OWASP Zed Attack Proxy (ZAP) v.1.3.2 Released

OWASP Zed Attack Proxy ZAP v.1.3.2 Released The OWASP Zed Attack Proxy ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.It is designed to be used by people with a wide range of security experience and as such is ideal for developers and...

Apple Fixes SSL Man-in-the-Middle Bug in iOS 4.3.5

Apple has released another new version of its iOS operating system for iPhones and other devices that fixes a security vulnerability in the way that the software handled SSL certificates and validated their authenticity. An attacker exploiting the bug might be able to intercept SSL traffic, Apple...

Fedora Update for curl FEDORA-2011-8586

Check for the Version of curl OpenVAS Vulnerability Test Fedora Update for curl FEDORA-2011-8586 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Fedora Update for curl FEDORA-2011-8640

Check for the Version of curl OpenVAS Vulnerability Test Fedora Update for curl FEDORA-2011-8640 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

[USN-1158-1] curl vulnerabilities

========================================================================== Ubuntu Security Notice USN-1158-1 June 24, 2011 curl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...

Ubuntu Update for curl USN-1158-1

Ubuntu Update for Linux kernel vulnerabilities USN-1158-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN11581.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for curl USN-1158-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This...

Ubuntu: Security Advisory (USN-1158-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SuSE 11.1 Security Update : perl-libwww-perl (SAT Patch Number 4603)

This update fixes the issue that perl-libwww-perl does not enable host name verification of SSL certificates by default. This vulnerability could be exploited by a man in the middle attack. CVE-2011-0633 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks ...

CVE-2011-0633

The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...

Design/Logic Flaw

The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...

CVE-2011-0633

CVE-2011-0633 affects libwww-perl’s Net::HTTPS usage (prior to 6.00) as used by WWW::Mechanize and LWP::UserAgent. When environments do not set the If-SSL-Cert-Subject header, full SSL certificate validation is not enabled by default, enabling MITM-style spoofing via hostnames that are not proper...

CVE-2011-0633

The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...

About the security content of Safari 5.0.5

About the security content of Safari 5.0.5 Last Modified: April 14, 2011 Article: HT4596 Email this article Print this page Summary This document describes the security content of Safari 5.0.5. For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until...

Mac OS X Fraudulent Digital Certificates (Security Update 2011-002)

The remote host is running a version of Mac OS X 10.6 or 10.5 that does not have Security Update 2011-002 applied. A certificate authority CA has revoked a number of fraudulent SSL certificates for several prominent, public websites. Without this update, browsers will be unable to learn that the...

Comodo hacker claim no relation to Iranian Cyber Army !

Comodo hacker claim no relation to Iranian Cyber Army ! The alleged hacker of Comodo stepped forward this weekend to explain how he generated bogus SSL certificates for login.skype.com, mail.google.com, login.live.com and other popular internet websites. His story is that he was able to compromis...

Microsoft Windows Fraudulent Digital Certificates Spoofing Vulnerability

This NVT has been replaced by NVT gbmswindowsfraudulentdigitalcertspoofingvuln.nasl OID:1.3.6.1.4.1.25623.1.0.801953. The host is installed with Microsoft Windows operating system and is prone to Spoofing vulnerability. OpenVAS Vulnerability Test $Id:...

Mozilla Firefox 3.5.x < 3.5.18 Invalid HTTP Certificates

Binary data 5843.prm...

How Microsoft is Addressing the Fraudulent SSL Certs

...

Phony SSL Certificates issued for Google, Yahoo, Skype, Others

UPDATED: A major issuer of secure socket layer SSL certificates acknowledged on Wednesday that it had issued 9 fraudulent SSL certificates to seven Web domains, including those for Google.com, Yahoo.com and Skype.com following a security compromise at an affiliate firm. The attack originated from...

Fraudulent SSL Certificates

US-CERT is aware of public reports of the existence of fraudulent SSL certificates. These fraudulent SSL certificates could be used by an attacker to masquerade as a trusted website. Multiple web browser vendors have provided updates to recognize and block these fraudulent SSL certificates. Mozil...