1599 matches found
CVE-2014-4422
The kernel in Apple iOS before 8 and Apple TV before 7 uses a predictable random number generator during the early portion of the boot process, which allows attackers to bypass certain kernel-hardening protection mechanisms by using a user-space process to observe data related to the random numbe...
Design/Logic Flaw
The kernel in Apple iOS before 8 and Apple TV before 7 uses a predictable random number generator during the early portion of the boot process, which allows attackers to bypass certain kernel-hardening protection mechanisms by using a user-space process to observe data related to the random numbe...
CVE-2014-4422
CVE-2014-4422 concerns the Apple kernel hardening RNG used early in the boot process. The connected sources confirm that the issue allowed some RNG output to be inferable by user space, enabling bypass of kernel-hardening protections. A fix was applied by replacing the early-boot RNG with a crypt...
CVE-2014-4422
The kernel in Apple iOS before 8 and Apple TV before 7 uses a predictable random number generator during the early portion of the boot process, which allows attackers to bypass certain kernel-hardening protection mechanisms by using a user-space process to observe data related to the random numbe...
WPS Implementation Issue Exposes Wi-Fi Routers to Attack
A number of popular home and small office routers suffer from an implementation problem that could lead an experienced hacker down the road toward learning the devices’ eight-digit Wi-Fi Protected Setup WPS PINs in one guess. The attack, developed by Dominique Bongard, founder of 0xcite of...
Trio of Flaws Haunts OleumTech Wireless Monitoring System
Researchers have identified several remotely exploitable vulnerabilities in a wireless remote monitoring product from OleumTech that is used in energy, water and other critical infrastructure sectors. Two of the three flaws are related to the encryption implementation in the affected products,...
EFF Releases Open Wireless Router Firmware
The EFF is working on an open wireless router firmware that’s designed to be a secure and flexible alternative to the existing software that runs on home and small business routers, much of which is notoriously insecure. The Open Wireless Router project, which the organization announced at the HO...
LibreSSL PRNG Vulnerability Patched
The OpenBSD project late last night rushed out a patch for a vulnerability in the LibreSSL pseudo random number generator PRNG. The flaw was disclosed two days ago by the founder of secure backup company Opsmate, Andrew Ayer, who said the vulnerability was a “catastrophic failure of the PRNG.”...
ISC BIND 8 Remote Cache Poisoning Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/25459/info BIND 8 is prone to a remote cache-poisoning vulnerability because of weaknesses in its random-number generator. An attacker may leverage this issue to manipulate cache data, potentially facilitating...
GNU Classpath 0.97.2 'gnu.java.security.util.PRNG' Class Entropy Weakness (2)
No description provided by source. source: http://www.securityfocus.com/bid/32909/info GNU Classpath is prone to a weakness that may result in weaker cryptographic security because its psuedo-random number generator PRNG lacks entropy. Attackers may leverage this issue to obtain sensitive...
ZeroShell 'cgi-bin/kerbynet' - Local File Disclosure Vulnerability
No description provided by source. Introduction to the PoC : ====================================================================== In this distribution, the managment website is a binary file named kerbynet interpreted in cgi-bin directory here : /cdrom/usr/local/apache2/cgi-bin/kerbynet So all...
GNU Classpath 0.97.2 'gnu.java.security.util.PRNG' Class Entropy Weakness (1)
No description provided by source. source: http://www.securityfocus.com/bid/32909/info GNU Classpath is prone to a weakness that may result in weaker cryptographic security because its psuedo-random number generator PRNG lacks entropy. Attackers may leverage this issue to obtain sensitive...
Google Chrome <= 6.0.472 'Math.Random()' Random Number Generation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/36185/info Google Chrome is prone to security vulnerability that may allow the application to generate weak random numbers. Successfully exploiting this issue may allow attackers to obtain sensitive information or gain...
ISC BIND 8 Remote Cache Poisoning Vulnerability (1)
No description provided by source. source: http://www.securityfocus.com/bid/25459/info BIND 8 is prone to a remote cache-poisoning vulnerability because of weaknesses in its random-number generator. An attacker may leverage this issue to manipulate cache data, potentially facilitating...
Simple Machines Forum <= 1.1.5 Admin Reset Password Exploit (win32)
No description provided by source. ?php echo ---------------------------------------------------------------\n; echo SMF = 1.1.5 Admin Reset Password Exploit win32-based servers\n; echo coded by Raz0r http://Raz0r.name/\n; echo ---------------------------------------------------------------\n; if...
openSUSE Security Update : tor (openSUSE-SU-2014:0143-1)
fixes potentially poor random number generation for users who 1 use OpenSSL 1.0.0 or later, 2 set 'HardwareAccel 1' in their torrc file, 3 have 'Sandy Bridge' or 'Ivy Bridge' Intel processors and 4 have no state file in their DataDirectory as would happen on first start. Users who generated relay...
JDK: Vulnerability in the IBMSecureRandom implementation of the IBMJCE and IBMSecureRandom cryptographic providers
The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier f...
CVE-2014-0878
The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier f...
Code injection
The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier f...
CVE-2014-0878
The IBMSecureRandom component in the IBMJCE and IBMSecureRandom cryptographic providers in IBM SDK Java Technology Edition 5.0 before Service Refresh 16 FP6, 6 before Service Refresh 16, 6.0.1 before Service Refresh 8, 7 before Service Refresh 7, and 7R1 before Service Refresh 1 makes it easier f...