CVE-2011-0633

The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...

PT-2011-2511

Name of the Vulnerable Software and Affected Versions libwww-perl LWP versions prior to 6.00 Description The issue allows remote attackers to conduct man-in-the-middle MITM attacks by spoofing servers due to inadequate validation of SSL certificates when the If-SSL-Cert-Subject header is not set...

CVE-2011-0633: Improper Input Validation

The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...

openSUSE Security Update : epiphany (openSUSE-SU-2010:1027-1)

epiphany does not support verification of ssl certificates. It nevertheless displayed all https connections as secure CVE-2010-3312. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

RHEL 6 : kdelibs (RHSA-2011:0464)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0464 advisory. The kdelibs packages provide libraries for the K Desktop Environment KDE. A cross-site scripting XSS flaw was found in the way KHTML, the HT...

Moderate: Red Hat Security Advisory: kdelibs security update

Updated kdelibs packages that fix two security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Two more Comodo registration authority accounts compromised !

Two more Comodo registration authority accounts compromised ! Certification company's humiliation drags on as hacker scalps two more Comodo registration authority accounts The Iranian hacker that managed to trick Comodo into issuing nine fraudulent certificates appears to have compromised two mor...

Debian DSA-2203-1 : nss - ssl certificate blacklist update

This update for the Network Security Service libraries marks several fraudulent HTTPS certificates as unstrusted. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-2203. The text itself is...

Eircom Netopia Router Backdoor

++++++++++++++++++++ FULL DISCLOSURE OF EIRCOM NETOPIA ROUTER BACKDOOR VULNERABILITY! Yes, failcom suck, and they did it again. DERP! They gave us a nice TELNET shell into their routers, and now we can mess about 'cos it spawns a root shell by magic! and magic is the actual command! They also lef...

MS KB2524375: Fraudulent Digital Certificates Could Allow Spoofing (deprecated)

The remote host is missing KB2524375, which updates the system's SSL certificate blacklist. A certificate authority CA has revoked a number of fraudulent SSL certificates for several prominent, public websites. Without this update, browsers will be unable to learn that the certificates have been...

Mozilla Firefox 3.5.x < 3.5.18 Invalid HTTP Certificates

Binary data 801236.prm...

Mozilla Firefox 3.6.x < 3.6.16 Invalid HTTP Certificates

Binary data 801340.prm...

SeaMonkey 2.0.x < 2.0.13 Invalid HTTP Certificates

Binary data 5844.prm...

Mozilla SeaMonkey 2.0.x < 2.0.13 Invalid HTTP Certificates

Binary data 801312.prm...

Blacklisted SSL Certificate

The remote service uses an SSL certificate that is either fraudulent, no longer secure due to leaked or compromised private keys, or was issued from a certificate authority that is considered to be untrustworthy. TRUSTED...

Debian DSA-2199-1 : iceape - ssl certificate blacklist update

This update for the Iceape internet suite, an unbranded version of SeaMonkey, updates the certificate blacklist for several fraudulent HTTPS certificates. More details can be found in a blog posting by Jacob Appelbaum of the Tor project. The oldstable distribution lenny is not affected. The iceap...

Debian DSA-2200-1 : iceweasel - ssl certificate blacklist update

This update for Iceweasel, a web browser based on Firefox, updates the certificate blacklist for several fraudulent HTTPS certificates. More details can be found in a blog posting by Jacob Appelbaum of the Tor project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mozilla Thunderbird 3.1 < 3.1.9 Invalid HTTP Certificates

The installed version of Thunderbird 3.1 is earlier than 3.1.9. Such versions have an out-of-date SSL certificate blacklist. A certificate authority CA has revoked a number of fraudulent SSL certificates for several prominent public websites. If an attacker can trick someone into using the affect...

Firefox 3.6 < 3.6.16 Invalid HTTP Certificates

The installed version of Firefox 3.6 is earlier than 3.6.16. Such versions have an out-of-date SSL certificate blacklist. A certificate authority CA has revoked a number of fraudulent SSL certificates for several prominent public websites. If an attacker can trick someone into using the affected...

SeaMonkey < 2.0.13 Invalid HTTP Certificates

The installed version of SeaMonkey is earlier than 2.0.13. Such versions have an out-of-date SSL certificate blacklist. A certificate authority CA has revoked a number of fraudulent SSL certificates for several prominent public websites. If an attacker can trick someone into using the affected...