FreeBSD-SA-16:09.ntp

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-16:09.ntp Security Advisory The FreeBSD Project Topic: Multiple vulnerabilities of ntp Category: contrib Module: ntp Announced: 2016-01-27 Credits: Cisco ASIG /...

FreeBSD : ntp -- multiple vulnerabilities (5237f5d7-c020-11e5-b397-d050996490d0)

Network Time Foundation reports : NTF's NTP Project has been notified of the following low- and medium-severity vulnerabilities that are fixed in ntp-4.2.8p6, released on Tuesday, 19 January 2016 : - Bug 2948 / CVE-2015-8158: Potential Infinite Loop in ntpq. Reported by Cisco ASIG. - Bug 2945 /...

Network Time Protocol Daemon (ntpd) 3.x / 4.x < 4.2.8p6 Multiple Vulnerabilities

The version of the remote NTP server is 3.x or 4.x prior to 4.2.8p6. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the receive function due to the use of authenticated broadcast mode. A man-in-the-middle attacker can exploit this to conduct a replay attack...

Network Time Protocol ntpq Control Protocol Replay Vulnerability

CERT VU357792 Summary The ntpq protocol is vulnerable to replay attacks. The sequence number being included under the signature fails to prevent replay attacks for two reasons. Commands that don’t require authentication can be used to move the sequence number forward, and NTP doesn’t actually car...

Network Time Protocol Deja Vu: Broadcast Mode Replay Vulnerability

Summary Expected Behavior: RFC 5905 page 29 Section 8 states that the on-wire protocol resists replay of server response packet in broadcast mode. Also on page 55 section 15, the RFC claims security in authenticated mode against on-path attackers where an attacker can: a Intercept and archive...

CVE-2015-4988

Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows remote attackers to read arbitrary fil...

CVE-2015-4988: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows remote attackers to read arbitrary fil...

PT-2016-3643

Name of the Vulnerable Software and Affected Versions IBM Tealeaf Customer Experience versions prior to 8.7.1.8818 IBM Tealeaf Customer Experience versions prior to 8.8.0.9026 IBM Tealeaf Customer Experience version 9.0.0 IBM Tealeaf Customer Experience version 9.0.0A IBM Tealeaf Customer...

Swift3 Replay Attack Vulnerability

OpenStack is a cloud platform management project.Swift is one of the storage projects for storing permanent static data.Swift3 is a middleware that provides access to OpenStack Swift through the Amazon S3 API. Swift3 has a security vulnerability that allows a remote attacker to perform a replay...

Authorization

Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header...

CVE-2015-8466

Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header...

CVE-2015-8466

Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header...

UBUNTU-CVE-2015-8466

Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header...

CVE-2015-8466

Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header...

CVE-2015-8466

Removed by vendor...

CVE-2015-8466

CVE-2015-8466 affects OpenStack Swift3 (S3 compatibility) middleware, allowing a remote replay attack when an Authorization request lacks a Date header. The issue is in Swift3 by default up to version 1.9. Public fixes are available in upstream Swift3 release 1.9. Debian lists fixed packages 1.7-...

CVE-2015-8466

Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header...

CVE-2015-8466: Improper Input Validation

Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header...

PT-2016-3904

Name of the Vulnerable Software and Affected Versions Swift3 versions prior to 1.9 Description The issue allows remote attackers to conduct replay attacks. This is possible via an Authorization request that lacks a Date header. Recommendations For versions prior to 1.9, update to version 1.9 or...

CVE-2015-8331

The Operation and Maintenance Unit OMU in Huawei VCN500 with software before V100R002C00SPC200 does not properly invalidate the session ID when an "abnormal exit" occurs, which allows remote attackers to conduct replay attacks via the session ID...