Microsoft Schannel Vulnerable to FREAK

Microsoft today issued an advisory warning Windows users that Secure Channel, or Schannel, the Windows implementation of SSL/TLS, is vulnerable to the FREAK attack. Disclosed this week, FREAK CVE-2015-1637 is the latest big Internet bug. It affects a number of SSL clients, including OpenSSL, and...

Security Advisory 3046015 released

Today, we released Security Advisory 3046015 to provide guidance to customers in response to the SSL/TLS issue referred to by researchers as “FREAK” Factoring attack on RSA-EXPORT Keys. Our investigation continues and we’ll take the necessary steps to protect our customers. MSRC Team...

MS KB3046015: Vulnerability in Schannel Could Allow Security Feature Bypass (FREAK)

The remote Windows host is affected by a security feature bypass vulnerability, known as FREAK Factoring attack on RSA-EXPORT Keys, due to the support of weak EXPORTRSA cipher suites with keys less than or equal to 512 bits. A man-in-the-middle attacker may be able to downgrade the SSL/TLS...

Google Chrome < 41.0.2272.76 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 41.0.2272.76. It is, therefore, affected by multiple vulnerabilities as referenced in the 201503stable-channel-update advisory. - Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM...

“Legacy”vulnerability: analysis of the new SSL/TLS vulnerability FREAK-vulnerability warning-the black bar safety net

Recently security researchers discovered a new SSL/TLS vulnerability. Expected within ten years, millions of Apple, Android users to access the HTTPS site will likely suffer from the middleman and then the stolen account and password, even if these sites use the encrypted transmission, also to no...

SSL/TLS EXPORT_RSA <= 512-bit Cipher Suites Supported (FREAK)

The remote host supports EXPORTRSA cipher suites with keys less than or equal to 512 bits. An attacker can factor a 512-bit RSA modulus in a short amount of time. A man-in-the middle attacker may be able to downgrade the session to use EXPORTRSA cipher suites e.g. CVE-2015-0204. Thus, it is...

SSL/TLS MiTM hijacking vulnerability warning-vulnerability warning-the black bar safety net

Dear users: Security researchers discover new SSL/TLS on a serious vulnerability. Find the vulnerability the researchers noted that the use of this encryption technology vulnerabilities, hackers can steal Apple Safari and Google Android browsers of the user communication. Vulnerability descriptio...

'FREAK' — New SSL/TLS Vulnerability Explained

Another new widespread and disastrous SSL/TLS vulnerability has been uncovered that for over a decade left Millions of users of Apple and Android devices vulnerable to man-in-the-middle attacks on encrypted traffic when they visited supposedly 'secured' websites, including the official websites o...

Security update for MozillaFirefox, mozilla-nss (important)

MozillaFirefox, mozilla-nss were updated to fix 18 security issues. MozillaFirefox was updated to version 36.0. These security issues were fixed: - CVE-2015-0835, CVE-2015-0836: Miscellaneous memory safety hazards - CVE-2015-0832: Appended period to hostnames can bypass HPKP and HSTS protections ...

RHEL 5 / 6 : Red Hat Satellite IBM Java Runtime (RHSA-2015:0264)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0264 advisory. This update corrects several security vulnerabilities in the IBM Java Runtime Environment shipped as part of Red Hat Satellite 5.6. In a...

Cisco Intrusion Prevention System Key Regeneration HTTPS Denial of Service Vulnerability

A vulnerability in the SSL/TLS subsystem used by the web management interface of Cisco Intrusion Prevention System IPS software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to a potential race condition while regenerating the...

RHEL 5 / 6 : java-1.5.0-ibm (RHSA-2015:0136)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0136 advisory. - ICU: font parsing OOB read OpenJDK 2D, 8055489 CVE-2014-6585 - ICU: font parsing OOB read OpenJDK 2D, 8056276 CVE-2014-6591 - OpenJDK:...

OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555)

It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption...

[SECURITY] Fedora 21 Update: polarssl-1.3.9-3.fc21

PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...

[SECURITY] Fedora 20 Update: polarssl-1.2.12-3.fc20

PolarSSL is a light-weight open source cryptographic and SSL/TLS library written in C. PolarSSL makes it easy for developers to include cryptographic and SSL/TLS capabilities in their embedded applications with as little hassle as possible...

[SECURITY] [DLA 144-1] polarssl security update

Package : polarssl Version : 1.2.9-1deb6u4 CVE ID : CVE-2015-1182 A vulnerability was discovered in PolarSSL, a lightweight crypto and SSL/TLS library. A remote attacker could exploit this flaw using specially crafted certificates to mount a denial of service against an application linked against...

DLA-144-1 polarssl - security update

Bulletin has no description...

Debian DSA-3141-1 : wireshark - security update

Multiple vulnerabilities were discovered in the dissectors/parsers for SSL/TLS and DEC DNA, which could result in denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-3141. T...

[SECURITY] [DSA 3141-1] wireshark security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3141-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 27, 2015 http://www.debian.org/security/faq -...

RHEL 7 : java-1.6.0-sun (RHSA-2015:0086)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0086 advisory. Oracle Java SE version 6 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes severa...