3572 matches found
SuSE 11.1 Security Update : perl-libwww-perl (SAT Patch Number 4603)
This update fixes the issue that perl-libwww-perl does not enable host name verification of SSL certificates by default. This vulnerability could be exploited by a man in the middle attack. CVE-2011-0633 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...
CVE-2011-0633
The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...
Design/Logic Flaw
The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...
CVE-2011-0633
The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...
CVE-2011-0633
CVE-2011-0633 affects libwww-perl’s Net::HTTPS usage (prior to 6.00) as used by WWW::Mechanize and LWP::UserAgent. When environments do not set the If-SSL-Cert-Subject header, full SSL certificate validation is not enabled by default, enabling MITM-style spoofing via hostnames that are not proper...
About the security content of Safari 5.0.5
About the security content of Safari 5.0.5 Last Modified: April 14, 2011 Article: HT4596 Email this article Print this page Summary This document describes the security content of Safari 5.0.5. For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until...
Mac OS X Fraudulent Digital Certificates (Security Update 2011-002)
The remote host is running a version of Mac OS X 10.6 or 10.5 that does not have Security Update 2011-002 applied. A certificate authority CA has revoked a number of fraudulent SSL certificates for several prominent, public websites. Without this update, browsers will be unable to learn that the...
Comodo hacker claim no relation to Iranian Cyber Army !
Comodo hacker claim no relation to Iranian Cyber Army ! The alleged hacker of Comodo stepped forward this weekend to explain how he generated bogus SSL certificates for login.skype.com, mail.google.com, login.live.com and other popular internet websites. His story is that he was able to compromis...
Microsoft Windows Fraudulent Digital Certificates Spoofing Vulnerability
This NVT has been replaced by NVT gbmswindowsfraudulentdigitalcertspoofingvuln.nasl OID:1.3.6.1.4.1.25623.1.0.801953. The host is installed with Microsoft Windows operating system and is prone to Spoofing vulnerability. OpenVAS Vulnerability Test $Id:...
Mozilla Firefox 3.5.x < 3.5.18 Invalid HTTP Certificates
Binary data 5843.prm...
How Microsoft is Addressing the Fraudulent SSL Certs
...
Phony SSL Certificates issued for Google, Yahoo, Skype, Others
UPDATED: A major issuer of secure socket layer SSL certificates acknowledged on Wednesday that it had issued 9 fraudulent SSL certificates to seven Web domains, including those for Google.com, Yahoo.com and Skype.com following a security compromise at an affiliate firm. The attack originated from...
Fraudulent SSL Certificates
US-CERT is aware of public reports of the existence of fraudulent SSL certificates. These fraudulent SSL certificates could be used by an attacker to masquerade as a trusted website. Multiple web browser vendors have provided updates to recognize and block these fraudulent SSL certificates. Mozil...
Firefox < 3.5.18 Invalid HTTP Certificates
The installed version of Firefox is earlier than 3.5.18. Such versions have an out-of-date SSL certificate blacklist. A certificate authority CA has revoked a number of fraudulent SSL certificates for several prominent public websites. If an attacker can trick someone into using the affected...
SuSE 11 Security Update : PostgreSQL (SAT Patch Number 1766)
The following bugs have been fixed : - An unprivileged, authenticated PostgreSQL user could create a table which references functions with malicious content. Maintenance operations carried out be the database superuser could execute such functions. CVE-2009-4136 - Embedded null bytes in the commo...
Code injection
Wee Enhanced Environment for Chat aka WeeChat 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate, related to incorrect...
SuSE 10 Security Update : pidgin, gaim and finch (ZYPP Patch Number 5573)
specially crafted MSN SLP messages could cause an integer overflow in pidgin. Attackers could potentially exploit that to execute arbitrary code. CVE-2008-2927 - overly long file names in MSN file transfers could crash pidgin. CVE-2008-2955 - SSL certifcates were not verfied. Therefore piding...
CentOS 3 / 4 : seamonkey (CESA-2010:0781)
Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...
Low: Red Hat Security Advisory: nss security update
Updated nss packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fr...