deprecate MD2 in SSL cert validation (Kaminsky)

The Network Security Services NSS library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash...

Wget CA SSL畸形证书验证漏洞

BUGTRAQ ID: 36205 CVECAN ID: CVE-2009-3490 Wget是可使用HTTP、HTTPS和FTP协议的文件检索工具。 Wget没有正确地处理X.509证书主题通用名称（CN）字段域名中的空字符（\0），在处理包含有空字符的证书字段时错误地将空字符处理为截止字符，因此只会验证空字符前的部分。例如，对于类似于以下的名称： example.com\0.haxx.se 证书是发布给haxx.se的，但Wget错误的验证给example.com，这有助于攻击者通过中间人攻击执行网络钓鱼等欺骗。 Micah Cowan Wget 1.12 厂商补丁： RedHat...

RHEL 4 / 5 : wget (RHSA-2009:1549)

The remote Redhat Enterprise Linux 4 / 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2009:1549 advisory. - wget: incorrect verification of SSL certificate with NUL in name CVE-2009-3490 Note that Nessus has not tested for this issue but has instead...

wget: incorrect verification of SSL certificate with NUL in name

GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issu...

wget security update

1.11.4-3 - add fix for CVE-2009-3490, incorrect verification of SSL certificate with NUL in name...

[SECURITY] [DSA 1925-1] New proftpd-dfsg packages fix SSL certificate verification weakness

------------------------------------------------------------------------ Debian Security Advisory DSA-1925-1 [email protected] http://www.debian.org/security/ Steffen Joeris October 31, 2009 http://www.debian.org/security/faq -...

DSA-1925-1 proftpd-dfsg - SSL certificate verification weakness

Bulletin has no description...

openSUSE 10 Security Update : seamonkey (seamonkey-6538)

seamonkey was updated to version 1.1.18, fixing various security issues : MFSA 2009-43 / CVE-2009-2404 Moxie Marlinspike reported a heap overflow vulnerability in the code that handles regular expressions in certificate names. This vulnerability could be used to compromise the browser and run...

2wire Router <= 5.29.52 Remote DoS

No description provided by source. """ ======================================== 2WIRE REMOTE DENIAL OF SERVICE ======================================== Device: 2wire Gateway Router/Modem Vulnerable Software: 5.29.52 Vulnerable Models: 1700HG 1701HG 1800HW 2071 2700HG 2701HG-T Release Date:...

GNU Wget SSL Certificate Security Bypass

Binary data 800981.prm...

GNU Wget SSL Certificate Security Bypass

Binary data 5212.prm...

ProFTPD < 1.3.2b, 1.3.3 - 1.3.3.rc1 SSL Certificate Validation Bypass Vulnerability

ProFTPD is prone to a security bypass vulnerability because the application fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might b...

[SECURITY] [DSA 1916-1] New kdelibs packages fix SSL certificate verification weakness

------------------------------------------------------------------------ Debian Security Advisory DSA-1916-1 [email protected] http://www.debian.org/security/ Giuseppe Iuculano October 23, 2009 http://www.debian.org/security/faq -...

CVE-2009-3766

muttssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

DSA-1916-1 kdelibs - SSL certificate verification weakness

Bulletin has no description...

SuSE9 Security Update : epiphany (YOU Patch Number 12521)

seamonkey was updated to version 1.1.18, fixing various security issues : - Moxie Marlinspike reported a heap overflow vulnerability in the code that handles regular expressions in certificate names. This vulnerability could be used to compromise the browser and run arbitrary code by presenting a...

[SECURITY] [DSA 1904-1] New wget packages fix SSL certificate verification weakness

------------------------------------------------------------------------ Debian Security Advisory DSA-1904-1 [email protected] http://www.debian.org/security/ Giuseppe Iuculano October 09, 2009 http://www.debian.org/security/faq -...

DSA-1904-1 wget - SSL certificate verification weakness

Bulletin has no description...

Google Chrome CA SSL Certificate Security Bypass Vulnerability (Oct 2009)

Google Chrome Web Browser is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft IE CA SSL Certificate Security Bypass Vulnerability - Oct09

This host is installed with Internet Explorer and is prone to Security Bypass vulnerability. OpenVAS Vulnerability Test $Id: gbmsiesslcertisecbypassvulnoct09.nasl 6529 2017-07-05 06:05:51Z cfischer $ Microsoft IE CA SSL Certificate Security Bypass Vulnerability - Oct09 Authors: Sharath S Updated...