[slackware-security] httpd

New httpd packages are available for Slackware 12.0, 12.1, 12.2, 13.0, and -current to fix security issues. modssl: A partial fix for the TLS renegotiation prefix injection attack by rejecting any client-initiated renegotiations. modproxyajp: Respond with HTTPBADREQUEST when the body is not sent...

Apache < 2.2.15 Multiple Vulnerabilities

Binary data 5356.prm...

Apache < 2.2.15 Multiple Vulnerabilities

According to its banner, the version of Apache 2.2 installed on the remote host is older than 2.2.15. Such versions are potentially affected by multiple vulnerabilities : - A TLS renegotiation prefix attack is possible. CVE-2009-3555 - The 'modproxyajp' module returns the wrong status code if it...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

Fedora Update for httpd FEDORA-2009-12747

Check for the Version of httpd OpenVAS Vulnerability Test Fedora Update for httpd FEDORA-2009-12747 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

Low: Red Hat Security Advisory: JBoss Enterprise Web Server 1.0.1 update

JBoss Enterprise Web Server 1.0.1 is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having low security impact by the Red Hat Security Response Team. JBoss Enterprise Web Server is a fully integrated and certified set of components for hosting Java web...

SSL data injection

Data injection possibility connected with SSL in-session renegotiation...

Aruba Advisory ID: AID-020810 TLS Protocol Session Renegotiation Security Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Aruba Networks Security Advisory Title: TLS Protocol Session Renegotiation Security Vulnerability Aruba Advisory ID: AID-020810 Revision: 1.0 For Public Release on 02/08/2010 +---------------------------------------------------- SUMMARY This advisory...

Preemptive Protection against TLS and SSL Spoofing Vulnerability

Transport Layer Security TLS and Secure Sockets Layer SSL are cryptographic protocols that provide security for communications over networks. TLS and SSL encrypt the segments of network connections at the Transport Layer end-to-end.A spoofing vulnerability exists in multiple implementations of...

Moderate: Red Hat Security Advisory: httpd and httpd22 security update

Updated httpd and httpd22 packages that fix multiple security issues are now available for JBoss Enterprise Web Server 1.0.0 for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popul...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

Fedora Core 12 FEDORA-2009-13250 (proftpd)

The remote host is missing an update to proftpd announced via advisory FEDORA-2009-13250. OpenVAS Vulnerability Test $Id: fcore200913250.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-13250 proftpd Authors: Thomas Reinke Copyright: Copyright c 2009...

Fedora Core 12 FEDORA-2009-13250 (proftpd)

The remote host is missing an update to proftpd announced via advisory FEDORA-2009-13250. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by t...

Fedora 11 : proftpd-1.3.2c-1.fc11 (2009-13236)

This update addresses CVE-2009-3555 SSL/TLS renegotiation vulnerability, mitigating the problem by refusing all client-initiated SSL/TLS session renegotiations. This update to the latest maintenance release also fixes a number of bugs recorded in the proftpd bug tracker: - SSL/TLS renegotiation...

TLS Renegotiation Vulnerability: Proof of Concept Code (Python)

No description provided by source. I created a Camtasia Movie some time ago "exploiting" the vulnerability by injecting "/user/profile/E1/" into the first ssl request to "/" http://www.hacking-lab.com/download/ This can help others to understand the vulnerability. Regards Ivan -----Original...

TLS: MITM attacks via session renegotiation

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

TLS Renegotiation Vulnerability PoC Exploit

No description provided by source. !/usr/bin/env python RedTeam Pentesting GmbH [email protected] http://www.redteam-pentesting.de PoC exploit for the TLS renegotiation vulnerability CVE-2009-3555 License ------- CC-BY-SA http://creativecommons.org/licenses/by-sa/3.0/ Timeline -------...

TLS Renegotiation Exploit

!/usr/bin/env python RedTeam Pentesting GmbH [email protected] http://www.redteam-pentesting.de PoC exploit for the TLS renegotiation vulnerability CVE-2009-3555 License ------- CC-BY-SA http://creativecommons.org/licenses/by-sa/3.0/ Timeline -------- 2009-12-21 initial public release...

TLS - Renegotiation

!/usr/bin/env python RedTeam Pentesting GmbH [email protected] http://www.redteam-pentesting.de PoC exploit for the TLS renegotiation vulnerability CVE-2009-3555 License ------- CC-BY-SA http://creativecommons.org/licenses/by-sa/3.0/ Timeline -------- 2009-12-21 initial public release...