SuSE 10 Security Update : IBM Java 1.4.2 (ZYPP Patch Number 7036)

IBM Java 1.4.2 was updated to version U13 FP 4 iFixes to fix the SSL renegotiation flaw reported as CVE-2009-3555, as well as SAP installer related bugs. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE 10 Security Update : Apache2 (ZYPP Patch Number 7882)

This update fixes several security issues in the Apache2 webserver. - This update also includes several fixes for a modproxy reverse exposure via RewriteRule or ProxyPassMatch directives. CVE-2011-3639 / CVE-2011-3368 / CVE-2011-4317 - Fixed the SSL renegotiation DoS by disabling renegotiation by...

SuSE 11.1 Security Update : Apache2 (SAT Patch Number 5482)

This update fixes several security issues in the Apache2 webserver. - This update also includes several fixes for a modproxy reverse exposure via RewriteRule or ProxyPassMatch directives. CVE-2011-3639 / CVE-2011-3368 / CVE-2011-4317 - Fixed the SSL renegotiation DoS by disabling renegotiation by...

The Hacker's Choice releases SSL DOS Tool

The Hacker's Choice releases SSL DOS Tool German hacker group "The Hacker's Choice" officially released a new DDoS tool. The tool exploits a weakness in SSL to kick a server off the Internet. Establishing a secure SSL connection requires 15x more processingpower on the server than on the...

The Hacker's Choice releases SSL DOS Tool

The Hacker's Choice releases SSL DOS Tool German hacker group "The Hacker's Choice" officially released a new DDoS tool. The tool exploits a weakness in SSL to kick a server off the Internet. Establishing a secure SSL connection requires 15x more processingpower on the server than on the...

openSUSE Security Update : gnutls (openSUSE-SU-2010:1025-1)

The SSL-renegotiation 'authentication gap' has been fixed in gnutls. CVE-2009-3555 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update gnutls-3388. The text...

SuSE9 Security Update : GnuTLS (YOU Patch Number 12705)

The SSL-renegotiation 'authentication gap' has been fixed in GnuTLS. CVE-2009-3555 Also a integer size issue was fixed which lead to incorrectly accepted certificates. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 7299)

The SSL-renegotiation 'authentication gap' has been fixed in GnuTLS. CVE-2009-3555 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid51748; scriptversion"1.11";...

SuSE 11 / 11.1 Security Update : IBM Java 1.4.2 (SAT Patch Numbers 2413 / 2483)

IBM Java 1.4.2 was updated to Version U13 FP 4 iFixes, to fix the SSL renegotiation flaw reported via CVE-2009-3555. Also, SAP installer related bugs have been fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Su...

SuSE 11 / 11.1 Security Update : GnuTLS (SAT Patch Numbers 3650 / 3651)

The SSL-renegotiation 'authentication gap' has been fixed in GnuTLS. CVE-2009-3555 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is...

SuSE9 Security Update : IBM Java 1.4.2 (YOU Patch Number 12621)

IBM Java 1.4.2 was updated to Version U13 FP 4 iFixes, to fix the SSL renegotiation flaw reported as CVE-2009-3555, and also SAP installer related bugs. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

Oracle OpenOffice.org < 3.2.1 Multiple Vulnerabilities

The version of Oracle OpenOffice.org installed on the remote host is prior to 3.2.1. It is, therefore, affected by several issues : - There is a TLS/SSL renegotiation vulnerability in the included third-party OpenSSL library. CVE-2009-3555 - There is a python scripting vulnerability that could le...

SuSE 10 Security Update : Mozilla NSS (ZYPP Patch Number 6977)

Mozilla NSS was updated to version 3.12.6. This fixes all currently known issues in mozilla-nss, and also implements the new TLS/SSL renegotiation handling. CVE-2009-3555 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

openSUSE Security Update : libfreebl3 (openSUSE-SU-2010:0100-1)

Mozilla NSS was updated to version 3.12.6. This fixes all currently known issues in mozilla-nss, and also implements the new TLS/SSL renegotiation handling CVE-2009-3555. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fro...

SSL renegotiation attacks detailed explanation-vulnerability warning-the black bar safety net

English good friends can see my English blog on the original. The attack uses the SSL Protocol renegotiation vulnerability, allowing an attacker to man in the middle attacks way in the communication of the initial portion of the insertion of any selected plaintext. The following assuming you on t...

Sourcefire November Vulnerability Report

Sourcefire VRT researcher Alain Zidouemba talks about Microsoft Patch Tuesday, the SSL renegotiation flaw and the iPhone worm...

SOL10737 - SSL Renegotiation vulnerability - CVE-2009-3555 / VU#120541

A Man in the Middle attack allows an attacker to inject an arbitrary amount of chosen plain text into the application protocol stream data during a secure session renegotiation that uses SSL version 3.x or TLS version 1.x. This may provide an attacker the ability to perform arbitrary actions on...

Google Chrome < 2.0.172.33 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is earlier than 2.0.172.33. Such versions are reportedly affected by multiple issues : - A buffer overflow caused by handling unspecified HTTP responses. This could lead to a denial of service or execution of arbitrary code. CVE-2009-2121 ...