MySQL SSL/TLS connection there is a security vulnerability, by the man in the middle attacks-vulnerability warning-the black bar safety net

Due to the client in the connection to MySQL when the SSL options are used improperly, may cause middle attack. The vulnerability will cause the database to the communication data in plaintext form in the network transmission. Vulnerability details This vulnerability with the client”–ssl”option h...

VMware vSphere Update Manager Java Vulnerability (VMSA-2015-0003)

The version of VMware vSphere Update Manager installed on the remote Windows host is 5.0 prior to Update 3d, 5.1 prior to Update 3a, 5.5 prior to Update 2e, or 6.0 prior to 6.0.0a. It is, therefore, affected by a vulnerability related to the bundled version of Oracle JRE prior to 1.7.076. A flaw...

New MySQL Bug Can Strip SSL Protection From Connections

Researchers have identified a serious vulnerability in some versions of Oracle’s MySQL database product that allows an attacker to strip SSL/TLS connections of their security wrapping transparently. The vulnerability is the result of the way that an option in MySQL handles requests for secure...

dovecot: denial of service

Dovecot = 2.2.14 does not correctly handle SSL/TLS handshake failure in the login process, asking OpenSSL to flush a connection that has already been aborted. This results in a crash with some versions of OpenSSL most likely = 1.0.2. A patch to OpenSSL has also been written to handle more...

Important: Red Hat Security Advisory: Red Hat JBoss BRMS 6.1.0 update

Red Hat JBoss BRMS 6.1.0, which fixes multiple security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...

Juniper Junos QFX Low Entropy Vulnerability (JSA10678)

According to its self-reported version number, the remote Juniper Junos device is affected by a low entropy vulnerability due to an insufficient number of bytes being collected from the RANDOMINTERRUPT entropy source when the device is first booted, thus resulting in the generation of weak SSH ke...

AIX IBM SDK Java JSSE vulnerability

IBM SECURITY ADVISORY First Issued: Mon Apr 13 12:11:24 CDT 2015 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/javajsseadvisory.asc https://aix.software.ibm.com/aix/efixes/security/javajsseadvisory.asc...

Fortinet FortiWEB Detection via SSL/TLS

Binary data 8646.prm...

openssl-fips security update

1.0.1m-2.0.1 - update to upstream 1.0.1m - update to fips canister 2.0.9 - regenerated below patches openssl-1.0.1-beta2-rpmbuild.patch openssl-1.0.1m-rhcompat.patch openssl-1.0.1m-ecc-suiteb.patch openssl-1.0.1m-fips-mode.patch openssl-1.0.1m-version.patch openssl-1.0.1m-evp-devel.patch...

FREAK Attack: How to Protect Yourself

The recently disclosed FREAK Factoring attack on RSA Export Keys attack is an SSL/TLS vulnerability that is affecting major browsers, servers and even mobile devices. FREAK vulnerability allows the attacker to intercept HTTPS connections between vulnerable clients and servers and force them to us...

SSL/TLS Suffers ‘Bar Mitzvah Attack’vulnerability detection method and repair recommendations-vulnerability warning-the black bar safety net

0x01 introduction April Fool's Day is coming, and SSL again due to the Bar Mitzvah Attack vulnerability to get everyone to not mind. Held in Singapore's Black Hat Asia Security Conference, the Imperva security Director Itsik Mantin detailed description of how to use the attack principle,the...

By the commandment of the ritual attack: - SSL/TLS and exposure of new vulnerabilities, plaintext read data transmission-vulnerability warning-the black bar safety net

! The SSL/TLS Protocol is a widely used encryption Protocol, and researchers recently have exposed a section called“by the commandment of ritual”new means of attack, to steal through the SSL and TLS Protocol of the transmission of confidential data such as Bank card numbers, passwords and other...

Mandriva Linux Security Advisory : dovecot (MDVSA-2015:113)

Updated dovecot packages fix security vulnerability. Dovecot before 2.2.13 is vulnerable to a DoS attack against imap/pop3-login processes. If SSL/TLS handshake was started but wasn't finished, the login process attempted to eventually forcibly disconnect the client, but failed to do it correctly...

BlackBerry Enterprise Server SSL/TLS EXPORT_RSA Ciphers Downgrade MitM (KB36811) (FREAK)

The version of BlackBerry Enterprise Server on the remote host is affected by a security feature bypass vulnerability, known as FREAK Factoring attack on RSA-EXPORT Keys, due to the support of weak EXPORTRSA cipher suites with keys less than or equal to 512 bits. A man-in-the-middle attacker may ...

BlackBerry <= 7.1 and 10.x < 10.3.1.1779 SSL/TLS EXPORT_RSA Ciphers Downgrade MitM (KB36811) (FREAK)

Binary data blackberry10311779.nbin...

IT-Grundschutz M5.066: Clientseitige Verwendung von SSL/TLS

IT-Grundschutz M5.066: Clientseitige Verwendung von SSL/TLS. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM5066.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 5.066 Authors: Thomas Rotter Copyright: Copyright c 2015 Greenbone Networks GmbH,...

IT-Grundschutz M4.300: Informationsschutz bei Druckern, Kopierern und Multifunktionsgeräten

IT-Grundschutz M4.300: Informationsschutz bei Druckern, Kopierern und Multifunktionsgeräten Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM4300.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 4.300 Authors: Thomas Rotter Copyright: Copyright c...

IT-Grundschutz M5.066: Clientseitige Verwendung von SSL/TLS

IT-Grundschutz M5.066: Clientseitige Verwendung von SSL/TLS. Stand: 14. Ergaenzungslieferung 14. EL. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

openssl security update

CentOS Errata and Security Advisory CESA-2015:0715 Updated openssl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

Cisco Intrusion Prevention System MainApp SSL/TLS DoS (cisco-sa-20150311-ips)

According to its self-reported version, the Cisco Intrusion Prevention System software running on the remote host is affected by a denial of service vulnerability within the SSL/TLS subsystem due to a race condition when handling multiple HTTPS requests on the management interface. A remote...