1599 matches found
Micali-Schnorr Generator (MS-DRBG) Part III - Zero Knowledge Proof Wanted!!
See also Part I and Part II of this series This is going to be a short blog post about the infamous Micali-Schnorr Random Number Generator MS-DRBG. See Part I and Part II of this series for more information about this topic. WHO: NIST published the specification for Micali-Schnorr Random Number...
Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on the upstream 4.14.44 and fixes at least the following security issues: The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial...
The vulnerability of the mechanism for handling errors during the establishment of SSL connections for Qualcomm’s Android operating system allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the error handling mechanism for establishing SSL connections in Qualcomm’s Android operating system is related to improper error handling of errors returned by the RNG function. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality,...
CenoCipher - Easy-To-Use, End-To-End Crypto-Communication Tool
CenoCipher is a free, open-source, easy-to-use tool for exchanging secure encrypted communications over the internet. It uses strong cryptography to convert messages and files into encrypted cipher-data, which can then be sent to the recipient via regular email or any other channel available, suc...
Huntpad - The Bug Hunter's Notepad
Syhunt Huntpad is a notepad application with features that are particularly useful to penetration testers and bug hunters - a collection of common injection string generators, hash generators, encoders and decoders, HTML and text manipulation functions, and so on, coupled with syntax highlighting...
IBM Worklight and Mobile Foundation Weak Password Vulnerability
IBM Worklight and Mobile Foundation are both products of IBM Corporation in the U.S. IBM Worklight is a suite of integrated development environments IDEs for developing, testing, running, and managing mobile applications.Mobile Foundation is a suite of software for rapidly creating mobile and...
EulerOS 2.0 SP2 : gcc (EulerOS-SA-2018-1116)
According to the versions of the gcc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The gcc package contains the GNU Compiler Collection version 4.8.You'll need this package in order to compile C code. - Security fixes: - Under...
kernel: Null pointer dereference in rngapi_reset function
A flaw was found in the Linux kernel's random number generator API. A null pointer dereference in the rngapireset function may result in denial of service, crashing the system...
kernel: Null pointer dereference in rngapi_reset function
A flaw was found in the Linux kernel's random number generator API. A null pointer dereference in the rngapireset function may result in denial of service, crashing the system...
CVE-2018-9057
aws/resourceawsiamuserloginprofile.go in the HashiCorp Terraform Amazon Web Services AWS provider through v1.12.0 has an inappropriate PRNG algorithm and seeding, which makes it easier for remote attackers to obtain access by leveraging an IAM account that was provisioned with a weak password...
OracleVM 3.3 : dhcp (OVMSA-2018-0024)
The remote OracleVM system is missing necessary patches to address critical security updates : - Added oracle-errwarn-message.patch - Resolves: 1550085 - CVE-2018-5733 Avoid reference overflow 12:4.1.1-53.P1.2 - Resolves: 1550083 - CVE-2018-5732 Avoid options buffer overflow - Resolves: 1063217 -...
Insecure Number Generator
github.com/markbates/goth is vulnerable to insecure number generator. The SetState function in gothic.go uses math/rand which is a weak random number generator and not robust enough to withstand a cryptographic attack against it...
Encryption 101: ShiOne ransomware case study
In part one of this series, Encryption 101: a malware analyst's primer, we introduced some of the basic encryption concepts used in malware. If you haven't read it, we suggest going back for a review, as it's necessary in order to be able to fully follow part two, our case study. In this study, w...
[ASA-201801-11] qtpass: private key recovery
Arch Linux Security Advisory ASA-201801-11 ========================================== Severity: High Date : 2018-01-11 CVE-ID : CVE-2017-18021 Package : qtpass Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-576 Summary ======= The package qtpass before version...
How to try to predict the output of Micali-Schnorr Generator (MS-DRBG) knowing the factorization. Part II
See also Part I and Part III of this series tl;dr In the previous article of the same series we tried to predict the output of Micali-Schnorr Generator MS-DRBG knowing the factorization. In this blog post we continue the effort started in part I showing different strategies. If you want to skip a...
CVE-2017-15116
A flaw was found in the Linux kernel's random number generator API. A null pointer dereference in the rngapireset function may result in denial of service, crashing the system...
Mozilla Secure Open Source security review published
Mozilla Secure Open Source security review published Earlier this year we were contacted by Mozilla and notified that our application to the Mozilla Secure Open Source program was accepted and that we would be receiving a review through the SOS program. The SOS program provides security auditing,...
Insecure Random Number Generation
zeppelin is vulnerable to insecure random number generation. It is insecure because it generates predictable random numbers using java.util.Random rather than using a cryptographically secure random number generator...