak RSA keys and compromised cryptosystems in the last few days has done anything, it’s to confirm what many in the cryptography community have known for quite a long time: When it comes to implementing cryptosystems, there are a whole lot of people doing it wrong...