Authentication flaw

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions...

DEBIAN-CVE-2018-1128

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions...

CVE-2018-1128

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions...

CVE-2018-1128

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions...

CVE-2018-1128

CVE-2018-1128 describes a replay vulnerability in the Cephx authentication protocol where a packet sniffer on a Ceph cluster network can authenticate to Ceph services due to insufficient verification of clients. The issue affects the msgr2 protocol (used by most Ceph communication) and can compro...

CVE-2018-1128

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions...

SUSE-SU-2018:1920-1 Security update for ceph

This update for ceph to version ceph-12.2.5-419-g8cbf63d997 fixes the following issues: - CVE-2018-10861: Ensure that ceph-mon does perform authorization on all OSD pool ops bsc1099162. - CVE-2018-1129: cephx signature check bypass bsc1096748. - CVE-2018-1128: cephx protocol was vulnerable to...

PT-2018-10448

Name of the Vulnerable Software and Affected Versions Ceph branches master, mimic, luminous, and jewel are believed to be vulnerable. Description The cephx authentication protocol did not correctly verify Ceph clients, making it vulnerable to a replay attack. An attacker with access to the Ceph...

CVE-2018-1128: Authentication Bypass by Capture-replay

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions...

CVE-2018-1128

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to the ceph cluster network who is also able to sniff packets on the network can use this vulnerability to authenticate with ceph service and perfo...

Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple ntp vulnerabilities

Summary Multiple security vulnerabilities have been discovered in ntp that is embedded in the IBM FSM. This bulletin addresses these vulnerabilities. Vulnerability Details CVEID: CVE-2015-7705 DESCRIPTION: Network Time Protocol NTP is vulnerable to a denial of service, caused by an error in the...

S3QL Replay Attack Vulnerability

S3QL is a file system for storing online data. The system supports Amazon S3, SFTP servers, and more. A security vulnerability exists in the 'checksumbasicmapping' function in S3QL versions prior to 2.27. An attacker can exploit the vulnerability to display an old version of the metadata database...

DEBIAN-CVE-2018-12088

S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the backend can present old versions of the filesystem metadata database as up-to-date, temporarily inject zero-valued bytes into files, or temporarily hide parts of files. This is...

CVE-2018-12088: Improper Input Validation

S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the backend can present old versions of the filesystem metadata database as up-to-date, temporarily inject zero-valued bytes into files, or temporarily hide parts of files. This is...

PT-2018-11001

Name of the Vulnerable Software and Affected Versions S3QL versions prior to 2.27 Description The issue is related to mishandling of checksumming, allowing replay attacks. An attacker controlling the backend can present old versions of the filesystem metadata database as up-to-date, inject...

Rest Devices Mimo Baby Man-in-the-Middle Attack Vulnerability

Rest Devices Mimo Baby is a baby sleep tracker device from Rest Devices UK. A security vulnerability exists in Rest Devices Mimo Baby version 2, which stems from the program failing to properly perform authentication or encryption for Bluetooth Low Energy BLE communication between the Turtle and...

CVE-2018-10825

Mimo Baby 2 devices do not use authentication or encryption for the Bluetooth Low Energy BLE communication from a Turtle to a Lilypad, which allows attackers to inject fake information about the position and temperature of a baby via a replay or spoofing attack...

CVE-2018-10825

CVE-2018-10825 concerns Mimo Baby 2 devices, where BLE communications between the Turtle and Lilypad do not use authentication or encryption. This enables replay or spoofing attacks to inject false baby position and temperature data. The vulnerability description clearly identifies the affected c...

PT-2018-10128

Name of the Vulnerable Software and Affected Versions Mimo Baby 2 affected versions not specified Description The issue concerns a lack of authentication and encryption in Bluetooth Low Energy BLE communication, allowing attackers to inject fake information about a baby's position and temperature...

CVE-2018-10825: Improper Authentication

Mimo Baby 2 devices do not use authentication or encryption for the Bluetooth Low Energy BLE communication from a Turtle to a Lilypad, which allows attackers to inject fake information about the position and temperature of a baby via a replay or spoofing attack...