BlackBerry <= 7.1 and 10.x < 10.3.1.1779 SSL/TLS EXPORT_RSA Ciphers Downgrade MitM (KB36811) (FREAK)

Binary data blackberry10311779.nbin...

IT-Grundschutz M5.066: Clientseitige Verwendung von SSL/TLS

IT-Grundschutz M5.066: Clientseitige Verwendung von SSL/TLS. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM5066.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 5.066 Authors: Thomas Rotter Copyright: Copyright c 2015 Greenbone Networks GmbH,...

IT-Grundschutz M4.300: Informationsschutz bei Druckern, Kopierern und Multifunktionsgeräten

IT-Grundschutz M4.300: Informationsschutz bei Druckern, Kopierern und Multifunktionsgeräten Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM4300.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 4.300 Authors: Thomas Rotter Copyright: Copyright c...

IT-Grundschutz M5.066: Clientseitige Verwendung von SSL/TLS

IT-Grundschutz M5.066: Clientseitige Verwendung von SSL/TLS. Stand: 14. Ergaenzungslieferung 14. EL. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

openssl security update

CentOS Errata and Security Advisory CESA-2015:0715 Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

Cisco Intrusion Prevention System MainApp SSL/TLS DoS (cisco-sa-20150311-ips)

According to its self-reported version, the Cisco Intrusion Prevention System software running on the remote host is affected by a denial of service vulnerability within the SSL/TLS subsystem due to a race condition when handling multiple HTTPS requests on the management interface. A remote...

JVN#41281927: LINE vulnerable to script injection

LINE provided by LINE Corporation is an application used to communicate with others. LINE is vulnerable to MITM man-in-the-middle attacks since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM man-in-the-middle attacker. Impac...

[SECURITY] [DLA 176-1] mono security update

Package : mono Version : 2.6.7-5.1+deb6u1 CVE ID : CVE-2015-2318 CVE-2015-2319 CVE-2015-2320 Debian Bug : 780751 Three issues with Monos TLS stack are addressed. CVE-2015-2318 Monos implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various...

DLA-176-1 mono - security update

Bulletin has no description...

Opera < 28.0.1750.40 SSL/TLS EXPORT_RSA Ciphers Downgrade MitM (Mac OS X) (FREAK)

The remote Mac OS X host has a version of the Opera web browser installed that is prior to 28.0.1750.40. It is, therefore, affected by a security feature bypass vulnerability, known as FREAK Factoring attack on RSA-EXPORT Keys, due to the support of weak EXPORTRSA cipher suites with keys less tha...

APPLE-SA-2015-03-09-2 AppleTV 7.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-03-09-2 AppleTV 7.1 AppleTV 7.1 is now available and addresses the following: Apple TV Available for: Apple TV 3rd generation and later Impact: An attacker with a privileged network position may intercept SSL/TLS connections Description:...

Splunk Enterprise 6.2.x < 6.2.2 Multiple Vulnerabilities (FREAK)

According to its version number, the Splunk Enterprise hosted on the remote web server is version 6.2.x prior to 6.2.2. It is, therefore, affected by the following vulnerabilities : - A flaw exists with ECDH handshakes when using an ECDSA certificate without a ServerKeyExchange message. This allo...

Cisco Intrusion Prevention System MainApp Secure Socket Layer Denial of Service Vulnerability

The Cisco Intrusion Prevention System IPS Software has a vulnerability within the SSL/TLS subsystem utilized by the web management interface which could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. Cisco has released software updates that address this...

MS15-031: Vulnerability in Schannel Could Allow Security Feature Bypass (3046049) (FREAK)

The remote Windows host is affected by a security feature bypass vulnerability, known as FREAK Factoring attack on RSA-EXPORT Keys, due to the support of weak EXPORTRSA cipher suites with keys less than or equal to 512 bits. A man-in-the-middle attacker may be able to downgrade the SSL/TLS...

DSA-3177-1 mod-gnutls - security update

Bulletin has no description...

SSL/TLS implementations accept export-grade RSA keys (FREAK attack)

Overview Some implementations of SSL/TLS accept export-grade 512-bit or smaller RSA keys even when not specifically requesting export grade ciphers. An attacker able to act as a Man-in-The-Middle MiTM could factor weak temporary RSA keys, obtain session keys, and decrypt SSL/TLS trafflc. This iss...

mono -- TLS bugs

The Mono project reports: Mono’s implementation of the SSL/TLS stack failed to check the order of the handshake messages. Which would allow various attacks on the protocol to succeed. Details of this vulnerability are discussed in SKIP-TLS post. Mono’s implementation of SSL/TLS also contained...

SSL/TLS: RSA Temporary Key Handling 'RSA_EXPORT' Downgrade Issue (FREAK)

This host is accepting SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.805142";...

FREAK

FREAK Factoring Attack on RSA-EXPORT Keys CVE-2015-0204 is a weakness in some implementations of SSL/TLS that may allow an attacker to decrypt secure communications between vulnerable clients and servers. Google has released an updated version of its Android OS and Chrome browser for OS X to...

Microsoft: All Windows versions Vulnerable to FREAK Vulnerability

Recently discovered FREAK vulnerability that apparently went undetected for more than a decade is reportedly affecting all supported versions of Microsoft Windows, making the flaw more creepy than what we thought. FREAK vulnerability is a disastrous SSL/TLS flaw disclosed Monday that allows an...