openSUSE Security Update : jakarta-commons-httpclient3 (openSUSE-SU-2013:0354-1)

jakarta-commons-httpclient3 was updated to add SSL certificate hostname checking. CVE-2012-5783 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2013-161. The text description of this...

openSUSE Security Update : pidgin (openSUSE-SU-2013:0511-1)

Pidgin was updated to 2.10.7 to fix various security issues and the bug that IRC did not work at all in 12.3. Changes : - Add pidgin-irc-sasl.patch: link irc module to SASL. Allows the IRC module to be loaded bnc806975. - Update to version 2.10.7 bnc804742 : + Alien hatchery : - No changes +...

openSUSE Security Update : gnutls (openSUSE-SU-2014:0328-1)

The gnutls library was updated to fix SSL certificate validation. Remote man-in-the-middle attackers were able to make the verification believe that a SSL certificate is valid even though it was not. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

openSUSE Security Update : libgdata (openSUSE-SU-2012:0862-1)

Changes in libgdata : - Add libgdata-validate-ssl-cert.patch: validate SSL certificates for all connections. Fix bnc752088, CVE-2012-1177. - Add gnome-common BuildRequires and call gnome-autogen.sh: needed for above patch. - Pass --with-ca-certs=/etc/ssl/ca-bundle.pem to configure to let libgdata...

openSUSE Security Update : MozillaFirefox (openSUSE-SU-2012:1064-1)

Mozilla Firefox, Thunderbird, xulrunner, seamonkey 15.0 update bnc777588 - MFSA 2012-57/CVE-2012-1970 Miscellaneous memory safety hazards - MFSA 2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-20 12-1975 CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/ CVE-2012-3959...

openSUSE Security Update : mercurial (openSUSE-SU-2010:1029-1)

This update of mercurial improves the SSL certificate validation process. CVE-2010-4237: CVSS v2 Base Score: 4.3 moderate AV:N/AC:M/Au:N/C:N/I:P/A:N %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

openSUSE Security Update : python-glanceclient (openSUSE-SU-2013:1330-1)

This update of python-glanceclient fixed SSL certificate CNAME checking. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2013-646. The text description of this plugin is C SUSE LLC...

openSUSE Security Update : dovecot20 (openSUSE-SU-2012:0219-1)

In proxy mode dovecot did not verify that the SSL certificate of the remote actually matched the server name. Dovecot was updated to version 2.0.16 which fixes the problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

Mandriva Linux Security Advisory : curl (MDVSA-2014:110)

Updated curl packages fix security vulnerabilities : Paras Sethia discovered that libcurl would sometimes mix up multiple HTTP and HTTPS connections with NTLM authentication to the same server, sending requests for one user over the connection authenticated as a different user CVE-2014-0015...

Man-in-the-middle (MITM) Through SSL Certificate Check Bypass

wagon-http-shared4 is vulnerable to man-in-the-middle attack. The SSL certificate checks are not enabled by default which would allow remote attackers to spoof the server and perform a man-in-the-middle attack...

Wing FTP Rush insufficient certificate validation

SSL certificate is not validated...

CVE-2012-5662

x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2013-0289

Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

DEBIAN-CVE-2013-0289

Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2013-0289

Isync 0.4 before 1.0.6 fails to verify the server hostname against the CN/SubjectAltName in the X.509 certificate, enabling MITM spoofing with any valid cert. Affected software: isync prior to 1.0.6. Impact per sources: potential disclosure of passwords and other sensitive data. Mitigation: upgra...

CVE-2014-3750

The Bilyoner application before 2.3.1 for Android and before 4.6.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might allow remote attackers to spoof trusted web sites via a web page containing references to external sources in which 1 the certificate of the last loaded resource is checked, instead of for the main...

CVE-2010-4832

Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might allow remote attackers to spoof trusted web sites via a web page containing references to external sources in which 1 the certificate of the last loaded resource is checked, instead of for the main...

CVE-2010-4832

The CVE-2010-4832 issue affects Android OS prior to 2.2, where an incorrect SSL certificate may be displayed in certain cases, allowing remote attackers to spoof trusted sites. The root cause is that certificate verification could be performed against the certificate of the last loaded resource o...

Research Quantifies Forged SSL Certificates in the Wild

An attacker with a forged SSL certificate is quite the Internet villain these days, be he a criminal or government spy. In possession of such a cert, an attacker can easily decrypt and monitor traffic, steal credentials and other sensitive information from a network. And with sensitivity over...